Most of the decisions this document records are ones you have already made. What a small practice is short of is the record of them. The document most firms end up with says the practice uses AI responsibly, applies appropriate safeguards, and maintains professional judgment at all times. Every word of that is true. It’s also silent about the moment that matters, when somebody is mid-task and wants an answer. At four people that matters more than it would at four hundred, because this is the only document you’re going to write.
- The rule that would have dictated the shape of it lets a firm your size off exactly the parts you were about to copy. It keeps you on the substance.
- A large firm’s policy is one part of an apparatus: supervision, monitoring, an annual sign-off, somebody whose job it is. Copy the document on its own and what you hold is paperwork. The control stays behind.
- Write it as a register of decisions already taken. Each entry carries a date and a name.
- The one rule that survives a bad afternoon turns on where something came from, never on how sensitive it is. Sensitivity asks for a judgment at the exact moment everybody is fresh out of them.
The rule that would have written it for you lets you off
If your practice prepares returns, the FTC’s Safeguards Rule reaches you, and what that does to your choice of supplier is an argument of its own. Here’s what’s worth knowing before you draft a word. The same rule has an exceptions section, and it’s one sentence long.
“Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers” (16 CFR §314.6, checked August 19, 2026).
Those four paragraphs are what every template in this category is built out of.
- a risk assessment written out to a prescribed set of criteria
- continuous monitoring, or annual penetration testing
- a written incident response plan
- an annual written report to a governing body
The count is of consumers whose information you hold, rather than of engagements. So it runs somewhat ahead of your client list. A practice with a few hundred returns is still a long way under.
Now read what the exception leaves standing. Access controls stay. The service provider paragraph stays. So does the requirement to provide your personnel with “security awareness training that is updated as necessary to reflect risks identified by the risk assessment” (16 CFR §314.4, checked August 19, 2026).
Look at the split. What comes off is everything aimed at producing a file. What stays is everything aimed at your people. The assessment underneath is still expected of you, so the thinking stays with it. Read the split as a statement about what a firm this size should be doing with its afternoon. The rest of this page arrives at the same instruction from another direction.
So a small practice excused the prescribed document, copying its shape anyway, picks up the whole cost and leaves the benefit behind. The form is yours to choose. Choose it for the four of you.
What a policy can do when there are four of you
A policy in a firm of two hundred works through machinery. Someone reviews access every quarter, because reviewing access is their job. Something flags a file leaving. New staff sign an attestation in their first week, and again every year. There’s a person to escalate to, and behind them a process people would rather avoid. The written policy is the part of that you can photocopy, and it’s the smallest part.
Take an inventory of what you actually have. What goes into a browser tab stays between the person and the tab. Induction is whatever you hand over between two calls, and the seasonal preparer starts on a Monday in the middle of the worst month you have. The compliance function is a partner who already carries the most work. Three mechanisms are left, and they’re the three you have.
Somebody remembers the rule while they’re busy. The right route is easier than the wrong one. And somebody asks.
That decides the form before you write a word of it. It has to be short enough to get read, because a one-page document only ever has one page. It has to be specific, because a general instruction loses every argument with a person’s own sense of being careful. And it has to be about moments rather than values. “Use good judgment with client data” describes what everybody believes they’re doing at the moment they’re getting it wrong.
The other half of what makes it stick sits outside the document. A policy two partners settled out loud in twenty minutes gets kept. One downloaded on a Sunday evening gets forgotten. The wording is the same in both.
The template is written for the wrong reader
There are two readers, and they want opposite things.
The first is the four of you, on the day, mid-task, wanting an answer in seconds. The second is an examiner, an insurer, a client’s lawyer or a state board. That one reads months later, with something already gone wrong.
Templates are drafted for the second reader, in the register of assurance. Firms copy that register because it’s what a policy sounds like. It fails on the second reader too. What that reader does is put your document beside what actually happened. A sweeping sentence that plainly slipped is worse evidence than a modest one you kept. The sweeping one proves that your written rules and your practice are two different things.
“All AI output is reviewed by a qualified professional before use”, in a firm where the scheduling ran itself all season, is a document arguing against you. Set beside it: client replies are prepared and wait for a person, filing and ranking run on their own, set this way on March 3 by the partner named at the top. That one is modest. It’s also a decision, taken by somebody, on a date, matching what the software did.
Which produces the inversion worth carrying away. Write for your own people and the outside reader gets the better document too. Write for the outside reader and both of them come away empty.
A record of decisions rather than a statement of principle
Almost every decision here gets made somewhere else, and in most firms it’s already made. There are six.
- how far the software may go for each kind of work
- who holds a seat
- what clients are told and what they sign
- what the profession’s own rule book requires when work goes outside the firm
- what your supplier committed to, and in which document
- what happens to the copies
Every one of those is its own piece of work, linked at the foot of this page.
