AI content policy for agencies: what to tell your clients

A client emails: do you use AI for our content? You have an answer in your head and nothing in writing. That gap is the problem, because the answer you give on a call is not the answer your account team gives next month.

This is the AI content policy for agencies that answers that email: eight sections, wording to adapt for each, and three decisions to make before you send it. We are a content provider and we publish our own AI disclosure, so this is a position we hold ourselves.

Short answer: what an agency AI content policy has to do

Three jobs. Tell the client what you do to their work. Tell them what they may need to tell their readers. Name who is accountable when something is wrong.

The document most guides describe is a different one. An internal AI acceptable-use policy covers which tools staff may use, what data may go into them, and what training is required. An agency usually needs both; this is the client-facing one.

One definition matters. Under the EU AI Act the "deployer" is whoever uses an AI system under its authority, excluding personal non-professional use [1]. Employees acting on a company's instructions are not separate deployers, and the company stays a deployer even when contractors operate the system for it [2]. An agency and its client can both be in scope for the same article.

Two audiences, not one

Most disclosure letters answer one audience and satisfy neither.

What your client needs to know

The client is buying a deliverable and putting their name on it. They need to know what changed about how it was made, and who to hold responsible if it is wrong. The test: could they explain your process to their board without you in the room?

What your client's readers may need to know

The reader has a different question. Google's guidance on generative AI content suggests telling readers how a piece was made where it makes sense for the audience [3]. Under the AI Act the information goes to the "natural persons concerned", at the latest at first interaction or exposure [4]. The reader is who that duty protects, not the client. Whether you have to disclose a provider or AI covers the provider half.

Where your provider sits in the chain

The chain is provider → agency → client → reader, and each handover needs its own statement. What you can promise your client is capped by what your provider will evidence. If your provider will not say which steps involve AI, you cannot say either. That is our argument, not a legal rule; the Act does not spell out a provider-to-agency duty. The questions to ask a provider about AI use and disclosure is the list to put to yours first.

The policy, section by section

Eight sections. Each says what it must contain, gives a line to adapt, and names the failure it prevents.

1. Scope: which work this covers

Say which services, which clients and which dates. A policy covering "content" without saying whether that includes the newsletter or the paid landing pages will be read as covering everything.

This policy covers articles, landing page copy and email written for [client] from [date]. It does not cover [x].

Failure it prevents: a client assuming a scope you never agreed.

2. What we use AI for, and what we do not

Be specific about steps, not intentions. "We use AI responsibly" tells a client nothing and reads as evasion.

We use AI to research the query, structure the outline and draft. A person sets the angle, edits the draft and signs it off. We do not use AI to invent quotes, statistics or customer stories.

A draft written from a person's outline and edited by a person is AI-assisted; a draft produced from a prompt with a read-through is AI-generated, and clients treat them differently.

Failure it prevents: the client filling the gap with the worst version they can imagine.

3. Who reviews the work, and what they check

Name a role and a checklist. An adjective is not a control.

Every draft is reviewed by [role] against [named checklist] before it reaches you. The review covers [three to five specific things].

Failure it prevents: "human-reviewed" with nobody's name on it.

4. What evidence we can show a client on request

List artefacts, not assurances. Ours are the brief, the source behind every citation [5], the editor score with a note per criterion [6], and the originality and AI-pattern checks [7]. Yours may differ; what matters is that each item exists as a file.

On request we will send the brief, the source list, the review notes and the approval record for any article.

Failure it prevents: a claim you cannot evidence in month nine.

5. What we tell your readers, and when

Two options and a rule for choosing. A footer line sits at the end of the article and covers the whole site. An author note sits near the byline and covers one piece. Use the footer line when the practice is uniform across your client's site; use the author note when one article was made differently. We ask at onboarding whether the customer wants a disclosure line and how it should appear [8], because it is their call.

This article was written with AI assistance and reviewed by [name, role] before publication.

Failure it prevents: a disclosure that appears on some articles and not others with no stated reason.

6. Client instructions we will follow

Record what a client has told you to do differently, and where it is stored. A verbal instruction is not an instruction.

