Your team is already using it
If you have more than a handful of people, someone is using AI to do their job. They’re drafting emails, summarizing documents, fixing spreadsheet formulas. Most of it is harmless and some of it is genuinely useful.
The risk isn’t AI. It’s the untracked kind: client information pasted into a free tool, a draft that went out without review, a decision nobody can explain later.
Policy first
An AI policy only has to say five things.
- Approved tools. Name them. Anything else is off-limits for work.
- Data that never goes in. Client confidential information, personal data, health or financial records, anything under NDA. Be specific.
- Human review. Anything AI helped draft gets a human review before it leaves the building.
- The record. Where you keep a record of what AI was used for, and by whom.
- The owner. One named person who owns the policy and updates it as tools change.
Put it in writing, have everyone acknowledge it, and review it every six months.
Where AI helps a business like yours
The best uses are repetitive, rule-bound and judgment-light:
- Triage and first drafts of routine email
- Summaries of long documents, calls and meetings
- Routing requests to the right person or system
- Filing documents and updating records
- First-pass quotes, proposals and reports that a person finishes
Where it shouldn’t be used
- Anything that decides about a person: hiring, firing, lending, grading, benefits
- Anything contractual, legal or regulatory that goes out without human approval
- Emergencies and outages, where a person must own the response
- Anywhere you can’t see what the tool did, or can’t administer it
The Harness: how Signet builds agents
Signet, our AI division, builds every agent inside the same six steps.
- Context pack. We encode how your business actually works: your systems, your rules, your obligations, your house style.
- The agent drafts. AI does the volume work: reading, classifying, routing, drafting, reconciling, summarizing.
- A person reviews. Every output that carries consequence passes a named human, against a written checklist, not a spot check, and not a vibe.
- We sign. Attestation, logging, and a defined escalation path.
- Two strikes and it’s law. Anything a reviewer corrects twice gets promoted into the context pack permanently.
- You keep the asset. The context pack, the policies, the governance record.
Built this way, an agent stops when something carries consequence. In the worked example on the Signet page, Frontdesk at a 40-person law firm reads email and transcribed voicemail around the clock, acknowledges new inquiries and opens an intake record, and routes existing clients to the responsible attorney with a one-line summary. Anything touching a deadline, a fee quote, or legal advice is never sent: it is drafted and escalated to a person.
Questions your insurer, examiner or auditor will ask
- Do you have a written AI policy, and do staff acknowledge it?
- Which AI tools are approved, and how is data protected in them?
- How do you prevent confidential data from entering unapproved tools?
- Who reviews AI-assisted work before it reaches a client?
- Can you show a record of AI use?
- Who is accountable for each AI system?
A 30-day starting plan
Week 1. Write the five-point policy. Name the owner.
Week 2. Choose approved tools and set them up with business licenses and single sign-on.
Week 3. Train the team in 30 minutes: what’s allowed, what never goes in, and how review works.
Week 4. Pick one repetitive process that eats your week and scope an agent for it, with review and sign-off built in.
What Signet refuses to build
- Nothing that decides about a person.
- Nothing deployed where we can’t see or administer it.
- No markup on AI model or usage costs.
- No outcome claims we can’t show the working for.
If you’d like help with the policy, or a second look at the one you have, that’s exactly where Signet starts. Give us one process that eats your week.