Free template
An AI acceptable use policy template,
written for Canadian firms.
A complete, adaptable policy for Canadian professional firms: tool approval, data rules by class, AI agents, incident reporting, and the records that show the policy operates. Your counsel makes it yours.
What's inside
Thirteen sections, five appendices, nine pages
Written in plain language a managing partner can adopt and a lawyer can mark up. Placeholders are highlighted; guidance notes tell the adapter what to delete.
-
Scope that matches how AI actually arrives
Three kinds of use are covered, not one: standalone chat tools, AI features inside software you already license, and AI agents that take actions such as sending messages or filing documents.
-
Data rules by class
Seven information classes with blunt rules per class: credentials never, client and personal information only in tools approved for that class and at the minimum needed, public material generally permitted.
-
An AI agents section
No agent acts on client matters, funds, or external communications without a named person authorizing that category of action. Every agent sits in the tool register with its permitted actions.
-
A workforce monitoring notice
Enforcing a policy means logging use, so the template says that plainly to staff instead of hiding it, and flags the Ontario written electronic monitoring policy question for counsel.
-
Evidence expectations throughout
Every section ends with one line naming the record that would show it is followed: a register, a signed form, a dated note. Appendix B collects all ten into a single page for an auditor, an insurer, or your board.
-
Counsel questions, not counsel answers
Appendix C puts the PIPEDA, Law 25, PHIPA, HIA, and PIPA questions to your lawyer instead of guessing at them, and Appendix D adds optional clause modules for legal, accounting, and health organizations.
Adoption
Four steps from template to policy
-
Name the owner
One role holds the policy, the tool register, and the exception log. Managing partner, privacy officer, or IT lead; what matters is that it's one named person.
-
Fill the placeholders, pick your module
Every bracketed value is highlighted in the Word version. Optional clause modules cover legal, accounting, and health organizations.
-
Put Appendix C to your counsel
The legal questions are drafted and sorted by statute. Your lawyer's answers shape the final policy; the one-page checklist version arrives with the template.
-
Roll out with acknowledgment
Staff sign the acknowledgment form at onboarding and annually. The review section keeps the policy alive after adoption.
Before you adopt it
The template is a starting point, not legal advice, and it says so on page one. Have a lawyer or privacy professional adapt it before adoption. Firms with Quebec operations should ask counsel about Law 25's requirements and French-language obligations early; the template flags both.
The honest limit
A policy is half the control
A policy on its own
Sets an obligation, leaves no record
The document tells staff what not to do. It can't tell you whether they did it, and it gives an auditor, an insurer, or a client's counsel nothing to examine. The template's evidence checklist narrows that gap by hand; it doesn't close it.
A policy with a mechanism
Enforced at the point of use, with a record
Mandate turns written rules into decisions on live AI traffic: allow, warn, redact, block, or escalate, each one leaving a tamper-evident audit record you can export and verify independently.
Mandate doesn't replace your AI policy. It gives your policy a mechanism and a record; the FAQ answer on exactly this question says more, and How it works shows the mechanism.
-
See what an enforcement record looks like
Download a sample evidence pack and verify its hashes and signatures on your own machine. Verify a pack →
-
The Canadian AI governance gap
What IBM's May 2026 Canadian survey says about the distance between AI adoption and AI governance. Read the note →
-
Trust & security
How Mandate handles data, keys, and audit records, described so your counsel can evaluate it. Read the posture →