AI use policy for a marketing agency

A marketing agency's staff use AI tools to generate copy, images, video and strategy, to analyse audiences and to run campaigns, and the agency's clients are paying for work they expect to own, to be original and to be true. The policy has to say what the agency generates and what it does not, who owns an output nobody wrote, how the agency checks that generated content does not infringe, mislead or breach the advertising rules, what client data goes into which tools, and what the agency tells clients; and the client agreement has to say the same. The AI use policy and the contract provisions that go with it are drafted for the business for a fixed £995 and delivery in five working days.

Who this is for

Marketing, advertising, content, social media, PR and creative agencies in England and Wales whose teams use generative and analytical AI tools on client work.

What matters in a marketing agency's AI use policy

Generated content, clients and the question of who owns it

A client agreement that assigns the agency's intellectual property in the deliverables to the client assumes the agency owns something to assign, and a work generated by an AI tool with no human author has an uncertain owner under the Copyright, Designs and Patents Act 1988 (section 9(3) treats the person who made the arrangements as the author of a computer-generated work, a provision untested on modern tools), while the tool's terms may grant the agency rights in outputs or reserve them; the policy requires substantial human authorship in deliverables the client needs to own (the generated draft as a starting point, the agency's creative work on top, recorded), tells staff which tools' terms grant output rights the agency can pass on, and the contract provisions tell the client what the agency can and cannot warrant about ownership of generated elements.

Copyright in outputs and the material the models were trained on

Generated images, text and music may reproduce protected works from the training data, may imitate a living artist's style in ways that invite a claim, and may include a trade mark or a real person's likeness, and the agency, not the tool provider, is the one that publishes the result for a client; the policy requires generated content to be checked for recognisable reproduction before use, prohibits prompts that name living artists, brands or real people as the style to copy, requires licensed stock or the agency's own assets for anything the client will use prominently, and records the prompts and the tool for each deliverable; the contract provisions limit the agency's infringement indemnity for generated elements to what it has checked and disclosed, because an unlimited indemnity for an output the agency cannot trace is a liability the agency cannot price.

Brand, accuracy and the claims the regulator polices

Advertising copy must be legal, decent, honest and truthful under the advertising codes the Advertising Standards Authority enforces, product claims must be substantiated, comparative claims must comply with the Business Protection from Misleading Marketing Regulations 2008, and consumer-facing content must not mislead under the Digital Markets, Competition and Consumers Act 2024; the policy requires every factual claim, statistic, testimonial and comparison in generated content to be verified against the client's substantiation before it is published, prohibits generated testimonials and reviews (which the 2024 Act treats as fake), and requires the agency's usual approval process to apply to generated work without exception, because the tool does not know what the client can prove.

Clients' data, audiences and the tools that profile

under the UK GDPR, personal data in an AI prompt is personal data being processed, so the business needs a lawful basis, a notice, an Article 28 data processing agreement with the provider and, where the use affects individuals, an Article 35 impact assessment; an agency processing a client's customer data in an AI tool is a processor under the client's data processing agreement, which may not permit the tool at all, and the policy requires the agency to check the client's DPA before any client data goes into a tool, to use only tools under the agency's own sub-processor arrangements, to keep clients' data out of consumer tools entirely, and to treat audience profiling and lookalike modelling as processing the client must have a basis and a notice for; trade secrets, confidential information and clients' data stay out of any tool whose provider may train on or retain the input, a line the Trade Secrets (Enforcement, etc.) Regulations 2018 (which protect only secrets kept by reasonable steps) and the business's confidentiality obligations both require.

Disclosure to clients and the deliverable that was generated

Clients increasingly ask whether work was generated, some prohibit it in their agreements, and some require it to be disclosed and priced differently, and the policy sets the agency's position: generated content is disclosed where the client agreement requires it, where the client asks, where a deliverable is substantially generated, and where the content will carry a legal or regulatory label (some platforms and some jurisdictions require generated media to be marked); the agency does not present generated work as hand-made, keeps a record of the tools and prompts behind each deliverable, and tells clients which tools it uses as a standing disclosure in the client agreement, so that the conversation happens at the start of the engagement rather than when a client finds the stock image was generated.

The contract provisions that put the policy into the client agreement

The provisions drafted with the policy go into the agency's client agreement (the agency's permitted use of AI tools, the disclosure it gives, the ownership and warranty position for generated elements, the client's own obligations on data it supplies, the indemnity limited to checked content), its freelancer terms (the same rules flowed down, since freelancers are the commonest source of undisclosed generated work), and its employment contracts and handbook.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can we assign copyright in AI-generated content to clients?

Only where there is something to assign: a work with substantial human authorship, or output rights the tool's terms grant and the agency can pass on. The policy requires human authorship for deliverables clients must own, and the contract provisions set what the agency warrants.

Do we have to tell clients when content was generated?

Where the agreement requires it, the client asks, a deliverable is substantially generated, or a label is legally required. The policy makes the tools the agency uses a standing disclosure in the client agreement so that the conversation happens at the start.

Can we put a client's customer data into an AI tool to build audiences?

Only if the client's data processing agreement permits the tool, the tool is under the agency's sub-processor arrangements, and the client has a basis and a notice for the profiling. Consumer tools are out. The policy requires the DPA check before any client data goes in.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Data processing agreement for a marketing agency
• AI use policy for a design agency

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.