Free template · Word and PDF · English and Arabic · CC BY 4.0
AI use policy template for law firms and in-house legal teams in the GCC
Word and PDF, free, no sign-up. The Arabic file is right-to-left.
More formats
A free, bilingual AI use policy template for law firms and in-house legal teams in the UAE, Saudi Arabia, Qatar, Bahrain, Kuwait and Oman. At least two GCC courts publish rules on AI in proceedings: the DIFC Courts[1] and the QICDRC.[2] They set different disclosure defaults, so the template has a rule for each forum. Copy any section, download the Word file or print the page. Then fill in the [placeholders], choose an option in each drafting note and have qualified counsel review the result. See also Qanu for law firms and for in-house legal teams.
This is a template, not legal advice. It does not create a lawyer–client relationship. Court rules, regulator guidance and laws change; check the official sources linked and have the policy reviewed by qualified counsel in each relevant jurisdiction. Last reviewed: 16 October 2026.
Key points
- Two GCC courts, two disclosure defaults. The DIFC Courts expect AI use to be declared at the earliest opportunity, with any issues resolved no later than the Case Management Conference.[1] The QICDRC requires no pre-emptive declaration unless the Court asks, but parties must be able to identify AI-generated portions and explain how they verified them.[2] A GCC policy therefore needs a per-forum disclosure rule.
- Confidential data: client consent or a secure platform. DIFC Courts guidance asks for client consent before confidential information goes into a generative AI tool.[1] The QICDRC bars confidential or privileged input except into "private, secure AI platforms".[2] The SRA in England and Wales warns that entering client data into public AI tools may permanently waive privilege.[13]
- Verification is personal. The DIFC Courts, the QICDRC, SDAIA, the SRA, the ABA and the CCBE all leave responsibility for AI output with the person who uses it.[1][2][10][13][15][17] The GCC court texts name rejection or disregard of material, adverse costs, referral to regulators and contempt among the consequences.[1][2]
- Saudi Arabia's AI framework reaches private firms. SDAIA states that its AI Ethics Principles apply to all segments of society in the Kingdom, including private entities and their employees.[10] As of 16 October 2026 we found no published guidance on lawyers' use of AI from the Saudi Bar Association or the Ministry of Justice.
- EU timing has moved. The EU AI Act's AI-literacy article has applied since 2 February 2025.[19] A 2026 amending regulation moves the high-risk obligations for Annex III systems to 2 December 2027.[20] This matters to GCC firms with EU offices or clients.
Why GCC law firms need an AI use policy now
AI reaches legal work through chat assistants and through features built into email, word processing and document management software. Without a written policy, each lawyer decides alone what client information goes into which tool, how far to trust the output and what to tell a court.
The GCC texts that exist set out the risks. The DIFC Courts list misleading or incorrect information, breach of client confidentiality, IP infringement and breach of data protection legislation.[1] The QICDRC treats fabricated or unverifiable citations as a breach of duty and requires every citation to be checked against primary sources or recognised databases.[2] In England and Wales, the SRA's August 2026 warning notice expects firms to have governance and controls, and keeps supervisors accountable.[13]
A policy turns these expectations into rules your team can follow: which tools are approved, which data classes each tool may receive, who verifies output, and what to disclose in each forum.
