AI Policy Template for a Marketing Agency (10-Person Version)

Most small agencies I talk to already use AI every day. What they lack is one page that says which tools are fine, what never goes in, and who checks the work before a client sees it. This post gives you that page: an AI policy template a marketing agency of about 10 people can copy, edit in an afternoon, and hand to the team.

One note first. I run marketing and build AI systems for a living. I am not a lawyer, and this is not legal advice. Use the template as a starting draft and have your own lawyer review it, especially the parts about client contracts and IP.

Why a small agency needs an AI policy now

Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work, which Microsoft says puts company data at risk. In a 10-person agency, that tends to look like this: a strategist on a personal ChatGPT account, a designer trying three image tools on free trials, and a copywriter pasting a client brief into whatever tab is open. Nobody is careless on purpose. There is no rule, so everyone makes their own.

A short policy fixes three things:

• Client data goes only into tools where you know how it is handled.
• Everyone works from the same setup, so quality stays consistent.
• You can answer honestly when a client asks whether you use AI on their account.

Keep it short. A 10-person team will read two pages. They will not read twenty.

What goes in an AI policy template for a marketing agency

Five parts cover almost everything a small team needs:

1. Approved tools, and how accounts are set up.
2. The never-paste list.
3. Client contract checks.
4. Review rules before anything ships.
5. Ownership: who maintains the policy and how people ask questions or report mistakes.

Before you write part one, find out what people use today. Ask in a team meeting with no blame attached, or send a three-question survey. The AI workflow audit guide shows how to run that inventory alongside a review of your recurring workflows, which is where unapproved tools tend to show up.

Approved tools: business plans, not personal accounts

The most useful rule in the whole policy: client work happens in business plans the agency owns, not in personal accounts.

Here is why. OpenAI says it does not train its models on data from ChatGPT Business, Enterprise, Edu or the API by default, unless the customer opts in to share it. The same page says that if a business opts in, for example through feedback tools, that shared data may be used for training. So your policy should tell staff not to opt in to feedback sharing.

Personal ChatGPT plans work differently. OpenAI says conversations on personal plans can be used for training unless the user opts out through the privacy portal or Data Controls. Temporary Chat conversations are never used for training.

Claude has a similar split. Anthropic's update to its consumer terms lets users of Claude Free, Pro and Max, including Claude Code used from those accounts, choose whether their chats are used to improve Claude. The update does not apply to services under Anthropic's Commercial Terms, such as Claude for Work and the API. Existing users had until October 8, 2025 to make their choice, and the setting can be changed at any time in Privacy Settings. A setting each person controls on their own account is not something you can rely on for client data.

Here is a starting table you can paste into your policy:

Pick one main assistant if you can. Two is fine. Five means five sets of settings to check and five places client data might live. Once you choose, load the approved tool with your brand voice, examples and rules so everyone starts from the same place. This guide to brand voice in ChatGPT Business and Claude Projects walks through that setup.

The never-paste list

Even approved tools get a never-paste list. Business-plan terms lower the risk. They do not make every kind of data appropriate to share. In my experience, this list covers what a small agency handles:

• Passwords, API keys, login links and two-factor codes.
• Payment card numbers, bank details, Social Security numbers and tax IDs.
• Customer personal data from a client's CRM or email list, such as names with emails, phone numbers, addresses or purchase history, unless the client has agreed in writing.
• Health, financial or other sensitive details about any person.
• Anything a client contract marks confidential and restricts from third-party software.
• Unreleased financials, legal disputes, deals in progress and HR matters about staff.
• Any material from a client who has said no to AI.

A rule of thumb the team will remember: if you would not paste it into an email to a contractor you met last week, do not paste it into AI. When a task does not need real names, swap them for placeholders like Client A or Customer 1.

Client contract checks

Contracts are where small agencies get surprised. Some newer client agreements include AI clauses. Older ones have confidentiality and IP terms written before anyone thought about AI, and those terms still apply.

IP deserves a closer look. On January 29, 2025, the US Copyright Office released Part 2 of its AI report, covering whether generative AI outputs can be copyrighted. It says using AI to help create a work, or including AI-generated material in a larger human-made work, does not stop the work from being protected. The Register also said that protecting material whose expressive elements are decided by a machine would undermine copyright's goals. If your contract assigns all IP in the deliverables to the client, a deliverable that is mostly unedited AI output may carry less than the client expects. Ask your lawyer how that affects your wording.

