A Family Office AI Policy Template: Rules for Staff, Family Members and AI Agents

1. The Short Answer: One Page, Four Decisions

A family office AI policy should fit on one page and settle four decisions: which AI tools and plans the office approves, what information may go into each one, who approves AI agents that can open files or take actions, and how money moves when a voice or video request could be fake.

The rest of this guide supports those four, with a table of what goes where (section 5) and template text to adapt with counsel (section 11).

Keep it short, because the office is small. Citi's 2026 Global Family Office Report (351 family offices in 41 countries, released September 22, 2026) found that "Approximately 62% of family offices employed six or fewer full-time professionals".

In an office of six, the policy has to work without a compliance department to interpret it. Write it so the newest assistant can follow it on a busy Friday afternoon.

2. Why a Family Office Needs Its Own Policy

A fund's AI policy covers employees and deal data. A family office policy reaches further, to more people and more personal information.

• Family members. They are owners, clients and users at once, they send documents from personal accounts, and they don't report to the COO.
• Household and personal staff. Assistants and house managers handle calendars, travel and bills for several family members.
• Reputation. A leaked chat about a family dispute or an illness can't be paid off with a fine and forgotten.
• Privilege. Offices work closely with lawyers on trusts and estates, and a recent ruling on AI chats and privilege (section 7) makes that a policy question.

The threats already reach family members directly. RBC Wealth Management and Campden Wealth's North America Family Office Report 2026 (155 family offices, September 29, 2026) found: "Fifty-nine percent of offices experienced phishing attempts this year, 25 percent saw a family member's personal accounts breached".

The guide to AI data privacy and security for family offices covers the security side. This guide covers the rules people follow.

A fund protects deal data. A family office protects a family, so its policy has to cover people who are not on the payroll.

3. The Policy on One Page

Here is the whole policy in nine lines. Section 11 turns each line into clauses you can copy.

1. Use only approved AI tools, on the office's business accounts.
2. No office or family information in personal or free AI accounts.
3. Follow the table for what goes where. When unsure, ask first.
4. Never put passwords, account numbers or wire instructions into AI.
5. Agents need the owner's approval and one limited folder.
6. A person checks every AI output before anyone uses it.
7. No money moves on a message alone. Call back on a number already on file.
8. Outside firms explain their AI use in writing.
9. One owner, same-day reporting of mistakes, a yearly review.

Print it and pin it up. People follow the rules they can see.

4. Approved Tools and Plans

The approved list names a tool and a plan, because the plan sets the data terms.

Business plans don't train on your data by default. Anthropic's Privacy Center (updated August 18, 2026) says: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models." The exception is a conversation someone sends as thumbs up or down feedback, which may be used.

OpenAI's enterprise privacy page (updated January 8, 2026) says of ChatGPT Business, Enterprise, Edu and the API: "We do not train our models on your data by default".

Consumer plans work the other way. Anthropic's pricing page lists model training as "Opt-out" for Claude Free, Pro and Max and "None by default" for Team and Enterprise.

OpenAI's data controls FAQ says: "On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default. You can turn off Improve the model for everyone and keep your chat history."

So the rule is short: office data goes only on business plans the office pays for and administers. A personal account with training switched off is still beyond the office's reach: nobody there can see what is in it or close it when someone leaves.

For each approved tool, record the plan, the admin and the information types it may hold. Ask staff to skip the thumbs up and down buttons on office chats.

Approve plans, not brands. Saying the office uses ChatGPT means little until you say which ChatGPT.

5. What Can Go Where

Sort information by type, then decide which kind of account may hold each type. Seven types cover most of what a family office handles.

The consumer column is short on purpose: everything the office creates or holds belongs on a business plan.

When something fits two rows, follow the stricter one.

6. AI Agents and File Access

Chat tools answer questions. Agents act on a computer or in other apps: they can open files, fill in forms and send messages if they are allowed to.

Anthropic's own Cowork safety page is direct about its desktop agent: "Avoid granting access to local files with sensitive information, like financial documents." It also says the chances of an attack are "still non-zero".

In a family office, financial documents are the daily work. So the policy sets four limits:

• Approval first. The policy owner approves each agent before first use and records what it may touch.
• One folder. An agent works in one folder holding copies of only the files the task needs. Never the whole drive, the email inbox, or a bank or custodian portal.
• A person approves actions. Anything that sends, deletes, pays, signs or shares waits for a person to approve it, every time.
• A list. The owner keeps a list of which agents can reach what, reviewed every quarter.

Give an agent the one folder the job needs. Every extra folder adds risk and no work.

7. Family Members and the Next Generation

Family members are the hardest part to write for, because the office serves them and can't instruct them. Three risks belong in the policy anyway.

Personal accounts

A trust document uploaded to a personal Pro or Plus account sits on consumer terms, outside the office's control. Family members follow the same rule as staff: no office or family information in personal accounts.

Shared chats

A share link can make a private chat public. Fast Company reported on July 30, 2025 that shared ChatGPT conversations were showing up in Google results: "Nearly 4,500 conversations come up in results for the Google site search, though many don't include personal details or identifying information."

TechCrunch reported the next day that OpenAI had removed the feature. Then, on July 28, 2026, Malwarebytes reported that "Reddit users found that by using a specific Google search query, it was possible to find Claude conversations". The rule: no share links for chats about the family.

Privilege

Law firm Orrick reported on March 25, 2026 on United States v. Heppner, a February 2026 ruling by Judge Jed S. Rakoff in the Southern District of New York about a defendant's chats with a consumer AI chatbot, Claude. In Orrick's summary, "The court found that communications with an AI chatbot are not protected by the attorney-client privilege".

