A one-page AI acceptable-use policy you can actually get signed

Disclosure: I co-founded Mitosis Labs, which runs Private SuperIntelligence. This is an adaptation of the original guide written for family offices.

IBM's 2025 Cost of a Data Breach Report found that 63% of breached organizations either had no AI governance policy or were still developing one, and only 37% had policies to manage AI or detect shadow AI. Organizations with high levels of shadow AI saw breach costs $670,000 higher on average. Most small professional offices need a page people will sign.

The access problem is account type

On ChatGPT's personal Free, Plus and Pro plans, OpenAI may use chats for training unless the user turns off "Improve the model for everyone". Business, Enterprise, Edu and the API don't train by default. A staff member who pastes a client memo into a personal account has chosen the terms, not the firm.

Eight clauses that fit on one page

1. Scope. Every employee, contractor and adviser, any device.
2. Approved tools. Name each tool and the account type. Personal AI accounts are not approved, even with training off.
3. Never list, in nouns. Tax returns, K-1s, trust and estate documents, account numbers, wire instructions, passwords, health information, travel plans, home addresses, security arrangements, passports, anything a client asked to keep private.
4. Agency. Tools may read, summarize and draft. A named person approves before send, share, record change or payment. No AI tool releases a wire. OWASP's 2025 LLM Top 10 calls the failure mode "excessive agency".
5. Output check. The human who sends it owns every figure, date and name.
6. New tools. Ask the owner first. Five vendor questions: training, retention, processing location, permissions, exit.
7. Incidents. Same-day report. No discipline for reporting quickly.
8. Outside advisers. Ask which tools they use on your matters.

Start the approved list by asking, without blame, what people already tried in the last three months. Two tools they use beat a ban they work around.

Mapping to NIST without adopting the whole RMF

NIST's AI RMF 1.0 (NIST AI 100-1, January 26, 2023) is voluntary. Four functions: Govern, Map, Measure, Manage. Owner and sign-off are Govern. Approved tools and the never list are Map. Output checks and vendor review are Measure. Approval limits and incident reporting are Manage. NIST added a Generative AI Profile (NIST AI 600-1) in July 2024. That mapping gives an investment committee or insurer a short, standard answer about the written policy.

Keep a dated register of approved tools and decisions. Read the policy aloud with staff. Review every six months and sooner when a tool can act on the family's behalf. This is general information, not legal advice.

We built Private SuperIntelligence as an AI concierge for one family office, working across that family's own email, documents and data with citations, within permissions the office sets, so clause 4 is a configuration, not a hope.

Speak with the founders

Private SuperIntelligence takes a limited number of families at a time so every one gets the same standard of service. Book a private call to talk through your office with Alex Morris.

Prakshal Jain (PJ), Co-founder and CTO, Private SuperIntelligence (by Mitosis Labs)

Alexander Morris, Co-founder and CEO, Private SuperIntelligence (by Mitosis Labs)

Originally published at privatesuperintelligence.si.

Sources: NIST AI RMF https://www.nist.gov/itl/ai-risk-management-framework ; IBM Newsroom, July 30, 2025 https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls ; OWASP Top 10 for LLM Applications 2025 https://genai.owasp.org/llm-top-10/ ; OpenAI Help Center on model training and ChatGPT Business.

Piece ID: FOP1-DEV