← All tools

AI Policy Generator for Finance Teams

Your AI policy in eight questions

Answer eight questions and get an AI acceptable-use policy written for a finance team. Each answer fills in a clause. Anything you leave open lands on a list of questions for the controller or CFO. Then test the policy against eight everyday requests.

  • About 8 minutes
  • 10-section policy
  • Private to your browser
Start with question 1

Policy builder

Eight questions. One policy.

Start blank, or load fictional sample answers to see a finished policy. The document on the right rewrites itself as you answer. Your answers stay in this browser and in the page link.

Question 1 of 8Which AI tools are approved?

Tick the kinds of tool your team may use for finance work. Name specific products in the box; IT keeps the official list.

Personal or free AI accounts

Why this matters
If the policy does not name approved tools, people use whatever is open in their browser. That is shadow AI. Company accounts usually come with contract terms on data use; free personal accounts often do not. Naming the approved tools is what makes every other rule enforceable.
Question 2 of 8Which data may be used, and where?

Set a rule for each data class.

PublicPublished statements, press releases, filings

InternalChart of accounts, procedures, routine reports

ConfidentialUnpublished results, forecasts, contracts, pricing

RegulatedPersonal data, bank and card numbers, tax IDs

Where may data be processed?

Why this matters
Masked means names, account numbers and other identifiers are removed or replaced before the data goes in, so the analysis still works but no one can be identified. Regulated data carries legal duties whether or not anything goes wrong, so most finance teams keep it out entirely until Legal has approved a specific tool. Where data is processed matters for data residency.
Question 3 of 8What may staff use AI for, and what is off limits?

Permitted

Prohibited

Question 4 of 8Which outputs always need human review, and by whom?

Who reviews?

Why this matters
Review checks that the work is right. Approval authorizes it to take effect. They are different jobs. A preparer checking their own AI output is better than nothing, but a second person keeps segregation of duties, which is what auditors look for.
Question 5 of 8When does an AI-assisted action need approval?

Always need approval, whatever the amount

Why this matters
A threshold turns “be careful” into a rule a system can enforce. Start from your existing delegation of authority: AI-assisted entries should follow the same limits as manual ones, never looser. Some items, like intercompany and related-party entries, carry risk at any amount, so they need approval regardless.
Question 6 of 8What must be logged, and for how long?
Why this matters
An auditor asks one question about AI-assisted work: can you show me what happened? The audit trail needs the input, the output, the reviewer and what they changed. Tying retention to the records the output supports keeps you consistent with the rules you already follow.
Question 7 of 8Who owns the policy, and how often is it reviewed?

Review cadence

Whatever you choose, the policy is also reviewed when a new tool is approved or a material incident occurs.

Question 8 of 8What training and attestation is required?

An attestation is the evidence that people have read the policy. That is the last question: your policy and its open questions are ready.

Question 1 of 8

Your policy

0of 10 sections defined

What this means

Open questions for the controller or CFO

    Email me this

    Building your policy…

    Important

    This is a starting template, not legal advice. It does not account for your industry, jurisdiction or contracts. Have it reviewed and adapted by your legal, risk and IT teams before you adopt it. Values in [square brackets] are placeholders to confirm.

    Test your policy

    Can I use AI for this?

    Eight requests a finance team might hear this month. Each verdict comes from your answers above, and changes as they do. Where the policy is silent, that is a gap to close before someone finds it for you.

    • Allowed
    • Allowed with review
    • Needs approval
    • Not allowed
    • Policy is silent

      Myth

      Our IT acceptable-use policy already covers AI.

      Reality

      It covers devices, passwords and email. It rarely says which financial data may go into a model, who reviews an AI-prepared entry, or what an auditor will need to see. Finance needs those answers in writing.

      Field note

      In our experience, the AI policy that gets followed is short, specific and written with the people who close the books. Keep a person on every key decision and cap automation around 80% of a task. Governing a specific agent rather than the whole team? Use the Agent Governance Framework.

      Field guide

      AI policy, in three lessons

      What we tell controllers and CFOs before their team’s first AI tool goes live.

      .01

      Why finance needs its own AI policy

      Finance output becomes the record. A wrong number flows into the ledger, the statements, a tax return or a payment. Finance also runs on controls that auditors test. A company-wide AI policy covers safe use in general; the finance policy says who checks what, at which amount, and what evidence is kept.

      Rule of thumbIf an output can reach the ledger, a filing or a payment, the policy must say who checks it.

      .02

      Classify the data before the prompt

      Four data classes cover most finance work: public, internal, confidential and regulated. The class sets the rule, not the tool or the urgency. Masking lets you analyze confidential data without exposing who it is about. Regulated data usually stays out until Legal approves a specific tool.

      Rule of thumbWhen unsure, treat it as the higher class and mask the identifiers.

      .03

      Review is not approval

      Review asks “is this right?” and ties the output back to the source. Approval asks “should this happen?” and carries authority. AI can prepare and route work, but it never approves its own output. Keeping the two separate, and with different people above a threshold, is what keeps segregation of duties intact.

      Rule of thumbAI prepares. A person reviews. A different person approves anything above the threshold.

      Want a tool built for your team?

      We build custom assessments, skills and internal apps as part of our engagements. Tell us what you need.

      Book a discovery call contact@baxtermountain.ai