What the ruling means for your family is a question for counsel. The habit to teach: legal questions go to the family's lawyers, and the chatbot stays out of them.

Bring the next generation in early, with a short session on these three risks and a named person to ask. Rules that come with a reason get followed.

8. Money Movement and Deepfakes

The costliest AI risk for a family office may involve none of its own tools. A cloned voice asking for an urgent wire needs no access to anything.

FinCEN's November 13, 2024 alert warned that "criminals have reportedly used GenAI tools to target companies by impersonating an executive or other trusted employee and then instructing victims to transfer large sums". In a family office, that trusted voice can be a family member's.

The FBI's April 6, 2026 release on its 2025 internet crime report said "the IC3 report features a section on artificial intelligence, which accounts for 22,364 complaints, costing Americans nearly $893 million." Meanwhile a basic defense slipped at family offices: in RBC's 2026 report, "two-factor authentication fell from 92 to 83 percent".

The policy's money rule has four parts:

1. No payment or change to bank details on an email, text, voicemail or video call alone, whoever it seems to come from.
2. Confirm every new or changed instruction by calling a number already on file. The FBI's December 19, 2025 warning gives the same advice: "Then independently identify a phone number for the person and call to verify their authenticity."
3. Agree a code word with each family member who can ask for money. The same FBI warning says: "Create a secret word or phrase with your family members to verify their identities."
4. A second person approves every outgoing wire, and first-time payees wait a day.

The guide to deepfake and AI fraud controls walks through the callback step by step.

Urgency is the attacker's main tool. The policy makes waiting normal, even when the request seems to come from the principal.

9. Outside Advisers and Vendors Using AI on Family Data

The office's bank, law firm, accountant, fund administrator and reporting platform may already run family data through AI tools. Your policy can't set their rules, but it can require answers.

Send each firm the same seven questions:

1. Which AI tools touch our data, and on which plans?
2. Can any provider train models on our data, by default or through feedback?
3. Where is our data kept, for how long, and will you delete it on request?
4. Who at your firm, and at the AI provider, can see it?
5. Does a person check AI output before it reaches us or before you act on it?
6. Will you tell us before adding an AI tool or agent that can act on our accounts?
7. If something goes wrong, how quickly will you tell us?

File the answers with the engagement letter, ask again every year, and ask for stricter terms in writing where an answer falls short.

A firm that can't answer these questions in writing has answered them anyway.

10. Ownership, Training and Review

A policy needs one owner with time to run it: the COO, the chief of staff or the CFO, with a named backup.

The owner keeps the approved list, approves agents, answers questions and runs the review. Mistakes get reported to them the same day, without blame, because a hidden mistake can't be fixed.

Training takes one hour at launch: the table, the agent limits and the money rule, each with a real example. Everyone signs, family members who use office systems included.

Review the policy every year, and sooner when a provider changes its terms or something goes wrong. Date every change.

The NIST AI Risk Management Framework (NIST AI 100-1, January 2023) describes a GOVERN function, quoted below, that builds a culture of risk management. In a six-person office, that culture is one owner and a habit of asking first.

A policy with an owner gets updated. A policy without one gets old.

11. The Template Text

Copy the clauses and fill in the brackets. Counsel reviews the result before anyone signs, so treat the text as a starting point: this guide is operational guidance, and counsel owns the legal reading.

Clause 1: Scope

1. This policy covers office staff, household staff, contractors and every family member who uses office systems or information.
2. An AI tool is any chatbot, assistant, agent or app feature that drafts, summarizes, analyzes or acts using AI.

Clause 2: Approved tools

1. Use only the AI tools on the approved list, on the office's business accounts. The list names each tool, plan, admin and the information allowed.
2. Do not put office or family information into a personal or free AI account.
3. Ask the policy owner before using any new AI tool or feature.

Clause 3: Information

1. Follow the table of what can go into which AI tool, and the stricter row when two apply.
2. Never enter passwords, account numbers or wire instructions into any AI tool.
3. Keep health information, details about minors and personal identifiers out of AI tools unless the policy owner approves a specific task in writing.
4. Do not create share links for chats that contain office or family information.

Clause 4: Agents

1. The policy owner approves each AI agent before first use and records what it may access.
2. An agent works in one folder holding copies of only the files the task needs.
3. A person approves every action that sends, deletes, pays, signs or shares.

Clause 5: Output

1. A person checks every figure against its source before AI output is sent, filed or acted on.
2. AI output that reads as legal, tax or investment advice goes to the responsible adviser before anyone acts on it.

Clause 6: Money

1. No payment, and no change to payment details, on the strength of an email, text, voicemail or video call alone.
2. Confirm new or changed instructions by calling a number already on file, never a number given in the request.
3. A second person approves every outgoing wire. Family members use the agreed code word for urgent requests.

Clause 7: Outside firms

1. Before an outside firm uses AI on office or family information, it answers the office's AI questions in writing, and again each year.

Clause 8: Ownership and review

1. The policy owner is [name], with [name] as backup.
2. Report any breach to the policy owner the same day, without blame.
3. Everyone covered signs this policy each year. The policy owner reviews it each year and whenever a provider changes its terms.

Eight short clauses and a signature line. The people it protects have to read it.

12. Where to Start

Start with the money rule this week, because it protects the family before anyone opens an AI tool. Then:

1. Name the policy owner and a backup.
2. List every AI tool in use, personal accounts included, and ask without blame so people answer honestly.
3. Choose the business plans and move office work onto them.
4. Adapt the table and the template text, and have counsel review them.
5. Run the one-hour session, collect signatures and put the annual review in the calendar.

The policy can be live within a month. Most of that month goes on decisions; the writing is the quick part.