The Agency AI Policy Nobody Reads
Most agencies of any size now have an AI policy. It was written with care, often with lawyers, approved by leadership and sent round in an email with a PDF attached. Ask a junior copywriter or a media executive what it says, and the honest answer is usually a shrug.
The rules people actually follow are set at deadline, by whichever tool gets the job done fastest.
Why the AI policy goes unread
It is written for the wrong reader. Policies drafted to reassure clients and protect the agency tend to be long, general and cautious, full of principles about responsible use. Staff need something else: a quick answer to whether they can paste this brief into that tool, right now, for this client.
It also ages fast. Tools change monthly, and a list of approved software from the start of the year can be out of date by the festive season. Once people notice the policy is behind, they stop consulting it at all.
A policy nobody can apply at eleven at night is not a policy. It is a disclaimer.
Where the real risks sit
Client confidentiality, first. Unreleased product details, pitch briefs, sales numbers and media budgets are routinely pasted into tools whose terms the user has never read. Some client contracts now say precisely what may and may not be done with their material, and the people doing the work rarely see those clauses.
Personal data, second. Customer lists, survey responses and lead data are covered by the Digital Personal Data Protection Act, 2023, and handing them to an outside tool without thought is exactly the kind of processing the law expects a business to control.
Delivered work, third. If generated images, voices or copy sit inside an ad, the client should know, and the agency should be able to say which parts and from which tool. Most agencies could not answer that today for work they shipped last month.
Making it a working rule
Shorten it to a page that answers practical questions: approved tools by task, what data never goes into any tool, and who to ask when unsure. Keep a simple sheet, per client, of what each one allows, and put it where account teams already look.
Build the checks into the workflow rather than the handbook. A field on the job sheet asking whether generated material was used, and where, will do more than a training session. Review the rules each quarter, and say so when they change.
The aim is not to slow people down. As we noted when the bottleneck moves to legal review, the cost of an unclear rule tends to arrive later, at the worst possible stage. A policy people can actually use is cheaper than one they admire and ignore.
More from The AI Shift.