Purpose

AI tools can save us a great deal of time, and we already use them to draft reports, letters and file notes. They also bring real risks: they can be confidently wrong, they can leak confidential information if used carelessly, and they can tempt us to rely on output we have not properly checked.

This policy sets out how we get the benefit of AI while continuing to meet our obligations to clients and to the FCA. The underlying rule is simple: AI can help us do the work, but it never does the thinking or takes the responsibility.

Scope

This policy applies to everyone who works for or on behalf of Annetts & Orchard Ltd — directors, advisers, paraplanners, administrators, temporary staff and contractors — whenever they use an AI tool for firm business, whether on a firm device or a personal one.

An AI tool is any software that generates or summarises text, images, audio or decisions using artificial intelligence. That includes:

• the firm's own tools (for example the Suitability Report, Annual Review Letter, Top-up/Withdrawal Letter and File Note generators);
• meeting recording and transcription services (for example Saturn);
• general-purpose AI assistants such as ChatGPT, Claude, Gemini and Microsoft Copilot;
• AI features built into software we already use — email, Office 365, our CRM, provider and platform websites, browser extensions and phone apps.

Key principles

If you remember nothing else, remember these:

1. You are responsible. Anything you produce with AI is your work. Your name on it means you have checked it.
2. Approved tools only. Use only the tools listed in the register in section 5, and only for the uses shown.
3. Protect client data. Client information goes only into tools approved for client data. Never into a personal or free account.
4. Check every output. Verify facts, figures and references against the source before anything is relied on or sent.
5. AI supports advice; it never gives it. Suitability, risk profiling and recommendations are the adviser's judgement.
6. Be open with clients. Tell clients when AI is used in ways that affect them, such as recording meetings.
7. If in doubt, ask first. Speak to a director before using AI for anything this policy does not clearly cover.

Roles and responsibilities

Directors

• Own this policy and keep it up to date.
• Maintain the approved tools register and decide whether a new tool or use may be added (section 13).
• Make sure a data protection impact assessment (DPIA) is completed before any AI tool processes client personal data.
• Check that AI use across the firm is consistent with our obligations under the Consumer Duty and that its effect on client outcomes is monitored.
• Under the Senior Managers & Certification Regime, the directors remain accountable for AI-assisted work in the same way as any other work the firm produces.

Everyone

• Read this policy, follow it, and confirm each year that you have done so (section 14).
• Report mistakes, near misses and concerns promptly (section 12). Reporting an error quickly is always the right thing to do.

Approved tools register

Only the tools below may be used for firm business. If a tool is not listed, it is not approved — including AI features that appear in software we already use.

Anonymised means a reader could not identify the client from what you entered, even when it is combined with other details. Removing the name is not enough if the date of birth, address, employer, plan numbers or an unusual set of circumstances remain.

Prohibited uses

Client data and data protection

Putting personal data into an AI tool is processing under UK data protection law (UK GDPR and the Data Protection Act 2018). Our normal obligations apply in full:

• Minimise. Upload or enter only what the task needs. Do not upload a whole client file when two documents will do.
• Take extra care with special category data. Health information is common in our work (protection, vulnerability, retirement planning) and needs particular care. Only enter it into a tool approved for client data, and only where it is relevant.
• Check the supplier first. Before a tool is approved for personal data, a director must be satisfied that it has a data processing agreement in place, does not use our data to train its models, keeps data only as long as necessary, stores data securely and protects any transfer outside the UK.
• Complete a DPIA before a new AI tool processes client personal data, and record the outcome.
• Keep clients informed. Our privacy notice must explain that we use AI-assisted tools and transcription services, and who our main processors are.
• No solely automated decisions. UK data protection law restricts significant decisions about people made solely by automated means. We do not make such decisions: a person reviews and owns every decision about a client.
• Client rights still apply. AI-generated notes and documents held on a client's file are personal data. They fall within subject access and erasure requests like any other record.

Using AI in advice and client work

Suitability and recommendations

The adviser forms the recommendation; AI helps write it up. The suitability assessment under COBS 9, the attitude to risk and capacity for loss assessment, and the choice of product and provider are the adviser's own professional judgement and must be evidenced as such on file.

