How to Write an AI Policy for Your Agency

39% of workers say their employer has no strong opinion about AI use at all. Not a ban. Not encouragement. Nothing. Silence.

That silence is getting expensive. The EU AI Act's AI-literacy obligation has been in force since February 2025, most of the Act has applied since 2 August 2026, and procurement questionnaires have started asking agencies to describe their AI policy before they'll talk scope.

"We don't really have one" is quietly becoming a deal-losing answer.

The good news: an agency AI policy isn't a legal treatise. It's one page of decisions your agency has probably already made informally — written down so clients, staff and subcontractors can see them. Here's what goes in it.

The Policy Vacuum, in Numbers

Salesforce's Generative AI Snapshot — 14,000 workers across 14 countries, late 2023 — found the governance layer missing almost everywhere. 39% reported no employer opinion on AI. Nearly 70% had never been trained on safe, ethical use. And in healthcare, an industry swimming in confidential data, 87% said their company lacked clear policies.

Microsoft and LinkedIn's 2024 Work Trend Index — 31,000 people, 31 countries — adds the leadership side: 60% of leaders worry their organisation lacks a plan and vision for AI, and only a quarter of companies planned to offer any generative-AI training that year. The vacuum isn't a staffing problem. It's a governance problem — everyone is waiting for someone to write the rules.

Regulators noticed before employers did. In the EU, Article 4 of the AI Act requires providers and deployers of AI systems to take measures ensuring staff have "a sufficient level of AI literacy" — and that duty has applied since 2 February 2025. If your agency works with EU clients, that duty can reach you. In the UK, the ICO's guidance on AI and data protection makes the same point through the GDPR lens: putting personal data into an AI tool is processing, and "the tool did it" is not a defence.

Meanwhile, some organisations turned the policy into a public asset. The Guardian published its AI principles back in June 2023 — human oversight and control, senior-editor sign-off for significant AI elements, openness with readers — and has updated them since.

Note what that took: a working group spanning editorial, creative, engineering, product, legal and commercial — three months of cross-team work for one page of principles. That's the honest effort level. The writing is easy; the deciding is the work. But the payoff is real: a published policy isn't just compliance. It's a trust signal that competitors without one can't fake.

Three Conversations You Don't Want to Improvise

This is what the missing policy costs in practice.

And the direction is one-way — the EU's transparency obligations phase in through December 2026, so clients will ask these questions more often next quarter than this one.

The procurement questionnaire. "Describe your organisation's policy on generative AI use, including data handling and disclosure." Question 14 of 40. Agencies with a document paste it in and move on. Everyone else writes something aspirational at midnight and hopes.

The new subcontractor. Day one: "So which AI tools are we allowed to use?" Without a written answer, the real answer is "whatever you already use" — which is how client briefs end up in consumer-tier accounts.

The NDA with teeth. Client contracts increasingly include third-party processing clauses, and AI tools are third parties. If your policy doesn't define which tiers are approved for client data, you're one keen junior away from a technical breach — and "we didn't realise" is not a position you want in writing. The mechanics are in Is It Safe to Put Client Data in ChatGPT?.

The Seven Clauses

A workable agency AI policy has seven parts. It's shorter than you think — most clauses are two sentences.

Two things it isn't. It isn't a legal filing — no regulator needs a copy. And it isn't an NDA rewrite — your client contracts stay as they are; this document governs your team's behaviour, not theirs. Think of it as the answers to the seven questions your team is already asking, written down once instead of improvised weekly.

The test for every clause: could a new starter follow it on day one without asking anyone? If not, it's not a policy — it's a wish.

Approved tools and tiers. Name the tools and, crucially, the account tiers approved for client work. "ChatGPT Business or Enterprise accounts only; no client material in Free, Plus or Pro accounts" is a complete clause. The tier is the point — the training defaults differ. Name the tools, but write the rule in terms of tiers: products rebrand faster than your policy gets read.

Client data rules. What may and may not go into an AI tool. Current briefs, yes. Unreleased financials, no. Personal data, never. One sentence covers most of it: "No client confidential information enters any AI tool outside an approved business-tier account." (This is the clause Vythos exists to make easy — per-client workspaces where the approved material is what's already loaded.)

Disclosure and consent. When you tell clients AI is involved, and how. Some agencies disclose everything, some disclose on request, some write it into their standard terms. Pick one and write it down — the full thinking, plus a template, is in Should You Tell Clients You Use AI?.

Human review and accountability. Every AI-assisted deliverable has a named human who checked it and owns it. No "the AI drafted it" shrugs when something goes wrong. The Guardian's version: significant AI elements need explicit senior sign-off.

IP and copyright. Who owns AI-assisted output under your contracts, and how you handle the grey areas: training-data provenance, AI-generated imagery, client brand assets as inputs. If a client asks who owns AI-assisted output, the honest current answer is "it's jurisdictionally fuzzy" — which is exactly why your contract needs to say something explicit. Even "final IP transfers on payment, per our standard terms" closes most of the gaps.

Training and AI literacy. How people learn to use the approved tools safely — an onboarding walkthrough, a shared prompt library, a quarterly refresh. This clause now has legal teeth in the EU, but it earns its place anyway: untrained staff are where shadow AI comes from.

Review cadence. AI tooling changes quarterly; your policy should too. "Reviewed every six months by [name]" turns a dead document into a living one. Date the policy visibly — clients notice.

The Five-Sentence Version

If you do nothing else, steal this and adapt it:

"We use AI to assist drafting, research and analysis. Client work is produced only in approved business-tier accounts; no client confidential information enters consumer-tier tools. We disclose our AI involvement to clients on request. Every deliverable is reviewed and owned by a named human. This policy is reviewed every six months."

That's clauses 1, 2, 3 and 4 in one breath. Add the rest as you grow.

What "Solved" Looks Like

A policy that works does three jobs at once. It's a sales asset — paste it into procurement answers, attach it to pitches, publish the short version like The Guardian did. It's a staff shortcut — new joiners stop guessing, and subcontractors get one link instead of a lecture. And it's a shadow-AI drain — most shadow usage exists because there's no sanctioned route, and clause 1 creates one.

Budget the time honestly: for a small agency this is one working afternoon plus a team conversation — not three months. The Guardian needed a working group because it's a two-century-old newsroom with legal exposure. You need a page and a conversation.

The best agency policies fit on one page. If yours needs a lawyer to read it, it won't be read. And if you want the marketing upside, publish the short version — it costs nothing and reads like confidence.

The Honest Trade-Off

A policy nobody reads is worse than none at all. It creates the appearance of governance with none of the behaviour — and it will be quoted back at you the first time something goes wrong. Over-restrict, and you've built a shadow-AI generator: people route around rules that make the work slower.

If you're a solo freelancer, skip the document. You don't need a policy — you need the seven decisions. Write them in an email to yourself. That counts.

And whoever writes it: give the policy an owner, not a committee. A document with seven authors has no author — and clause 7's review date is the first thing a committee forgets.

The one thing: An AI policy isn't about restricting AI. It's about being able to defend your use of it — to a client, to a regulator, and to yourself at 11pm before a deadline.

How to Write an AI Policy for Your Agency