Run this checklist once per client and save the answers:

1. Does the contract mention AI, machine learning or automated tools? What does it allow or forbid?
2. Do the confidentiality terms limit sharing client information with third-party software or subprocessors?
3. Do you warrant that deliverables are original, or that you own everything you assign?
4. Do you assign all IP in the work to the client?
5. Does the client require you to disclose AI use, or ask permission first?
6. Is there a data processing agreement that lists approved vendors?
7. Record the result in a client register: Allowed, Allowed with limits, or Not allowed, plus any notes.

Have your lawyer review your standard contract wording on AI and IP once, then reuse it for new clients. If you produce ads, platform rules on labeling AI content can change, so check the current rules for each platform with your lawyer before you write a disclosure clause.

Review rules before anything ships

The Copyright Office position above and plain quality control point the same way: a person shapes and checks the final work. My review rules for small teams:

1. A named person edits everything that ships. Not a skim. An edit.
2. Every fact, number, name, quote, price and link gets checked against a source.
3. The work matches the brand voice and the client's rules.
4. No AI output goes to a client or publishes on its own, including drafts made by automations. Build a review step into the flow.
5. AI use is noted in the project file, so you can answer client questions later.
6. For images and video, confirm the tool's terms allow commercial use, and do not create a real person's likeness without permission.
7. When in doubt, ask the policy owner before sending.

Rule four matters more as you automate. Automations run quietly, and a broken one can skip the review step without anyone noticing. If you are deciding what to automate, this post on what to automate first covers where review steps belong.

The copy-ready template

Copy this into a doc, fill in the brackets and cut what does not fit.

[Agency name] AI Use Policy

Effective date: [date]. Policy owner: [name]. Reviewed every [6] months.

1. Purpose. We use AI to save time on drafts, research and operations. We stay responsible for everything we deliver.

2. Approved tools.

• [ChatGPT Business and/or Claude plan under Commercial Terms], agency workspace only.
• API access inside [Make, Zapier or n8n] for automations the policy owner has approved.
• Do not opt in to feedback or data sharing in agency workspaces.
• Personal AI accounts are not used for client work or company data.
• Any other AI tool, extension or app: ask [policy owner] first.

3. Never paste. Passwords and keys. Payment, bank and ID numbers. Customer personal data without written client approval. Sensitive personal details. Confidential client material restricted by contract. Internal financial, legal or HR matters. Anything from clients marked Not allowed in the client register.

4. Client rules. Check the client register before using AI on an account. Follow any limits listed. If a client is not in the register, ask [policy owner].

5. Review. A named person edits and fact-checks all work before it reaches a client or goes live. No automation sends or publishes without a review step. Note AI use in the project file.

6. Accounts and access. All AI and automation accounts are created in the agency's name with [policy owner] as admin. Access is removed the day someone leaves.

7. Mistakes and questions. If you paste something you should not have, tell [policy owner] the same day. Reporting a mistake is never punished. Questions go to [channel].

Acknowledgment: I have read and will follow this policy. Name, date.

Doing it yourself versus getting help

Most 10-person agencies can do this themselves in about a week: one afternoon to inventory tools, one afternoon to fill in the template, a lawyer review of the contract and IP parts, and a 30-minute walkthrough with the team. The hard part is follow-through: approved tools set up properly, settings checked, automations with real review steps, and a policy that matches how people work.

If you want a second pair of hands, that is what Keeplight does. The AI Workflow Audit (from $1,500) includes owner and team interviews and a report with the top automations to build, what to leave alone and tool cleanup. You can see the format in the sample report. Brand Brain Setup configures your approved tool with your voice, examples and rules so the whole team gets the same quality. If talking it through would help, book a free 20-minute intro call. Either way, start with the template above. A short policy your team follows beats a long one nobody reads.

Frequently asked questions

Bryce Walls, Founder, Keeplight

Bryce runs marketing for a global consumer brand and builds the AI systems he uses every day. He has run paid media, analysis and marketing ops in-house for more than seven years, and Keeplight sets up the same kind of AI and automation for small marketing teams.

More from Bryce · LinkedIn · bryce@keeplight.ai