AI Governance & Acceptable Use Policy

Willsure is a LegalTech platform that uses Artificial Intelligence ("AI") to help solicitors and their clients review, analyse and monitor Wills and estate-planning documents. We believe AI, applied responsibly, can materially improve the quality, speed, accessibility and commercial performance of estate-planning work - surfacing risk in historic archives, flagging Wills that need updating, and freeing fee-earner time for chargeable client work.

We also recognise that AI introduces material risk. For a regulated legal practice and for the clients those practices serve, those risks include inaccurate or fabricated information, breaches of confidentiality, loss of legal professional privilege, inappropriate processing of personal data, cybersecurity vulnerabilities, intellectual-property issues, bias, inadequate supervision, inappropriate automated decision-making, and damage to clients, firms and reputation.

Willsure therefore adopts the following fundamental principles:

• AI may assist legal professionals. AI does not assume professional responsibility.
• The use of AI must always be proportionate to the risk of the activity being undertaken.
• A qualified, regulated human remains responsible for checking and validating material AI-generated outputs before reliance.
• Where Willsure's AI is used in the provision of legal services, professional responsibility remains with the appropriately authorised and qualified professional at the client firm - never with Willsure.

This Policy establishes the minimum governance, security, confidentiality, data-protection, professional and operational standards that apply to the design, development, deployment and ongoing operation of AI by or on behalf of Willsure. It is shared with client firms so they can assess Willsure's AI practices before and during a pilot.

The purposes of this Policy are to:

1. enable responsible and commercially valuable use of AI in estate planning and Will review;
2. protect client firms, their clients, beneficiaries and other individuals;
3. protect confidential information and legal professional privilege;
4. ensure compliance with applicable law and professional obligations;
5. establish clear accountability for Willsure's AI systems;
6. prevent uncontrolled or "shadow AI" behaviour within Willsure's own environment;
7. establish appropriate human oversight of every material AI output;
8. manage AI-related operational, legal, regulatory and reputational risk;
9. provide a consistent framework for approving and changing AI systems;
10. create an auditable record of Willsure's AI environment;
11. establish requirements for Willsure's AI suppliers and sub-processors; and
12. support innovation while maintaining professional standards.

This Policy applies to:

• Willsure directors, employees and contractors;
• Willsure's AI engineers, product and data teams;
• suppliers and third parties who operate AI systems on Willsure's behalf;
• any person using Willsure systems, information or data in connection with AI.

It applies to AI used by Willsure:

• in the Willsure platform and consumer portal;
• in the solicitor portal and lead marketplace;
• in document ingestion, extraction and risk scoring;
• in Will-draft generation and intent validation;
• in client follow-up and life-event monitoring;
• in research, administration, marketing, HR, finance and operations;
• through third-party SaaS products, APIs, internally developed applications, AI agents or autonomous systems.

This Policy applies whether the AI is hosted by Willsure, by a supplier, in the cloud, through an API, or through another third-party platform.

Willsure's AI governance operates alongside all applicable legislation, regulation and professional guidance, including as applicable:

• Solicitors Regulation Authority rules and guidance, and the SRA Standards and Regulations;
• duties to the court;
• legal professional privilege;
• confidentiality obligations;
• UK GDPR and the Data Protection Act 2018;
• the Data (Use and Access) Act 2025 and associated regulations;
• the Equality Act 2010;
• the Copyright, Designs and Patents Act 1988;
• cybersecurity and network-and-information-systems requirements;
• consumer-protection requirements;
• financial-crime and AML requirements; and
• other applicable sector-specific requirements.

Willsure reviews and updates its AI governance whenever legislation, regulation or professional guidance changes. The ICO's current AI guidance - emphasising accountability, risk assessment, data protection by design, transparency, accuracy, fairness, security and appropriate governance - is reflected throughout this Policy.

All AI activity undertaken by or for Willsure complies with the following principles.

