---
title: A one-page AI policy for a single-family office
description: A family office AI policy on one page: what staff may paste into AI, which accounts to use, what AI may do on its own, and who approves new tools.
canonical: https://privatesuperintelligence.si/blog/family-office-ai-policy/
last-updated: 2026-10-15
---

# A one-page AI policy for a single-family office

A family office AI policy tells staff which AI tools they may use for family work, what information may go into them, and what an AI tool may do without a person approving it. One page is enough for a single-family office, and the template below covers the essentials. Without it, your staff are already making these decisions one paste at a time.

## Why a small office needs a written AI policy

Most family offices run lean, and nobody is watching which websites the team uses. IBM's 2025 Cost of a Data Breach Report found that 63% of breached organizations either had no AI governance policy or were still developing one, and only 37% had policies to manage AI or detect shadow AI (staff using AI tools the organization hasn't approved). Organizations with high levels of shadow AI saw breach costs $670,000 higher on average.

The risk in a family office is specific. A personal chatbot account plays by different rules from a business plan. On ChatGPT's personal Free, Plus and Pro plans, OpenAI may use chats for training unless the user turns off "Improve the model for everyone", while Business, Enterprise, Edu and the API don't train by default. Our guide [is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/) covers the details by plan. When your controller drafts a trust distribution memo in a personal account, the family's information sits under that account's terms, chosen by one employee.

A short policy fixes the default. It names the approved tools, lists what never goes anywhere else, and gives people a quick way to ask.

## The one-page template

Copy this, replace the brackets, and have the principal or executive director sign it.

> **[Family office name]: AI use policy**
> Effective [date]. Owner: [name, title]. Reviewed every [six] months.
>
> **1. Scope.** This policy covers every employee, contractor and adviser who handles family information for [office name], on any device.
>
> **2. Approved tools.** You may use only these AI tools for family work: [list each tool and the account type, for example "office-issued business account"]. Personal AI accounts are not approved for family work, even with training switched off.
>
> **3. Never enter into an unapproved tool.** Tax returns and K-1s; trust, estate and entity documents; account numbers, wire instructions and passwords; health information; travel plans, home addresses and security arrangements; passports and identity documents; anything a family member has asked to keep private.
>
> **4. What AI may do on its own.** Approved tools may read, summarize and draft. A named person must approve before any AI tool sends email outside the office, shares a file, changes a record, or starts a payment. No AI tool may release a wire.
>
> **5. Check the output.** You are responsible for anything you send or file. Check every figure, date and name against the source document before it leaves the office.
>
> **6. New tools.** Ask [owner] before trying any new AI tool or AI feature in software we already use. [Owner] reviews it with the office's AI vendor checklist and records the decision.
>
> **7. Mistakes and incidents.** If you put family information into the wrong tool, or an AI tool does something unexpected, tell [owner] the same day. Nobody is disciplined for reporting quickly.
>
> **8. Advisers.** We ask outside advisers to tell us which AI tools they use on family matters.
>
> Signed: [principal or executive director], [date]. Acknowledged: [each staff member], [date].

## How to fill in each section

**Approved tools.** Start with what staff already use. Ask each person, without blame, which AI tools they have tried in the last three months. Then pick the business-grade accounts you will pay for and close the rest. A list of two approved tools that people use beats a ban that people work around.

**The never list.** Keep it concrete. "Confidential information" means different things to different people. "Wire instructions" and "the principal's travel plans" mean one thing.

**What AI may do on its own.** Clause 4 matters most once an AI tool connects to the principal's inbox or the bill pay system. The OWASP Top 10 for LLM Applications (2025) calls the risk "excessive agency": a system holding more permissions than its job needs. Draft-only permission covers most of the value at little risk. The [deepfake wire fraud guide](/blog/deepfake-wire-fraud-family-offices/) explains why payments stay with people.

**New tools.** Give the owner a standard set of questions. The [AI vendor due diligence checklist](/blog/ai-vendor-due-diligence-checklist/) gives five: training, retention, processing location, permissions, and exit.

