ANVE: the private AI office, on the record. See what that means

ANVE

Private AI, answered · updated 2026-10-07

What should an office AI policy cover?
Twelve headings, two pages, written so staff can follow them on a busy day.

Short answer. An office AI policy should cover twelve things: purpose and scope; approved tools and accounts; permitted and prohibited uses; what data may go in; confidentiality and client disclosure; accuracy and human review; records and retention; roles and accountability; training; incidents and errors; vendors and third parties; and review and exceptions. Keep it to about two pages with examples. NIST’s generative AI profile calls for acceptable use policies that cover tools, human-AI configurations and the kinds of queries that should be refused, and for updating them to cover open-source technologies and third-party personnel.

01

Twelve headings

HeadingWhat to writeExample line
1. Purpose and scopeWhy the policy exists and who it covers: employees, partners, contractorsThis policy covers anyone doing work for the firm.
2. Approved tools and accountsThe tools staff may use, and a ban on personal accounts for client workUse only the office AI and tools on the approved list.
3. Permitted and prohibited usesTasks allowed, tasks needing approval, tasks bannedAI may draft. It may not decide on hiring or send anything to a client unreviewed.
4. Data rulesWhat may be entered, by class, and what never mayNever paste passwords or client identifiers into cloud tools.
5. Confidentiality and disclosureClient confidentiality, and when to tell clients, courts or regulators that AI was usedAsk the partner before using AI on a matter that needs client consent.
6. Accuracy and human reviewCheck cited sources, name a reviewer, require sign-off for external outputThe person who sends the work owns it.
7. Records and retentionWhat is logged, who can read it, how long it is kept and how to delete itWorking chats are deleted on the schedule in the retention table.
8. Roles and accountabilityOwner, administrator, sponsor and privacy contactQuestions go to the AI owner.
9. TrainingWho is trained, when, and how it is refreshedEveryone completes the induction session in their first week.
10. Incidents and errorsWhat to report, to whom and how fast, with no blameReport any wrong output that left the office, or data pasted by mistake, the same day.
11. Vendors and third partiesHow tools are approved; contracts, data location, remote accessNew AI tools need approval and a review of where data goes.
12. Review and exceptionsThe review date, and how exceptions are requested and recordedThe policy is reviewed every year and after any incident.
02

Three rules most offices need on page one

  • Never put client or personal data into tools the office has not approved.
  • A person checks everything that leaves the office, and the sender owns it.
  • Report mistakes early. Nobody is blamed for reporting.
03

Where the headings come from

NIST’s generative AI profile suggests establishing acceptable use policies for generative AI interfaces and human-AI configurations, with criteria for the kinds of queries that should be refused. It suggests updating them to address proprietary and open-source technologies and data, and contractors, consultants and other third-party personnel. It also suggests incident response plans for third-party technologies. The NIST AI Risk Management Framework asks organisations to understand and document legal and regulatory requirements, to inventory their AI systems, to document roles and responsibilities, and to train personnel for their duties.

OWASP’s guidance on sensitive information disclosure adds a clear policy on data retention, usage and deletion, and user education on avoiding sensitive input. For records and breaches, the CERT-In directions and the DPDP Act set expectations that the policy should point to. This is general information, not legal advice.

04

Make it usable

  • Two pages with examples, in plain words.
  • Name a person for questions.
  • List the approved tools and what each is for.
  • Keep a one-line version for the wall.
  • Have staff acknowledge it at induction and when it changes.
  • Link to the incident form.
05

Keep it alive

  • Set a review date and keep every version.
  • Keep a register of AI tools and uses. NIST’s framework asks for mechanisms to inventory AI systems.
  • Review after incidents and when a tool or model changes.
  • Check the policy against what the system actually allows. A rule the product does not enforce is only a request.
06

What ANVE says

A policy is the office’s own document, and ANVE cannot write it for you. Two features of ANVE support the records and accountability headings. Every model call is logged with the user, the app, the model and whether it ran locally or in the cloud. Meeting action items need an owner confirmed by a person, with each confirmation logged. Cloud models are optional and added by an administrator, which gives you a clear approval point for the vendors heading. ANVE is pre-release and holds no certifications.

07

Questions people ask

Is an AI policy a legal requirement?
The DPDP Act does not require an AI policy as such, but it requires reasonable security safeguards and that the office can answer for its processing of personal data. A policy is how most offices show they have thought about it. This is general information, not legal advice.
Should staff sign it?
Yes, at induction and whenever it changes, so there is a record that they read it.
What about personal AI accounts?
Say plainly whether they may be used for work. For client work the usual answer is no. See the question on personal chatbot accounts.
08

What is not real yet

No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.

Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.