• Principle 1 - Human Accountability. AI may support professional and business decisions but does not assume responsibility for them. A qualified human at the client firm remains accountable for material decisions and outputs.
• Principle 2 - Client Confidentiality. Client confidentiality is non-negotiable. Confidential, privileged or sensitive client information is never entered into an unapproved AI system and is never used to train shared or third-party models without an explicit lawful basis.
• Principle 3 - Professional Responsibility. Willsure's AI does not alter or reduce the professional obligations of a solicitor or other regulated professional. Willsure's outputs are advisory, not legal advice.
• Principle 4 - Accuracy. AI-generated information is appropriately verified before material reliance is placed upon it. Willsure designs its systems to make outputs checkable, traceable and explainable.
• Principle 5 - Proportionality. The greater the potential impact of an AI system, the greater the level of governance, testing, oversight and approval required.
• Principle 6 - Transparency. Where Willsure's AI materially affects a client firm or an end client, Willsure will provide appropriate transparency about what the AI did, what it relied on, and the confidence level of its output.
• Principle 7 - Security. AI systems meet Willsure's security requirements and do not circumvent established technical controls.
• Principle 8 - Data Protection by Design. Personal data is processed lawfully, fairly, transparently, securely and only to the extent necessary.
• Principle 9 - Audit-ability. Material AI systems are documented, monitored and auditable. Willsure maintains logs of risk-scoring runs, draft generations and intent validations.
• Principle 10 - Controlled Innovation. Willsure encourages responsible innovation but prohibits uncontrolled experimentation using client, privileged, personal or commercially sensitive information.

For this Policy, "AI" includes technologies capable of performing tasks that ordinarily require human cognitive activity, including:

• generative AI and large language models;
• machine learning and natural-language processing;
• computer vision and predictive analytics;
• automated classification and AI document analysis;
• AI-powered search, AI assistants and AI agents;
• autonomous or semi-autonomous workflows;
• recommendation and automated-decision systems;
• AI APIs and AI-enhanced software; and
• future technologies performing substantially similar functions.

This Policy applies irrespective of the terminology used by a supplier.

Every material Willsure AI use case is assigned a risk classification.

Level 1 - Low Risk. Routine productivity activities where there is limited consequence if the output is incorrect (e.g. formatting, generic copy editing, summarising non-confidential material). Control: approved tools and standard user controls.

Level 2 - Moderate Risk. AI supporting internal business work where incorrect output could cause operational or commercial harm (e.g. internal research, knowledge management, marketing content, meeting summaries). Control: approved system, trained user, appropriate human review.

Level 3 - Professional / Client-Matter Risk. AI supporting legal or client-related activity (e.g. legal research, document review, Will analysis, contract analysis, drafting assistance, preparation of legal documents). Control: formal AI-system approval, appropriate contractual and data-protection controls, qualified human review. Most of Willsure's client-facing features sit here.

Level 4 - High Risk. AI capable of materially affecting legal, financial, regulatory, safeguarding or other significant outcomes (e.g. significant client decisions, AML/fraud signals, vulnerability assessments, automated legal recommendations, profiling, high-impact risk assessments, systems processing highly sensitive information). Control: Board or delegated AI-Governance approval, documented risk assessment, DPIA where applicable, formal testing, monitoring and human oversight.

Level 5 - Autonomous / Agentic AI. AI capable of taking actions or making decisions without immediate human approval (e.g. sending client communications, changing client records, opening or closing matters, executing transactions, invoking other systems). Control: Board-level or formally delegated approval. Any Level 5 capability Willsure deploys has defined permissions, boundaries, authentication, logging, human intervention and rollback.

Acceptable use of Willsure AI includes:

• analysing uploaded Wills and estate documents to produce a plain-English summary, health score and risk indicators;
• flagging Wills that may need review or updating;
• generating draft Will text from a controlled clause library for a qualified professional to review;
• validating whether a draft reflects a client's stated intentions;
• surfacing cross-sell opportunities (LPA, IHT planning) for a firm to consider;
• monitoring life events that may affect an existing Will;
• internal productivity, research and knowledge-management tasks using approved tools.

Prohibited use includes:

• entering client, privileged or personal data into unapproved or public AI tools;
• relying on AI output without appropriate professional review for any Level 3+ use case;
• using AI to make final legal, financial or regulatory decisions without a qualified human;
• using AI to produce communications to clients without human review and approval;
• attempting to use Willsure data to train external or third-party models without explicit authorisation;
• circumventing security, logging or access controls.

Willsure's AI is designed as a decision-support tool, not a decision-maker.

• Every Level 3+ output (Will risk scores, draft clauses, intent validations, follow-up emails) is presented to a qualified human for review before it reaches a client or is acted upon.
• Risk scores and health indicators are explicitly framed as indicators to prompt professional review, not as conclusions.
• AI-generated client communications are held in draft until a firm user approves and sends them.
• Willsure never auto-executes a Will update, matter change or client instruction. Any agentic capability is bounded by the controls in Section 7 (Level 5).

Willsure acts as a data processor (or sub-processor) for client-firm data and as a data controller for its own operational data, in each case processing personal data in accordance with UK GDPR and the Data Protection Act 2018.