## How the policy maps to the NIST AI Risk Management Framework

The U.S. National Institute of Standards and Technology released the AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) on January 26, 2023. It is voluntary, and it organizes AI risk work into four functions: Govern, Map, Measure and Manage. In July 2024 NIST added a Generative AI Profile (NIST AI 600-1), and NIST says the AI RMF is being revised as part of the White House AI Action Plan. A family office doesn't need the full framework, but the one-page policy lines up with it.

| NIST AI RMF function | Where the one-page policy covers it |
| --- | --- |
| Govern: roles, accountability and policies | Owner, scope, sign-off, review date (sections 1 and 8, the header) |
| Map: understand the context and the risks | The never list and the approved tools (sections 2 and 3) |
| Measure: assess and track risks | Output checks and vendor review (sections 5 and 6) |
| Manage: act on risks and respond | Approval limits and incident reporting (sections 4 and 7) |

If an investment committee, auditor or insurer asks how the office governs AI, this table gives you a short, standard answer.

## Making it stick

Read the policy aloud at a staff meeting and take questions. Keep a one-line register of approved tools and decisions, with dates. Review it every six months, and sooner when you add a tool that can act on the family's behalf. The policy covers people. The [guide to keeping company data private with AI](/blog/keep-company-data-private-with-ai/) covers the technical controls that sit underneath it.

This page is general information and not legal advice. Ask your counsel to review the policy against your office's employment terms and jurisdiction.

## Private SuperIntelligence

Private SuperIntelligence from Mitosis Labs is an AI concierge for family offices, enterprises and private clients: the most capable AI, trusted with everything. It works across the family's own email, documents and data, answers with citations, and acts within permissions the office sets, which makes clause 4 something you configure. Each deployment is built for one client. See [AI for family offices](/family-offices/).

## Frequently asked questions

### Does a single-family office need an AI policy?

Yes, if anyone on the team uses AI for family work. IBM's 2025 report found that 63% of breached organizations had no AI governance policy or were still developing one.

### Can staff use personal ChatGPT accounts for family office work?

The template says no. Personal plans may train on chats unless the user turns the setting off, and the office has no control over the account.

### How long should a family office AI policy be?

One page covers a single-family office: scope, approved tools, what never goes into AI, approval limits, output checks, new tools and incidents. Add detail only where your office has a specific risk.

### What is the NIST AI Risk Management Framework?

It is a voluntary framework NIST released on January 26, 2023 as NIST AI 100-1. It groups AI risk work into four functions: Govern, Map, Measure and Manage.

### Who should own the AI policy in a family office?

One named person, often the COO, chief of staff or general counsel, with the principal or executive director signing it. The owner approves new tools and handles incident reports.


## Related reading

- [Private AI for family offices](/blog/private-ai-for-family-offices/)
- [Consolidated reporting across custodians, without the Excel export](/blog/family-office-consolidated-reporting/)
- [Tracking K-1s across 30 entities](/blog/k-1-tracking-across-entities/)
- [Capital call notices: catching every one, across every trust and LLC](/blog/capital-call-tracking/)
- [The family office technology stack](/blog/family-office-technology-stack/)
- [Family office operations, and where AI changes the staff math](/blog/family-office-operations-and-ai/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [AI Risk Management Framework (NIST, accessed 2026-10-15)](https://www.nist.gov/itl/ai-risk-management-framework)
- [IBM Report: 13% of organizations reported breaches of AI models or applications (IBM Newsroom, July 30, 2025)](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls)
- [OWASP Top 10 for LLM Applications 2025 (OWASP GenAI Security Project, accessed 2026-10-15)](https://genai.owasp.org/llm-top-10/)
- [What if I want to keep my history on but disable model training? (OpenAI Help Center, accessed 2026-10-15)](https://help.openai.com/en/articles/8983130-what-if-i-want-to-keep-my-history-on-but-disable-model-training)
- [Managing data, sharing, and privacy in ChatGPT Business (OpenAI Help Center, accessed 2026-10-15)](https://help.openai.com/en/articles/8798634-managing-data-sharing-and-privacy-in-chatgpt-business)