What GCC courts and regulators say
DIFC Courts: Practical Guidance Note No. 2 of 2023
The DIFC Courts' Practical Guidance Note No. 2 of 2023, Guidelines on the use of large language models and generative AI in proceedings before the DIFC Courts, has been in effect since 21 December 2023. It applies to parties in DIFC Courts proceedings and describes itself as guidance only.[1]
- Principles: transparency (disclose AI use, the source of AI content and its limitations or biases); accuracy and reliability; professional obligations under the Mandatory Code of Conduct (DIFC Courts' Order No. 4 of 2019), the DIFC Data Protection Law No. 5 of 2020 and the DIFC IP Law No. 4 of 2019; and avoiding over-reliance on AI.[1]
- Disclosure: declare the use of AI at the earliest opportunity and resolve any issues no later than the Case Management Conference. Discuss it with the other side; failing agreement, make a Part 23 application.[1]
- Tools and clients: verify output against independent sources, prefer specialist legal tools to free conversational tools, educate clients and seek their consent, obtain client consent before confidential information is given to a generative AI tool, and read the tool's terms of use.[1]
- Consequences: the Courts may reject AI-generated content (RDC 29.10), a false statement verified by a statement of truth can lead to contempt proceedings (RDC 29.137), and witness statements must be in the witness's own words.[1]
QICDRC: Practice Direction No. 1 of 2026
The Qatar International Court and Dispute Resolution Centre issued its Practice Direction on the Use of Artificial Intelligence (No. 1 of 2026) on 6 January 2026. It applies to litigants, representatives and practitioners in the QFC Civil and Commercial Court and the Regulatory Tribunal, and says AI "is to be welcomed".[2]
- Confidentiality: no confidential, privileged or protected information in AI tools except private, secure AI platforms. Users are encouraged to disable chat history, and misuse may lead to sanctions (paras 12–14).[2]
- Citations and evidence: fabricated or unverifiable citations are a breach of duty, every citation must be checked against primary sources or recognised databases, and AI must not be used to generate or fabricate evidence (paras 8, 15–18).[2]
- Disclosure: no pre-emptive declaration unless the Court asks. The Court may require disclosure in the interests of fairness, and users must be able to identify AI-generated portions and explain how they verified them, possibly by affidavit (paras 24–26).[2]
- Multimedia and sanctions: AI-generated multimedia must be disclosed and deepfakes may be excluded (paras 22–23). Sanctions include disregarding material, adverse costs, referral to regulators and contempt (para 27).[2]
The QICDRC also publishes a Use of Artificial Intelligence page and a Practice Guidance issued with the Practice Direction.[3][4] We have not reviewed the Practice Guidance for this page.
ADGM Courts
ADGM Courts' Practice Direction 2 on commercial and civil claims (re-issued 17 October 2025) says at paragraph 2.84 that a search is not unreasonable solely because a party used AI, for example predictive coding.[5] As of 16 October 2026 we found no published ADGM Courts practice direction specific to generative AI; check the current position with the Courts.
Saudi Arabia: SDAIA AI Ethics Principles and Generative AI Guidelines
SDAIA's AI Ethics Principles (Arabic title: مبادئ أخلاقيات الذكاء الاصطناعي) set out seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility.[7][8][9]
SDAIA's Generative AI Guidelines for the Public state that the AI ethics principles apply to all segments of society in the Kingdom, including private and non-profit entities and their employees, and that "it is users' responsibility to verify the content generated by GenAI".[10] SDAIA also publishes Generative AI Guidelines for Government.[11]
As of 16 October 2026 we found no published guidance on lawyers' use of AI from the Saudi Bar Association or the Ministry of Justice. Saudi firms can anchor their policy on SDAIA's documents and their professional duties.
UAE: AI Charter
The UAE government publishes The UAE Charter for the Development and Use of Artificial Intelligence (July 2024) on its official portal.[12] We list it as a reference and do not summarise it here.
Dubai's Legal Affairs Department lists a continuing professional development course titled "Ethics – An International Comparison on the use of AI in the Legal Sector".[6] As of 16 October 2026 we found no published binding rules or circular from the Department on lawyers' use of AI.
Where we found no published guidance
As of 16 October 2026 we found no published guidance on the points below. That does not mean none exists: check with your regulator or bar before relying on this list. This page is reviewed quarterly.
- ADGM Courts: a practice direction specific to generative AI.
- Dubai Legal Affairs Department: binding rules or a circular on lawyers' use of AI.
- Saudi Arabia: guidance on lawyers' use of AI from the Saudi Bar Association or the Ministry of Justice.
- Bahrain, Kuwait and Oman: bar or ministry guidance on lawyers' use of AI.
- An official Arabic title for DIFC Courts PGN 2/2023.
