The AI usage policy your agency needs. Twelve things it has to cover, and why the document is the easy part.

What a good agency policy covers

A policy written for a software company or a bank does not fit an agency. Yours has to deal with other people's brands, journalists, embargoes and quotes. These are the twelve sections we include, and the reason each one is there.

1. Scope and owner. Who it applies to, including freelancers, and the named director who owns it.
2. Approved tools and how one gets approved. A register beside the policy, with the account each tool must be used through. Personal accounts for client work are the most common breach we see.
3. Client data and confidentiality. What may never be entered into any tool: unpublished results, embargoed announcements, personal data, anything under NDA. Listed in full, because "use judgement" is not a control.
4. Disclosure to clients. When and how you tell a client that AI was used, and the client-facing AI transparency statement that goes with it.
5. Verification. The rule that a named person checks AI output before it leaves, and the specific things they check: facts, figures, names, sentiment calls, anything attributed to a person.
6. Quotes and attributed statements. Nothing in a spokesperson's voice is generated and sent without that person's sign-off. In PR this section does more work than any other.
7. Statistics and research. How a figure produced or found with AI is sourced before it is used, and what happens when it cannot be.
8. Copyright and third-party material. Images, voices and text: what may be generated, what must be licensed, what is never used.
9. Crisis, sensitive and regulated work. Where AI is not used at all, or only with the owner's say-so, and why.
10. Training and acknowledgement. Everyone reads it, everyone signs it, new starters sign it in week one, and the record is kept.
11. Incidents. What counts as one, who hears about it and what gets written down. Most agencies have had one already; few have recorded it.
12. Review date. A fixed date, at least annually, and a trigger list: a new tool, a new client sector, a change in the law.

The document is the easy part

Writing the policy takes a day. The thing a client's procurement team actually tests is whether it is in force, and that is a different question. The agency we audited that already had a policy, a good one, could not produce four things on request, and we expect that to be the norm:

• the signed acknowledgements that show every member of staff, and every freelancer who touches client work, has read it
• the training record of who was shown how to work within it, and when
• the approved-tools register, current, with the account each tool runs under
• the incident log, even if it says nothing has happened

That evidence is the real governance job, and it takes months rather than a day because it has to be true. A policy with the evidence behind it wins the questionnaire. A policy without it is a PDF.

The client-facing version

The internal policy is for your team. Clients get a shorter document, usually one page, that says what you use AI for in their work, what you never use it for, who checks the output and who to ask. It is written to be forwarded to the client's own legal or procurement people without you in the room. The audit produces both documents together, so they say the same thing.

How to get the template

The policy is one of the four deliverables of the £499 audit, fitted to your tools, your clients and your sectors. If you would rather start with the bare template, email and ask; we send it with a short note on the three sections agencies most often get wrong.

Questions agencies ask