An AI usage policy template for agency teams

The policy

• Purpose: [why the agency uses AI, for which tasks, in one or two sentences].
• Approved tools: [the list of tools, with the plan and the named account owner for each].
• Data allowed: [what may go into a tool, and what never does, such as passwords, tokens and client personal data].
• Client accounts: [which AI tools may connect to a client account, and at which permission level].
• Human review: [which outputs need a named person's check before they reach a client or a live account].
• Disclosure: [when the team tells a client that AI helped produce the work].
• Logging: [where AI-assisted drafts and changes are recorded].
• Incidents: [who to tell, and within how long, when AI output or data goes wrong].
• Review date: [the owner of this policy and the date of the next review].

Everyday rules

• A tool that is not on the approved list is not used for client work.
• Read the policy once a quarter, and after any change to the tools in use.