International benchmarks
SRA and the Law Society (England and Wales)
The SRA's Misuse of AI warning notice (17 August 2026) says solicitors stay accountable for their work and AI has no legal personality. Citations must be genuine and verifiable. Firms need governance and controls, and supervisors stay accountable. Client data entered into public AI tools may breach confidentiality and privilege may be permanently waived. Client data should go into AI tools only where contractual, technical and organisational safeguards exist, with no training on it unless explicitly authorised.[13]
The Law Society's Generative AI – the essentials (updated 30 June 2026) advises against putting confidential data into free tools where there is no vendor relationship. It recommends fictional data for testing and templating, documenting inputs and outputs, agreeing AI use with clients, checking insurance and planning an exit.[14]
ABA Formal Opinion 512
ABA Formal Opinion 512 (29 July 2024) applies the duties of competence (Rule 1.1), confidentiality (Rule 1.6), communication (Rule 1.4) and fees (Rule 1.5) to lawyers' use of generative AI tools. Lawyers generally cannot bill clients for time spent learning a generative AI tool.[15][16]
CCBE guide on generative AI
The Council of Bars and Law Societies of Europe published its guide on the use of generative AI by lawyers on 2 October 2025. Client data should not go into AI tools without safeguards. Competence includes understanding the tool and verifying its output. Independence covers bias and sycophancy. Lawyers should be transparent with the client where an informed client would object to the AI use.[17]
The CCBE also published a technical guide on AI tools and models for lawyers on 27 March 2026, which we have not reviewed for this page.[18]
EU AI Act
Article 4 of the EU AI Act (Regulation (EU) 2024/1689), on AI literacy, has applied to providers and deployers of AI systems since 2 February 2025.[19]
An amending regulation published in the Official Journal on 24 July 2026 (OJ L 2026/1744) says in recital 40 that the obligations in Chapter III, Sections 1–3, apply from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems. The general application date stays 2 August 2026.[20] Its recital 8 signals changes to Article 4; we have not confirmed the final amended wording from the official text.
Annex III, point 8(a), lists as high-risk AI used by or on behalf of a judicial authority, or in alternative dispute resolution, to research and interpret facts and law.[21] Our reading, which is an interpretation and not legal advice, is that a law firm's own drafting tools are not listed as such.
The template
Fifteen sections. Text in [brackets] is a placeholder: replace it, choose between the options it offers or delete it. Drafting notes explain the options and are not part of the policy; the Word file carries them as comments so you can delete them all at once.
Disclaimer. This is a template, not legal advice. It does not create a lawyer–client relationship. Before adopting it:
- adapt it to your jurisdiction(s), professional rules and client instructions;
- apply any court or regulator guidance that binds you;
- have it reviewed by qualified counsel.
Last reviewed: [date].
[FIRM / LEGAL DEPARTMENT NAME]: Policy on the Use of Artificial Intelligence
Version [x.x] · Approved by [body] on [date] · Owner: [AI Governance Lead] · Next review: [date]
1.1 This Policy sets the rules for using artificial intelligence (AI), including generative AI, in work done by or for [Firm/Department]. Its purpose is to:
- (a) protect client confidentiality and legal privilege;
- (b) keep our work accurate;
- (c) meet our duties to clients, courts and regulators.
1.2 It applies to [all partners, lawyers, trainees, paralegals, support staff, secondees, contractors and consultants] ("Users"), on any device, whenever they work on [Firm/Department] matters or handle [Firm/Department] or client information.
1.3 It covers all AI tools: tools licensed by us, AI features built into software we already use ([email, word processing, document management, e-discovery]), and publicly available tools.
1.4 This Policy adds to, and does not replace, our professional obligations. These include [the applicable code(s) of conduct, e.g. the Mandatory Code of Conduct for Legal Practitioners in the DIFC Courts; the applicable advocacy law and bar rules], data protection law, and the practice directions of the courts before which we appear. Where there is a conflict, the law, rule or court direction prevails.
Drafting note
Name the codes that actually bind your lawyers. In-house teams: state whether the company-wide IT/AI policy also applies and which policy prevails.
- Option A: one policy for all staff.
- Option B: a legal-team annex to the corporate AI policy. This is often easier in-house.
- AI tool: software that produces content, predictions, recommendations or decisions from inputs with a degree of autonomy. This includes chat assistants and tools for drafting, summarisation, translation, transcription, research and review.
- Generative AI: AI that generates new text, images, audio, video or code in response to a prompt.
- Approved Tool: an AI tool listed in Annex A after the review in Section 7.
- Public Tool: an AI tool used under consumer or standard online terms that [Firm/Department] has not contracted for and reviewed.
- Input: anything entered into or uploaded to an AI tool. Output: anything an AI tool produces.
- Client Information: all information relating to a client or matter, however obtained, including the fact that a matter exists.
- Privileged Material: material protected by legal professional privilege or professional secrecy under applicable law.
- Personal Data: as defined in the data protection law applicable to the processing.
- Hallucination: Output that appears plausible but is false, invented or unsupported, e.g. a non-existent case or statutory provision.
Drafting note
Keep definitions technology-neutral so the policy survives tool changes. In the DIFC or ADGM, align "Personal Data" with the free-zone law, not the federal PDPL. See the GCC legal glossary and our data protection guide.
3.1 Users may use only Approved Tools for work, and only within the data classes allowed for each tool (Annex A and Section 4).
