A written policy is a statement of intent. What actually holds up, to a client, an auditor, or the EU AI Act, is being able to prove you followed it on a specific deliverable.
Most agencies now use AI somewhere in client delivery: drafting copy, generating first-pass code, summarizing research, building creative variants. Most of those same agencies have no written policy about it, and the ones that do usually have a policy that would not survive a client actually asking "prove it."
That gap is about to matter more than it used to.
A one-page "we sometimes use AI tools, responsibly" document feels like it covers you. It doesn't, for two reasons.
First, a policy is a statement of intent, not a record of behavior. If a client, auditor, or regulator asks whether a specific deliverable used AI, what model, on what date, reviewed by whom, a policy document tells you nothing about that specific deliverable. It describes what you meant to do, not what you did.
Second, transparency obligations under the EU AI Act are increasingly about disclosure to the people affected by AI-assisted output, not just internal governance. If your agency serves EU clients, or the deliverables reach EU end users, the direction of travel is toward telling the people on the receiving end when they're interacting with, or receiving output shaped by, an AI system. A binder in a shared drive that nobody reads doesn't satisfy that. What satisfies it is being able to show, per engagement, what was disclosed, when, and to whom.
Agencies get this backwards constantly: they write the policy once, file it, and treat the compliance work as done. The actual exposure isn't "we don't have a policy." It's "we have a policy and can't demonstrate we followed it," which is arguably worse, because it looks like the gap was known and ignored.
If you're writing or rewriting yours, these are the sections that hold up under scrutiny, not just the sections that read well:
Items 1 through 3 are what most agency AI policies already have. Items 4 and 5 are what separate a policy you can point to from a policy you can prove.
Here's the part that actually gets tested: a client, a platform, or a regulator asks for evidence, not assurance. "Do you have an AI policy?" is a yes/no question anyone can answer yes to. "Show me the disclosure record for the March campaign" is a different question entirely, and it's the one that's becoming more common as AI use in agency work stops being novel and starts being assumed.
If your record-keeping is a Slack thread or someone's memory, you don't have proof, you have a story. The fix isn't more process for its own sake, it's making the disclosure and the record the same artifact, generated at the point of use instead of reconstructed after the fact.
We built a free tool for exactly the first step of this: a client-side AI disclosure policy generator that produces the written policy in about a minute, scoped to how your agency actually uses AI, no signup, nothing sent to a server. It's not a substitute for the record-keeping layer above, but it gets you a real policy instead of a template you copy-pasted from somewhere else, and it's the artifact everything else in this post builds on.
Answer a few questions about how your agency uses AI in client work, get a written disclosure policy in under a minute. No signup, runs entirely in your browser.
Writing the policy is an afternoon of work. Being able to prove you followed it is the part worth building toward next.