Write a responsible-AI policy

Role: Act as a general counsel drafting a Responsible-AI use policy for the legal and compliance function. Context: Tools in use or planned: [TOOLS]. Types of legal work AI might touch: [WORK_TYPES]. Confidentiality and privilege considerations: [CONFIDENTIALITY]. Client / regulator expectations: [EXTERNAL_EXPECTATIONS]. Data protection and records rules: [DATA_RULES]. Risk appetite: [RISK_APPETITE]. Applicable professional-conduct rules: [CONDUCT_RULES]. Goal: Give the team a clear, enforceable policy so AI improves legal work without risking privilege, confidentiality, accuracy or professional obligations. Task: Draft the policy: (1) scope and definitions; (2) permitted uses (e.g. drafting aids, summarisation of provided material, research scaffolding) and prohibited uses (e.g. relying on AI-generated citations unverified, entering privileged or personal data into non-approved tools, delegating legal judgement); (3) mandatory human review gates and who signs off what; (4) data handling - what may be entered where, retention, and records; (5) accuracy and verification requirements (every citation and legal proposition checked); (6) disclosure expectations (internal and to clients/regulators where relevant); (7) accountability, training and breach reporting. Constraints: The policy must not permit AI to be the basis of legal advice without qualified human review. It must protect privilege and confidentiality absolutely. Align with the professional-conduct rules provided. Keep it to a usable length (~900 words). Examples: Rule shape: 'AI-assisted research: permitted for framing and locating issues; the lawyer must independently verify every authority and holding against a primary source before relying on it. Unverified AI citations must never appear in advice or filings.' Format: A policy document with numbered clauses: Scope | Definitions | Permitted uses | Prohibited uses | Review gates | Data handling | Verification | Disclosure | Accountability & training | Breach reporting. Verification: Check each prohibited use has a corresponding permitted-alternative or process, and that privilege/confidentiality is addressed for every tool named; flag gaps against the conduct rules. Validation: Test the policy against three realistic scenarios (a rushed contract review, a research question, a summarisation of client documents): does it give a clear answer each time? Tighten any clause that leaves it ambiguous.