3.2 Prohibited without exception:
- (a) entering Client Information, Privileged Material or Personal Data into a Public Tool;
- (b) using AI to fabricate, alter or "enhance" evidence, or to draft a witness's evidence other than in the witness's own words;
- (c) presenting AI Output to a court, tribunal, regulator, client or counterparty without the human verification in Section 5;
- (d) using AI to make a final legal decision or give final advice without lawyer review;
- (e) running AI tools on work data through personal accounts or devices [unless approved under the BYOD policy];
- (f) circumventing tool settings fixed by [IT/Knowledge team], including re-enabling chat history or model training;
- (g) [using AI note-takers or recorders in client meetings or hearings without the consent of all participants].
3.3 Permitted with an Approved Tool, subject to Sections 4 and 5: [first drafts; document summaries; Arabic–English translation; clause extraction and comparison; legal research assistance; e-discovery and document review; proofreading; internal knowledge search].
3.4 Requests to approve a new tool go to [AI Governance Lead] using Annex B.
Drafting note
- Option A (allow-list, recommended): only listed tools may be used.
- Option B (deny-list): everything is allowed except listed tools. Suitable only for non-confidential work.
Two GCC court texts point to Option A. QICDRC PD 1/2026 allows confidential input only into "private, secure AI platforms".[2] DIFC Courts' PGN 2/2023 advises against free conversational tools for legal content.[1] Also decide whether AI features switched on inside existing office software need separate approval. Contract-review use is covered on our AI contract review page.
4.1 Before using any AI tool, Users must classify the information they intend to input and follow this table:
| Class | Examples | Public Tool | Approved general-purpose tool (enterprise terms, no training on our data) | Approved legal tool with [in-country hosting / approved region] and matter-level access controls |
|---|---|---|---|---|
| 1. Public | Published laws and judgments, public news, our published articles | Allowed | Allowed | Allowed |
| 2. Internal | Firm know-how, templates with no client data, training material | Not allowed | Allowed | Allowed |
| 3. Client confidential | Client documents, correspondence, contracts, matter facts, client identity | Not allowed | [❌ / ✅ only if anonymised under 4.3] | Allowed [subject to client terms, 4.4] |
| 4. Highly sensitive / privileged | Privileged advice, litigation strategy, sensitive personal data (health, criminal, children), government or [critical-infrastructure] client data | Not allowed | Not allowed | [✅ only with written client consent and [Partner/GC] approval / ❌ never] |
| 5. Restricted by law or order | Data under a court confidentiality or sealing order; data a client contract says may not leave [country]; classified government data | Not allowed | Not allowed | ❌ unless the order, contract or law expressly allows it |
4.2 When in doubt, treat information as the higher class.
4.3 Anonymisation: removing names is not enough. Remove or replace every detail that could identify the client, the counterparty or the matter. Never use real client data to test or train tools or to build templates. Use fictional data.
4.4 Client instructions prevail. Follow any engagement terms, outside-counsel guidelines or instructions that restrict AI use or data location. [Before inputting Class 3 or 4 information, we will obtain the client's informed consent [in the engagement letter / matter by matter].]
4.5 Do not disable security settings. Chat history and model training on our data must be off wherever the tool allows it.
Drafting note
Three sources shape this table:
- DIFC Courts' PGN 2/2023: have client consent before giving confidential information to a generative AI tool, and read the tool's terms of use.[1]
- QICDRC PD 1/2026: no confidential or privileged input except into private, secure platforms.[2]
- SRA (UK): client information entered into public tools may permanently waive privilege.[13]
Choose the consent model for Class 3. Engagement-letter consent is efficient; matter-by-matter consent is more protective. Government and critical-infrastructure clients often set their own hosting rules, which is why Class 5 exists.
5.1 The User who relies on an Output is responsible for it as if they had written it. AI is a tool and carries no responsibility.
5.2 Before any Output leaves [Firm/Department] or is relied on internally, a qualified lawyer must:
- (a) check every case, statute, regulation and quotation against a primary source or a recognised legal database. Confirm that it exists, says what is claimed, is current, and comes from the correct jurisdiction (e.g. DIFC common-law authority vs onshore civil-law provisions);
- (b) check facts against the matter file;
- (c) check Arabic–English renderings of legal terms against the authoritative-language text;
- (d) check for bias, omissions and over-confident conclusions.
5.3 Witness statements and affidavits must reflect the witness's own words and knowledge. AI may help only with format and language. The witness must confirm the content before signing any statement of truth.