• Lawful basis and purpose limitation. Personal data is processed only for the purposes agreed with the client firm and only to the extent necessary.
• Data minimisation. Willsure collects and processes the minimum personal data required to deliver the service.
• Data Protection Impact Assessments (DPIAs). DPIAs are completed for high-risk processing, including the analysis of Wills containing special-category or highly sensitive personal data.
• International transfers. Any transfer of personal data outside the UK uses appropriate safeguards (e.g. UK International Data Transfer Agreements, adequacy decisions or approved transfer mechanisms).
• Sub-processors. Willsure maintains a list of AI and infrastructure sub-processors and provides it to client firms on request. Sub-processor changes are notified in advance.
• Retention. Data is retained only for as long as necessary to deliver the service and meet legal obligations, then securely deleted.
• Subject rights. Willsure supports client firms in fulfilling data-subject access, rectification, erasure and portability requests.

• Willsure treats all client documents and matter information as confidential.
• Privileged material is handled in line with the instructions of the client firm and is not used for any purpose outside the agreed service.
• Willsure personnel and sub-processors are bound by confidentiality obligations.
• Willsure does not use client-firm documents or data to train shared, general-purpose or third-party models without an explicit, documented lawful basis and written agreement.
• Where Willsure uses its own models, any model improvement is governed by a documented data-use policy reviewed by the DPO.

Willsure's AI systems are built and operated to recognised security standards.

• Encryption. Data is encrypted in transit (TLS) and at rest.
• Access control. Role-based access, least-privilege, multi-factor authentication for administrative access, and regular access reviews.
• Network and application security. Segregation of environments, regular vulnerability scanning, and patch management.
• Logging and monitoring. Security and AI-activity logs are retained and monitored for anomalous behaviour.
• Secure development. AI features follow a controlled release process with testing, code review and change management.
• Incident management. A documented incident-response process covers detection, containment, notification and post-incident review. Personal-data breaches are notified to the ICO and to client firms in accordance with statutory timescales.
• Business continuity. Backups and recovery procedures support continuity of the platform and its AI services.

• Willsure maintains an inventory of every AI model and AI supplier it uses, including purpose, data flows, risk classification and approval status.
• Models are evaluated for accuracy, bias, drift and appropriateness before adoption and re-evaluated on a defined cadence.
• Third-party AI suppliers are assessed for security, data protection, confidentiality and model-governance practices before onboarding and are contractually bound to equivalent standards.
• Willsure does not deploy a model into a Level 3+ use case without documented testing and sign-off.
• Model and prompt changes are version-controlled and logged.

• Willsure designs outputs to be explainable and checkable: risk findings reference the underlying document content, and draft clauses are drawn from a controlled clause library.
• Outputs are calibrated and periodically tested against known samples to monitor accuracy and detect drift.
• Willsure monitors for bias in risk scoring and recommendations and takes corrective action where material bias is identified.
• Willsure does not represent AI outputs as legally conclusive. All outputs are accompanied by guidance that they require professional review.

• Willsure tells client firms what AI is used, for what purpose, and what data is processed.
• Where Willsure's AI materially affects an end client (e.g. a Will health score shared with a consumer), the output makes clear that it is AI-assisted and not legal advice.
• Client firms remain responsible for any client-facing transparency or notification required by their own regulators; Willsure supports them with accurate descriptions of its AI use.

• Willsure maintains an auditable record of its AI environment: model inventory, approvals, risk assessments, DPIAs, testing results and change logs.
• Risk-scoring runs, draft generations and intent validations are logged so that outputs can be traced and reviewed.
• Willsure makes audit information available to client firms and their auditors on reasonable request, subject to confidentiality.

• Willsure personnel involved in AI development or operation receive training on this Policy, data protection, security and responsible AI use.
• Willsure fosters a culture of responsible AI use, encouraging staff to raise concerns about AI outputs, data handling or supplier practices.

• Any suspected AI failure, data breach, model-misuse or security incident must be reported immediately to the Chief AI / Product Governance Lead and DPO.
• Willsure assesses, contains and (where required) notifies affected client firms and regulators.
• Post-incident reviews drive corrective and preventive action.

Willsure's AI is effective only with proper professional oversight. Client firms are responsible for:

• providing accurate instructions and data to Willsure;
• ensuring they have the necessary consents and lawful bases to share client data with Willsure;
• reviewing and validating AI outputs before any client reliance or action;
• maintaining their own AI governance, confidentiality and professional-conduct obligations;
• notifying Willsure promptly of any concern about Willsure's handling of data or AI output.

This Policy is reviewed at least annually, and sooner if there is a material change to Willsure's AI systems, the regulatory landscape, or a relevant incident. The next scheduled review is 31/08/2027.

For questions about this Policy, please contact us via our Contact Us page.