Checking output before use

Before any AI-drafted document is relied on, filed or sent, the person responsible must check that:

1. it relates to the right client, and contains no details from another client;
2. every fact matches the source documents and what was actually discussed or agreed;
3. all figures are correct — values, charges, percentages, contributions, withdrawals, dates and ages;
4. any regulatory, tax or product statements are accurate and current;
5. nothing has been invented, and nothing material has been left out (including risks, disadvantages and alternatives considered);
6. it is clear, fair and not misleading, and written so the client can understand it (Consumer Duty, consumer understanding outcome).

The adviser whose name appears on a suitability report or letter must personally review and approve it before it is sent.

Meeting recordings and file notes

• Read the AI-generated note against your own recollection and correct it before it goes on file. A file note is a record you are vouching for.

Vulnerable clients

AI may help highlight possible signs of vulnerability, but it must not be relied on to identify or rule them out. Recognising and responding to vulnerability remains the adviser's responsibility under our vulnerable clients approach.

Client communications and marketing

• AI may help draft emails and letters, but you must read and edit them so they are accurate and sound like us before they are sent.
• Any AI-assisted financial promotion — website content, social media, newsletters, adverts — goes through the same approval process as any other promotion and must be fair, clear and not misleading.
• Do not publish AI-generated images of people presented as real clients or staff.

Security and fraud awareness

• Use firm accounts with multi-factor authentication. Do not share logins, including for the firm's internal tools.
• AI makes fraud more convincing. Treat with caution any unexpected request — especially to change bank details, move money or release information — even if the email, voice or video appears to come from a client, colleague or provider. Verify through a contact method you already hold, not one supplied in the request.
• Be alert to AI-written phishing emails, which may be free of the spelling mistakes that used to give them away.

Record keeping

• Save the final, checked version of any AI-assisted client document to the client's file, together with the source material it relied on, in line with our normal record-keeping requirements.
• Working drafts do not need to be kept once the final version is on file. Saved drafts in the firm's internal tools are deleted automatically after 90 days.
• Where AI materially contributed to a document sent to a client, the file should show who reviewed and approved it.

Mistakes, incidents and breaches

Tell a director the same day if:

• client or confidential information has been entered into a tool not approved for it;
• an AI-assisted document containing an error has been sent to a client or provider;
• a tool has behaved unexpectedly, for example by showing information that is not ours;
• you suspect AI-enabled fraud or impersonation.

The director will assess whether a personal data breach has occurred and, if it is reportable, notify the ICO within 72 hours of the firm becoming aware of it. Errors in client documents will be corrected and explained to the client, and any resulting complaint handled under our complaints procedure.

Introducing a new AI tool or use

To use a tool or feature not on the register, or to use an approved tool in a new way, ask a director first. Before approving it, the director will consider:

• what it will be used for and what data it will see;
• the supplier's terms, data processing agreement, security, data location and whether our data is used for training;
• whether a DPIA is needed, and its outcome;
• the likely effect on client outcomes and whether it offers good value.

Approved tools are added to the register in section 5 and staff are told.

Training and acknowledgement

Everyone in scope must read this policy when they join, whenever it changes and at least once a year, and confirm they have done so by signing the staff acknowledgement at the end of this policy. Directors will make sure staff using the firm's AI tools understand how to use them and their limitations.

Breaches of this policy

Not following this policy may put clients and the firm at risk and may lead to disciplinary action. Honest mistakes that are reported promptly will be treated as an opportunity to learn and improve our controls.

Review

This policy is reviewed at least annually, and sooner if we introduce a significant new tool, if something goes wrong, or if FCA or ICO expectations change. The FCA has not, at the date of this policy, introduced rules specific to AI; it expects firms to apply the existing framework to their use of it.

Relevant rules and guidance

• FCA Principles for Businesses, including Principle 12 and the Consumer Duty (PRIN 2A)
• SYSC — systems and controls, record keeping and outsourcing
• Senior Managers & Certification Regime
• COBS 9 (suitability) and COBS 4 (financial promotions)
• UK GDPR and the Data Protection Act 2018, and ICO guidance on AI and data protection

Version history