5.4 Record the verification in the matter file [with the Annex C checklist / with the note "AI-assisted; verified by [initials] on [date]"].
5.5 Supervisors remain responsible for the AI-assisted work of the people they supervise.
Drafting note
Every source reviewed agrees on this:
- DIFC Courts may reject AI-generated content and warn that false statements of truth can lead to contempt.[1]
- QICDRC treats fabricated or unverifiable citations as a breach of duty, with sanctions up to contempt.[2]
- SDAIA's generative AI guidelines make verification the user's responsibility.[10]
Choose the level of record-keeping: a short file note for small teams, or the Annex C checklist for litigation teams. Research workflows are covered on our legal research page.
6.1 Clients. [Our engagement terms tell clients that we may use Approved AI Tools and how we protect their information.] We follow any client instruction not to use AI. [We do not bill clients for time spent learning AI tools.]
6.2 Courts and tribunals. Follow each forum's rules:
- (a) DIFC Courts (PGN 2/2023):[1]
- declare the use, or intended use, of AI-generated content at the earliest opportunity;
- raise it with the other side and resolve any issues no later than the Case Management Conference;
- keep the client informed and obtain their consent to using generative AI material in submissions.
- (b) QFC Court and Regulatory Tribunal (QICDRC PD 1/2026):[2]
- no pre-emptive declaration is required unless the Court asks;
- be ready to identify AI-generated portions and explain how they were verified;
- always disclose AI-generated or AI-enhanced multimedia evidence.
- (c) Other courts, tribunals and arbitrations: follow any applicable direction. Where there is none, [disclose material AI use where fairness requires it / refer to the supervising partner].
6.3 [Litigation Lead] keeps a forum register (Annex D) and updates it [quarterly].
Drafting note
This is where GCC forums differ most, so don't write one universal rule.
- Option A: proactive disclosure to every court. Simplest and most conservative; matches DIFC.
- Option B: follow each forum's own rule. Matches QICDRC's "only if asked".
On fees: ABA Formal Opinion 512 says lawyers generally should not bill clients for learning a generative AI tool.[15] This is a useful benchmark, though not binding in the GCC.
7.1 No AI tool may be approved until [AI Governance Lead], with [IT Security] and [DPO/Legal], has completed the Annex B questionnaire. It covers at least:
- (a) where Inputs, Outputs, logs and backups are stored and processed, and from which countries staff or sub-processors can access them;
- (b) whether Inputs or Outputs train or improve models, and whether that is contractually excluded;
- (c) the underlying model providers and sub-processors;
- (d) retention and deletion, including deletion when a matter closes;
- (e) encryption, access controls (SSO, matter-level permissions) and exportable audit logs;
- (f) the cross-border transfer mechanism relied on under each relevant law;
- (g) breach-notification timelines;
- (h) handling of government and law-enforcement requests;
- (i) independent security reports (ask for the reports themselves, not logos);
- (j) Arabic-language capability, if Arabic documents will be processed.
7.2 Tools that process Class 3 or 4 data must meet the data-location requirements of [the applicable data protection laws, client contracts and sector rules]. Record them in Annex A.
7.3 Re-review each approval [annually], and whenever the vendor changes its terms, models or sub-processors.
Drafting note
Data-location rules differ across GCC states and between onshore and free-zone regimes. Some regimes treat remote access from abroad as a transfer. See our GCC data protection and data residency guide for legal teams for each regime and a longer vendor checklist.
- Option A: in-country hosting for all Class 3–4 data (strictest).
- Option B: accept approved transfer mechanisms (more flexible, more paperwork).
8.1 Do not input third-party material in breach of licence terms (e.g. [subscription database content]), and do not ask a tool to reproduce protected works.
8.2 Before approval, confirm under the vendor's terms that [Firm/Department] [and the client] own or may freely use Outputs, and that the vendor gains no rights in Inputs.
8.3 Work product created with AI assistance belongs to [Firm/client] on the same terms as other work product under [the engagement terms / employment contracts].
8.4 Do not treat Output as original work for copyright purposes without legal review. [Label published AI-generated text or images as AI-generated.]
Drafting note
DIFC Courts' guidance names IP infringement as a core risk and refers to the DIFC IP Law.[1] Whether AI-generated content is protectable varies by jurisdiction. This template takes no position on that question.
9.1 No User may use an Approved Tool before completing [AI induction training]. It covers this Policy, data classification, verification, hallucination risk, forum disclosure rules and tool settings.
