What Clients Now Ask Agencies About AI Security
The AI security questionnaire is the new gate on the client side, and it is not being written by marketing. It comes from information security, procurement or legal, and it arrives with the assumption that the agency already has answers.
Most creative agencies do not, because the questions are about infrastructure rather than about work, and nobody in the building has been responsible for that answer before.
The AI Security Questions Being Asked
Which tools are used on this account, and under what account ownership. Whether client material is used to train anything. Where data is stored and for how long. Whether subcontractors and freelancers use the same tools. And who inside the agency approves a new one.
None of these are unreasonable. All of them assume a level of central control that the last two years of adoption quietly removed.
Why This Is A Commercial Issue, Not An Admin One
Because an unanswerable questionnaire delays onboarding, and a delayed onboarding costs a quarter of fee. Larger advertisers increasingly run this check before a contract is signed, which turns a paperwork gap into a lost pitch.
It also travels. A regulated client in banking or pharmaceuticals will impose terms that then apply across the agency's systems, which means one account's security posture becomes everybody's.
The pitch was won on the work and held up by a spreadsheet from a department nobody in the room had met.
What To Have Ready Before It Arrives
A current tool register. A one-page statement of what the agency does and does not put into third-party services. Named approval for new tools. A freelancer clause that carries the same rules outward. And a retention answer, which is the question that catches most agencies out.
Preparing it once costs a week. Answering it badly costs the onboarding, and the second attempt is always slower than the first.
Related: transparency about AI use.
More in The AI Shift.