What to put in writing.
WHAT TO COVER
Approved tools What client, patient or case material may be sent, and to what What must never be sent What must be verified, and to what standard What may never be delegated Who is accountable Disclosure requirements
THE NEVER-DELEGATE LIST
Profession-specific, and it should be explicit.
For law: advice, citations, filings. For medicine: diagnosis, treatment, prescribing. For engineering: calculations, certification.
THE VERIFICATION STANDARD
State it concretely. "Every citation retrieved and read" is enforceable. "Check your work" is not.
WHAT TO ADDRESS ABOUT CONFIDENTIALITY
Which tools have appropriate terms What anonymisation is required What is prohibited entirely
TRAINING
A policy nobody was trained on is not a control.
REVIEWING
At least annually. Regulator guidance is developing quickly.
LENGTH
Short enough to be read. One or two pages.
WHAT YOUR REGULATOR MAY REQUIRE
Check. Some now expect firms to have a documented position.
