Safe AI and AI governance
Tier 1 helps law firms and high-trust consultancies find the AI already in use, set a clear line around sensitive information and build oversight that people can follow.
Section 02
Client material entered into an unapproved tool may be processed outside the firm's approved systems under terms the firm has not assessed. AI output can also be wrong while sounding convincing. Both issues need practical controls.
Section 03
The goal is safe, useful adoption with named accountability, not a large policy exercise.
Record approved, trial and prohibited tools, their owners, purposes, users and information.
Define what may and may not enter each tool, including client, personal, privileged and security information.
Assess terms, locations, retention, training use, subcontractors, deletion, incidents and administration.
Define which output needs checking, who is qualified and what evidence should be retained.
Use examples from real legal and advisory work so staff understand the line and how to report a mistake.
Build a formal AI management system when risk, clients, tenders or strategic goals justify it.
Section 04
The work can begin as a focused baseline and grow only where the firm's use and obligations require it. The immediate aim is to give staff a safe route to use useful tools and a clear way to ask before crossing the line.
Speak with the people doing the work and record existing tools, experiments, embedded features and intended use cases.
Classify uses, approve suitable tools and set the information, review and recordkeeping rules that apply to each category.
Train staff with relevant examples, publish a simple approval path and make reporting a mistake easier than hiding it.
Recheck approved tools, exceptions and higher-risk uses when suppliers, terms, models or business processes change.
Straight answers
Not necessarily. A practical starting point is to identify real use, decide which information cannot enter a tool and approve suitable services for defined tasks. Some uses may need to remain prohibited when the confidentiality or reliability risk cannot be controlled.
No. Contract terms, data use, retention, location, access controls, deletion and administration still need review. The right answer depends on the tool, configuration, information and proposed use.
Most small firms do not need certification to begin governing AI. An inventory, data rules, supplier checks, human review and named ownership usually come first. Formal alignment becomes more useful when clients, tenders, higher-risk systems or strategy justify it.
Yes. AI governance crosses contractual, privacy, security, technology and professional duties. Tier 1 can coordinate the control work while the appropriate adviser remains responsible for advice in their field.
A quiet first step
Talk directly with Michael about what your firm needs to protect and the practical next step.
Book a confidential call