What a small practice loses is the record. The decision got reached between two people at a kitchen table. A year later, everyone has forgotten whether the reply setting was raised deliberately or by somebody trying something out. Institutional memory at this size is two people’s memory, and it stays in their heads.
So: a register. Five entries carry it.
Who may say yes, and to what. One person, named. Yes covers connecting anything to the mailbox or the ledger, accepting terms in the practice’s name, and moving a setting up. The value here is the saying out loud. A decision now has to be spoken to another person, and at this size that’s close to the whole of your detection. The authority was always going to be theirs.
What may go into a tool that sits off your list. The next section, because this is the entry that does the most work. It’s also the one most often written in a way that defeats the person reading it.
Where the dial sits. A line for each kind of work, who may change it, and when it last changed. This entry ages fastest. It’s the first thing an outside reader holds up against what the software actually did.
What a person does in the ten minutes after they think something went wrong. The section after next. Most policies at this size skip this entry, and that’s the reason they get found out at the worst possible moment.
When this gets read again, and by whom. Attach it to something that already happens, rather than to a date on the calendar. A new person is the obvious hook. At four people a new person is a quarter of the firm, and this page is the whole of their induction. The other hook is any entry above changing. A fresh round of questions to your supplier runs off a different trigger, with its own answer.
Anything that sits outside those five is one of two things. It’s a decision belonging to one of the pieces linked below, or it’s a sentence you were writing for the wrong reader.
The rule for the tool nobody bought
Keep the list of what the firm uses. The list is necessary, and the control sits somewhere else. A list only ever has an opinion about what is on it, and your exposure lives in what is off it. Every other document your practice produces attaches to software you chose and looked at. This is the one that reaches the tool that walked in on its own.
The standard fix is a classification scheme: three or four tiers of sensitivity, each with rules hung off it. There’s a legal problem with that. In a practice, nearly everything sits inside the protected category anyway, and that’s settled elsewhere. There’s a second problem, and it belongs to policy design rather than to law. That one decides the matter.
Classification asks a person for an assessment at the moment they’re least equipped to give one. They’re stuck, it’s late, the tool is one tab away. “Is this really sensitive” has a convenient answer sitting right there. A scheme that runs on judgment is a test a tired person takes and passes.
Provenance asks one question. Did this come from a client, or out of work you’re doing for a client? Then it goes only into what’s on the list. One question, one answer, and somebody thinking poorly at six in the evening can still answer it. That last part is the whole of what you’re buying.
Three things that rule has to say out loud. Each one is a place people quietly assume an exception.
It covers uses that sit a long way from advice. A client’s letter dropped into a free grammar checker. A paragraph pasted somewhere to be made less blunt before it goes out. A photographed statement handed to a chatbot to work out what one line means. The person doing any of those is after tidier words, and it feels a long way from handling client data.
It covers the fragment as much as the file. People hear this rule as being about documents, and almost everything that actually crosses the line is a sentence.
And it holds with the names taken out. That’s deliberate rather than strict. “Unless you take the names out” puts back precisely the judgment the rule exists to remove, and it’s the amendment somebody reaches for at the moment you’d least like them exercising judgment.
Then the part that decides whether any of it survives contact with March. A prohibition with a route through it holds. One with a closed door gets broken quietly, and quiet is the failure that costs you, because quiet and fine look identical from where you sit. So the rule arrives with a promise attached. Ask, and you get an answer inside a day. The person who may say yes has to actually answer inside a day. Miss that three or four times and the rule dies, and it dies quietly enough that the news reaches you last.
Keep the refusals alongside the approvals. What was asked for, turned down, when, and one line of why. Otherwise the same question comes round every quarter and collects whichever answer that week happens to allow.
The half that always gets left out
Policies at this size stop at the prohibition. The interesting hour starts after somebody has already done it.
Go back to the inventory. What went into a browser tab stayed between the person and the tab, with nothing to flag it and nobody reviewing it. The detection your practice owns is a colleague deciding to tell you. That decision gets made in about four seconds, against whatever they expect to happen next.
So the most load-bearing sentence in the document is the one that makes telling you cheap. Say it the same day, it is what we expect rather than a confession, and it has never once been treated as a disciplinary matter. Write that sentence only if you can write it honestly. Promise it falsely and you buy exactly the silence you designed for, and the silence reads as calm.
Then four things. They’re an afternoon rather than a project.
Write down what went in, into what, and when, while somebody still remembers it properly. A week later you’re reconstructing rather than recording.
Read that tool’s terms for the two paragraphs that decide the answer. How long it keeps what it was given, and what it may do with it afterwards. Consumer terms in this category often say the opposite of your own supplier’s, and why the second paragraph is the one to read carefully is a subject of its own.
Delete what deletes, and ask about the rest.
Decide whether this stops in your office. Take that one to your adviser, rather than settling it yourself at six in the evening with a return open on the desk.