9.2 Refresher training happens [annually] and after any significant change to tools or rules. [HR / L&D] records completion.
9.3 [Relevant training may count towards CPD where the regulator allows.]
Drafting note
Separate "how to use the tool" training from "professional and ethical use" training; the Law Society (UK) recommends both.[14] The CCBE treats understanding the tool as part of competence.[17] If you have EU offices or clients, note the EU AI Act's AI-literacy article (Art. 4). It has applied since February 2025 and is being amended.[19][20]
10.1 Report to [AI Governance Lead and DPO/IT Security] immediately, and in any case within [24 hours], if you become aware of:
- (a) Client Information, Privileged Material or Personal Data entered into a Public Tool, or into a tool not approved for that class;
- (b) Output with a hallucinated or wrong authority that has been sent outside the firm or filed;
- (c) tool behaviour suggesting a data leak, or a vendor security notice.
10.2 [AI Governance Lead] decides whether clients, courts, regulators or data protection authorities must be notified, and acts within the applicable deadlines.
10.3 A good-faith report does not by itself lead to discipline. Concealment does.
Drafting note
Notification deadlines differ by data protection regime, so link this process to them (see the data protection guide). If a filed document contains a wrong citation, prompt correction with the court is usually the safest course. Decide in advance who makes that call.
| Role | Responsibility |
|---|---|
| [Managing Partner / General Counsel] | Approves the Policy; accepts residual risk |
| [AI Governance Lead] | Owns the Policy, Annex A (tools) and Annex D (forums); runs approvals and reviews |
| [IT / Information Security] | Technical review; configuration (training off, logging on); access control |
| [DPO / Privacy Counsel] | Data protection assessment; transfer mechanisms; breach notifications |
| [Risk & Compliance] | Monitoring, audits, incident log |
| [Practice-group leads / Supervising partners] | Enforce verification and supervision |
| All Users | Comply, complete training, report incidents |
Drafting note
Small firms can combine the roles in one partner. Larger firms often form an AI committee. In-house teams should align with the company's data or AI board, but keep privilege decisions within Legal. The SRA warning notice stresses firm-level governance, systems and supervision.[13] For audience-specific guidance see for law firms and for in-house legal teams.
12.1 [Firm/Department] may log and audit use of Approved Tools in line with applicable law and our [IT/privacy notice].
12.2 A breach may lead to disciplinary action [up to dismissal] and, where required, a report to regulators.
13.1 Review this Policy every [6 / 12] months. Also review it when:
- (a) a court or regulator in a forum where we practise issues AI guidance;
- (b) a significant incident occurs;
- (c) we adopt a materially new tool.
13.2 Record the version history in Annex E.
- Annex A: Approved Tools register. Columns: Tool | Vendor | Allowed data classes | Hosting region | Training off (Y/N) | Owner | Approved | Review date.
- Annex B: New-tool request and due-diligence questionnaire. Use the Section 7 list.
- Annex C: Verification checklist.
- ☐ every authority checked against a primary source
- ☐ jurisdiction correct
- ☐ quotations exact
- ☐ facts checked against the file
- ☐ translation checked
- ☐ forum disclosure rule applied
- ☐ verification recorded
- Annex D: Forum register. Columns: Forum | Instrument | Disclosure rule | Last checked. Pre-filled rows:
- DIFC Courts | PGN 2/2023 | early disclosure
- QICDRC | PD 1/2026 | on request
- ADGM Courts | [check current position] |
- Onshore courts | [check current position] |
- Annex E: Version history.
I, [full name], [job title], confirm that I have read and understood the [Firm/Department] Policy on the Use of Artificial Intelligence (version [x.x]). I agree to comply with it, and I understand that a breach may lead to disciplinary action. I completed the required training on [date].
Signature: ____________ Date: ____________ Staff/ID number: ____________
Implementation checklist
Eleven steps from draft to adopted policy.
- Appoint the policy owner and choose the governance model.
- Inventory the AI tools already in use, including features built into existing software.
- Choose an allow-list or a deny-list (Section 3).
- Run vendor due diligence and fill in Annex A.
- Tailor the data-classification table to your clients and hosting options.
- Update engagement letters to cover AI use and consent.
- Build the forum register: DIFC, QICDRC, ADGM, onshore courts and arbitral institutions.
- Configure tools: training off, history off where needed, SSO, logs on.
- Train all users and collect signed acknowledgements.
- Connect incident reporting to your data-breach procedure.
- Set the review date (6–12 months) and check monthly for court and regulator updates.