One of your clients is going to email you a question you’ll want a good answer to: “How does your agency use AI, and what happens to our data?”

Maybe it comes from their lawyer. Maybe it’s a line in a new contract. Maybe it’s a nervous owner who read something scary. Either way, “we’re careful” isn’t an answer. A written AI use policy is.

Key Takeaways

• Clients are starting to ask agencies how they use AI with client data. A written policy is the answer they want.
• A good agency AI use policy fits on a few pages: approved tools, data rules, recording rules, a review date.
• Sort the data first, then pick the tool. The type of data decides where it can go, not convenience.
• Keep a short register of every AI tool you run, what data it touches and where that data ends up.
• Write your own before you write one for anyone else. I did, and it changed how I work.

Why clients are starting to ask

For a long time nobody asked. AI showed up inside agencies quietly, one person and one tool at a time, and clients never thought about it.

That’s changing. Bigger clients have their own AI rules now, and those rules reach every agency they hire, including yours. Smaller clients are hearing horror stories about data pasted into the wrong place. Either way, the question is coming, and the agencies with a real answer get to look like the grown-ups in the room.

What goes in an agency AI use policy

It doesn’t need to be long. Mine is a few pages. Here’s what belongs in it.

Approved tools, on approved accounts. A list of the AI tools your team can use, on business accounts where client data isn’t used to train the model. If a tool isn’t on the list, client data doesn’t go into it. Personal accounts are out for client work, full stop.

Data rules. Which kinds of data can go into which tools. Public marketing copy is one thing. A client’s financials, customer lists or anything personal about their customers is another.

Recording rules. When calls and meetings get recorded or transcribed by an AI note-taker, who gets told, and how. Some states require everyone on a call to consent, so write this for the states you and your clients work in, and have your attorney look at it.

Who owns it and when it gets reviewed. One named owner, and a review date. AI tools change fast. A policy nobody has looked at in a year is a policy nobody follows.

Sort the data first, then pick the tool

This is the rule that does the most work, and it’s the one most agencies get backwards.

The usual habit is to pick the tool you like and then put whatever you need into it. Flip that. Put every kind of data you handle into a few buckets, say public, internal, client-confidential and sensitive, and decide where each bucket is allowed to go.

Once that’s written down, most of the hard calls make themselves. Somebody wants to paste a client’s sales numbers into a new tool? Check the bucket, check the list, done.

Keep a register of every tool you run

Alongside the policy, keep a simple register: every AI tool the agency uses, what data it touches, where that data goes and who approved it.

It sounds like paperwork. In practice it’s the document you’ll be glad you have when a client asks a specific question, like “do you use an AI note-taker on our calls, and where are the transcripts stored?” You open the register and answer in a minute instead of a week.

If you want a deeper framework to lean on, the NIST AI Risk Management Framework is free and worth skimming. You don’t need all of it. An agency needs the practical slice.

Why I wrote my own first

My business is one person and a team of AI agents, and I write AI policies for agencies. If I couldn’t show you mine, I’d have no business writing yours.

So I wrote mine first. It lists the tools I’m allowed to put client data into, the data rules, how I handle recording and transcription on client calls, and when it gets reviewed. Writing it changed how I work. ChatGPT, which I use plenty, didn’t make the list for client data, because my account isn’t on business terms yet. It’s approved for testing and nothing else.

That’s the point of doing it. The policy isn’t for show. It’s the set of rules you actually work by, written down so a client can see them.

Frequently Asked Questions

Do I need a lawyer to write an agency AI use policy?

You can write the first draft yourself; most of it is just writing down how you already work. Have your attorney review it, especially the recording and consent rules and anything that ends up referenced in client contracts.

Will a policy slow my team down?

Less than you’d think. Once the approved tools and data rules are written down, people stop asking you every time. The policy answers the question, and you stop being the bottleneck.

What if my team is already using tools that aren’t on the list?

That’s normal, and it’s the reason to write the policy now. Find out what’s in use, move anything that touches client data onto approved business accounts, and retire the rest. Give people a clear path, not a punishment.

Want a policy you can hand a client?

Governance is part of the Head of AI seat I take inside agencies: an AI use policy, a tool register and data rules your clients can read. You can see what’s included on How It Works.

If a client has already asked and you’d like to talk it through, book a 20-minute fit call.