The last step separates a firm that learns from a firm with an incident file. Change the rule that permitted it, and keep the person. At four people the person is a quarter of your staff, and a paragraph pasted into the wrong tab is a thin reason to lose them.
Where does Point fit?
A practice that connects Point fills in most of the register above at once. Here’s which entries Point turns into a fact you can write down, and where the written record runs out.
- How far Point goes is a setting, held separately for each kind of work. That’s what turns “client replies wait for a person” into an entry you can check rather than an intention. Every kind starts on review, so Point prepares the work and stops there. Move one to the top and Point handles that kind start to finish, and the day you move it is the day the register entry changes.
- A new kind of action begins on a short leash, waiting for your yes until you decide it has earned more. Your policy can rest on that default rather than invent a rule, which is why the entry records what you raised rather than what you permitted.
- The log covers what Point did, in plain language, and most of it can be approved, turned down or reversed. The other half of this page sits outside any log, because a paragraph pasted into a browser tab leaves the record behind. Knowing precisely where the written record stops tells you which line of your policy carries the weight alone.
- If the mailbox carries return information, the standard service covers it only when a separate written supplement says so, and tax return information is named among the excluded categories. Put that document’s date in your register rather than a sentence describing it, and ask for it while you’re still deciding.
- Subprocessors carries a version and an effective date. That turns “keep a copy and name who compares it” into an instruction somebody can follow rather than a gesture, and the terms hold the rest of what was actually promised to you.
The capabilities are written out at length on the benefits page, and Point for accountants puts them in a firm’s own terms.
Common questions
Do four of us really need a written AI policy?
The file itself is optional. The rule that prescribes written plans for larger institutions lets a firm holding information on fewer than five thousand consumers off those particular paragraphs, so the compliance answer is that your document is beside the point. What you need is the decisions you already took, findable by somebody who was elsewhere when you took them. Two partners agreeing something at a kitchen table is a real decision, and it evaporates in about a month.
Can we start from a template?
Take its headings and throw away its sentences. A template is drafted for a firm with the machinery to enforce it, and its language quietly assumes monitoring, an attestation and somebody whose job this is. Your firm runs on three mechanisms instead, so those sentences are decoration in your version, and they read as decoration to anyone who checks. What survives at your size is the register. Who may say yes, what may go where, where the settings sit, what happens afterwards, and when it gets read again.
How long should it be?
One page, and the test is a person rather than a word count. Somebody starts on a Monday in the middle of your busiest month, and their induction is what you hand them between two calls. Whatever sits past the point where they stop reading is gone, and everything you added for the benefit of a future examiner is sitting exactly there. Length is the way this document fails.
Should the policy name the tools we allow?
Yes, and this is precisely where the internal document parts company with the client-facing one. Naming a product in your engagement letter ties a signed contract to a decision you’ll revisit, so that document describes what the software does instead. Your own list has the opposite job. It has to be specific enough to check against in the second before somebody opens something. So it names products, dates them, and carries the ones you turned down beside the ones you allowed.
Somebody has broken the rule. What now?
Treat the report as the thing you wanted. A colleague’s willingness to tell you is the whole of your detection at this size, and one cold reaction switches it off. Write down what went where while it’s still recent. Read that tool’s terms on retention, and on what it may do with what it received. Delete what deletes, and ask about the rest. Take the question of whether this leaves your office to your adviser. Then change the rule that allowed it, and keep the person, since one of four is a policy decision rather than a headcount one.
The short version
- The Safeguards Rule excuses a firm holding information on fewer than five thousand consumers from the written risk assessment, the written incident response plan and the annual report. Training your own people stays, for everybody, which tells you who the document is for.
- A large firm’s policy is the paperwork of an apparatus that lives in a larger firm. Copy the paperwork and the control stays behind.
- There are two readers, and the template is drafted badly for the second one. A modest rule you kept is better evidence than a sweeping one that plainly slipped.
- Write a register rather than an essay. Who may say yes, what may go where, where the dial sits, what happens afterwards, and when it gets read again. Each entry carries a date and a name.
- The rule that survives a bad afternoon asks where something came from, never how sensitive it is, and it comes with a route to yes inside a day. A prohibition with a closed door gets broken quietly, and quiet looks the same as fine.
Each entry in that register is decided elsewhere. How far to let the software go is is it safe to use AI with client financial data. What changes inside a firm once reading becomes cheap, including the seat list, is using an AI inbox without breaking confidentiality. What clients are told and what they sign is the engagement letter. What the profession already requires when work goes to an outside supplier is AI and the CPA Code. How to grade what a supplier tells you is questions to ask any AI tool. And what happens to the copies is keeping client data out of AI model training. Whether to connect a practice mailbox at all is the client data guide. And Point is what the whole of it looks like when it’s working.