AI usage guidelines aligned with the NIST AI RMF

Context

Staff were already curious about generative AI tools, and the firm handles sensitive client information. Banning AI outright tends to push its use out of sight. Allowing it with no guidance risks confidential data ending up somewhere it shouldn’t.

The firm needed clear, readable rules: what is allowed, what is not, and why.

Approach

• Started from the acceptable use policy. AI guidance was written as an extension of existing acceptable-use expectations, not as a standalone document that competes with them.
• Used the NIST AI Risk Management Framework as the backbone. Its four functions (Govern, Map, Measure, Manage) gave a ready-made structure: who is accountable, where AI is used, how risks are judged, and what happens when something goes wrong.
• Wrote for the reader, not the auditor. The guidance focuses on the decisions people actually face, such as whether a given piece of information can go into a given tool, while still giving reviewers a framework they recognize.

Key decisions

• Guidance over prohibition. Clear rules about data handling make safe use easier than unsafe use.
• A recognized framework means the policy can be explained to clients, insurers, and auditors without starting from scratch.

Outcome

Published AI usage guidelines that sit alongside the firm’s acceptable use policy and give staff a clear answer to “can I use this?”

What’s next

Review the guidance as tools and regulation change, and turn the lessons into material that helps other regulated organizations adopt AI carefully.