Meta AdsName the approved tools
- List each AI tool staff may use and the work it is approved for, such as internal drafts only or work on connected accounts.
- Say which tools may never see client data. A tool that is not on the list is not approved, even if it is useful.
- Review the list each quarter, and whenever a tool changes its data terms.
Set the data rules
- Write what may go into a prompt: public material, the agency's own templates and anonymised examples.
- Write what may not go in: customer lists, personal data, account access details, unpublished revenue and contract terms.
- Keep keys and tokens in the agency's password manager or secret store, never in a prompt, a document or a chat.
Made-up scenario: a strategist pastes a customer export into a chat tool to find the best segments. The policy says customer data stays in approved tools. The strategist reruns the analysis on a column of anonymised segment codes instead.
Set the review rules
- Every AI draft that reaches a client has a named human reviewer, who signs off the final text or change.
- Reviewers check facts, numbers, claims, and anything that names a competitor or a person.
- An AI-assisted change to a live account follows the same approval and read-back steps as a human change.
Log and train
- Log each AI-assisted change with the tool, the prompt standard used, the reviewer and the time.
- Train new staff on the policy in their first week, and check that they can name the approved tools and the data rules.
- Write down each incident, such as data sent to the wrong tool, and review the policy after it.
