A marketing agency's AI policy has to protect something a normal company's policy doesn't: your clients' data. In this blog, you can find a template that you can copy, edit and send today.
When a copywriter pastes a client's audience segment into ChatGPT to sharpen the campaign copy, they aren't exposing company data. They're exposing the client's, and it's usually covered by your NDA.
That's why a generic AI policy falls short for agencies. It talks about "company data", and the data your team is most likely to leak isn't yours.
So the question isn't whether your team uses AI on client work. It's whether you can show a client how you control it.
If a client's security questionnaire asks that, this is what you would send. Let's start with why a generic template doesn't cover it.
Why a generic AI policy isn't enough for agencies
Generic templates cover company data. Agency work adds a layer they ignore.
Client PII, audience segments, unreleased creative briefs, product roadmaps and NDA-covered pricing all pass through your team's hands. Your contracts probably require you to protect each of them, so your policy should name each of them.
The agency AI policy: six sections to copy and customize
The six sections below follow the same structure as our guide to what an AI acceptable use policy should include, with the agency-specific rules filled in. Start with a short scope line, then work through the sections.
Scope. This policy applies to all use of AI tools by [Agency Name] employees, contractors and freelancers in connection with agency work, including work done on behalf of clients. It covers AI tools used to generate content, analyze data, create or adapt creative assets, draft communications, or produce anything else delivered to clients.
Leave out personal AI use outside of work, and AI features built into client-owned platforms. Those fall under the client's own policies.
Section 1: Approved tools
An approved tools list is the difference between a policy and a suggestion. Name the tool and the plan.
| Tool | Approved for | Not approved for |
|---|---|---|
| ChatGPT Business or Enterprise | Content drafting, internal research, ideation | Client PII, any data under NDA |
| Claude Team or Enterprise | Long-form drafting, structured analysis | Client PII, any data under NDA |
| Gemini in Google Workspace | Internal drafts, research | Client PII without a signed data processing agreement |
| Image generation tools (business plan) | Concept mockups, internal mood boards | Client brand assets, unreleased creative |
Approved tools. Staff may use only the tools on the Approved Tools list, on the company account. A personal account of an approved tool isn't an approved tool. New tools need written approval from [Policy Owner] before first use.
Section 2: Client data rules
This is the section every generic template skips. It's the most important one for agencies, because it covers data classification and what's off-limits in one place.
Client data. Never paste the following into AI tools without written approval from the relevant client: contact lists or CRM exports, customer PII (names, emails, addresses, demographic data), proprietary audience segments, unreleased creative or campaign briefs, product roadmaps, pricing information, and any data covered by a client NDA.
Use placeholders. For drafting, research and ideation, use placeholder data. Write "Client A" instead of the client's name. Replace real audience statistics with invented figures. Swap live email lists for fictional examples.
When a client approves. If a client approves AI use on their data, document the approval in writing, name the approved tool, and confirm that tool is on the Approved Tools list.
Section 3: Human review before client delivery
Every AI-assisted output going to a client gets a human review before it leaves the agency.
Review. A named reviewer checks AI-assisted work for factual accuracy, brand voice, fit with the brief, and invented details such as statistics, names and product specs. The reviewer records that the review happened.
Here's a practical test. If you wouldn't want the client to see the prompt that produced the output, the output isn't ready to send.
Section 4: Incident reporting
Incidents. If client data enters an unapproved tool, tell [Policy Owner] within 24 hours. Reporting a good-faith mistake within 24 hours won't lead to disciplinary action. The agency will contact the affected client once it has confirmed what happened.
Check your master services agreement before you decide not to tell a client. If client PII was involved, you probably have a contractual duty to notify them.
The proactive call is always better than the client finding out on their own.
Section 5: Enforcement
Enforcement. The agency uses technical controls where possible to stop client data reaching unapproved tools. Repeated or deliberate breaches are handled through the agency's disciplinary process.
This is the section most agency policies skip. Without it, you have a document and no way to make it hold. More on that below.
Section 6: Review and ownership
Ownership. [Policy Owner] is responsible for this policy. It's reviewed at least once a year and whenever a new AI tool is added.
One owner, not a committee.
Prevent accidental data leaks to ChatGPT, Claude, and Gemini.
Sequirly scans your prompts and uploaded files before they're sent. If it finds credentials, client records, or API keys, it stops you before the request goes out.
What enterprise clients will ask you
When a client asks for your AI governance documentation, these are the five questions they want answered.
That last question is where most agencies stall. You can write a clear policy. You can't guarantee that someone reads it before pasting a client brief into ChatGPT at midnight before a pitch.
For more on that gap, see AI Security for Marketing Teams.
Where to start
This week: Write Sections 1 and 2. They cover the highest-risk situations for agencies and take under two hours.
Next week: Build the Approved Tools list. Audit which AI tools your team actually uses, not the ones you think they use. Scan an exported chat history if you want a quick look.
Month one: Add Sections 3 to 6, then run a 30-minute session to walk the team through the policy. Write down who attended.
If a client asks before you're ready: Say "we're finalizing it and can share it by [specific date]". Don't give a verbal summary. Get it in writing.
Beyond the written policy
A written policy sets the standard. It doesn't enforce itself.
For an agency running several client accounts at once, one data incident can hit a client relationship, a contract renewal and a referral pipeline at the same time.
Sequirly sits between your team and AI tools and checks what's about to be sent. It catches client PII, audience data and confidential briefs at the moment of the paste, before they reach any model. Your team keeps working. The admin sees which category of data was flagged and which tool was involved, never the content of the prompt.
If you want rules built around how your agency works, the Sequirly team will sit down with you, understand your clients' requirements and build the setup around your workflow.
Sequirly has limits too. It doesn't replace a written policy, and it only covers AI tools used in the browser.
You can start with just the policy. Sequirly's free AI policy generator builds a draft from your team's setup, and you can choose "Marketing / Advertising Agency" as your industry. No account is needed for the quick-start policy.
Common Questions
What should an AI policy for a marketing agency include?
An agency AI policy should include approved tools and plans, client data rules, human review before delivery, incident reporting, enforcement, and a named owner. The client data rules are the part generic templates miss.
Can agencies put client data into ChatGPT?
Only with the client's written approval, and only in a tool on your approved list. Without approval, use placeholder data instead of the client's real names, audiences and figures.
Do I need a client's permission to use AI on their work?
Check your contract and any security questionnaire the client has sent. Many agreements restrict sharing client data with third parties, and an AI provider is a third party. This isn't legal advice, so ask a lawyer if your contract is unclear.
How do I tell a client how my agency uses AI?
Send them your written AI policy, your approved tools list, and the section that covers their data. A dated document answers the question better than a verbal summary.
Next step
Start with the draft. Generate your agency's AI policy, edit it, and share it with your team this week.
Then try Sequirly free so the policy has something checking it at the moment of the paste.