Define allowed use cases. Identify where AI is permitted—and where it is not—based on risk, sensitivity, and impact. Low-risk use cases such as internal drafting or summarization may be appropriate, while activities involving client advice, coverage interpretation, or decision-making should be restricted or tightly controlled. Clear boundaries ensure AI is used to support operations, not replace professional judgment.

Set tool standards. Approved tools, approved configurations, and clear rules for data entry must be established. Not all AI platforms operate with the same level of security or data handling, and uncontrolled usage introduces risk. Define which tools can be used, how they are configured, and what information can be entered—particularly when it relates to client data or proprietary information.

Require human review. Establish when AI outputs must be reviewed, by whom, and what “approval” means. AI-generated content should never be treated as final without validation. Define review thresholds based on risk and complexity, ensuring that qualified individuals assess outputs before they are used in client-facing or decision-making contexts.

Document evidence. Decide what needs to be retained—prompts, outputs, decisions—and where that information is stored. Documentation ensures transparency and provides a clear record of how AI was used, what decisions were made, and who was responsible for review and approval. This is critical for both internal governance and regulatory defensibility.

Train the team. Practical training is required to ensure AI is used safely and effectively. This includes understanding limitations, recognizing where outputs may be unreliable, and knowing when to escalate. Training should be tied to real operational scenarios so that staff can apply guidance in day-to-day work, not just in theory.

Monitor and improve. AI use should not be static. Establish a process for periodic review of usage, incidents, and control effectiveness. Track how tools are being used, identify emerging risks, and refine policies and practices over time. Continuous improvement ensures that AI remains a controlled and valuable part of the brokerage’s operations, rather than an unmanaged risk.