Where a client has restricted AI use, the restriction is recorded in the statement of work and repeated in the brief for every article.

Failure it prevents: the instruction living in one account manager's memory.

7. Who is accountable, and how to raise a problem

One named role, one route, one response time you will actually meet.

Questions and complaints go to [role] at [address]. We acknowledge within [x] and answer within [y].

Failure it prevents: a client escalating to whoever answers the phone.

8. Review date and change log

The section almost everyone omits, and the one that makes the rest credible. A policy with no review date is a claim about the past.

This policy was last reviewed on [date]. The next review is [date]. Changes are listed below.

Failure it prevents: a 2026 policy still going out in 2028.

Copy and fill in:

1. Scope: which work this covers
2. What we use AI for, and what we do not
3. Who reviews the work, and what they check
4. What evidence we can show a client on request
5. What we tell your readers, and when
6. Client instructions we will follow
7. Who is accountable, and how to raise a problem
8. Review date and change log

What the rules actually require, and what they do not

None of this is legal advice. An agency working across several jurisdictions should have its own counsel read the policy before it goes out.

Google: advised, not required

Both Google pages say "consider", not "must". Google says AI or automation disclosures are useful where a reader might wonder how the content was created, and suggests adding them where they would be reasonably expected [9], from a page dated 2026-10-05; the page dated 2026-10-01 says the same in different words [3]. Neither makes disclosure a ranking requirement. The one hard line Google draws is about purpose: automation used "for the primary purpose of manipulating search rankings" is a spam-policy violation [10]. What Google's guidelines actually say about AI-written articles has the full reading.

Regulation: where disclosure is required, and where it is not

Regulation (EU) 2024/1689 applies in stages; the Article 50 transparency duties apply from 2 August 2026 [11]. The text duty is the second subparagraph of Article 50(4): "Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated" [4]. The same subparagraph exempts text that "has undergone a process of human review or editorial control" where "a natural or legal person holds editorial responsibility" [12]. The duty turns on purpose and subject matter, not on AI use, and the exemption is the part an agency should be able to evidence.

The purpose test is genuinely ambiguous for B2B marketing articles. The Commission's examples run from politics and public administration through public health and consumer safety, and end in a catch-all for any economic, financial, political, scientific or cultural development that could be a matter of public debate [13]. That catch-all is broad enough that an article about a regulated industry could arguably fall inside it, and an agency could reasonably read the whole provision as never touching its work. The text does not settle either reading.

Instrument	Who it binds	What triggers the duty	Applies from	Source
Regulation (EU) 2024/1689, Art. 50(4)	Deployers	AI text published to inform the public on matters of public interest, unless human review or editorial control	2 August 2026	[4] [12] [11]
Regulation (EU) 2024/1689, Art. 50(2)	Providers	Machine-readable marking of synthetic audio, image, video or text output	2 August 2026 (2 December 2026 for systems already on the market)	[4] [14]
Google Search guidance	Nobody — advisory	Nothing. Disclosure is "consider"ed where a reader would reasonably expect it	n/a	[3] [9]
16 CFR 255.5 (FTC Endorsement Guides)	Advertisers and endorsers	A material connection between endorser and seller that the audience would not reasonably expect	In force; Guides revised 2023	[15] [16]
Pennsylvania Act 99 of 2026, s.4	Advertisers	An advertisement using synthetic content (including text) that gives consumers a false impression of the goods' nature, origin or authenticity	Enacted 22 October 2026; effective date NOT verified	[17] [18]
New York synthetic performer law	Persons who produce or create an advertisement	An advertisement including an AI-generated synthetic performer	In effect (announced 9 June 2026)	[19]
California SB 1050	Advertisers	A video or audio ad using AI-generated performers to sell a product or service	Signed 16 September 2026; commencement NOT verified	[20]

Pennsylvania's Act 99 is the closest thing we found to a text-in-advertising duty, but its test is deception-based: an advertisement using synthetic content in a way that gives consumers a false impression of the goods' nature, origin or authenticity [17], and synthetic content includes text [18]. It is not a blanket AI label, and we could not verify its effective date. The New York and California laws we found cover synthetic performers in ads, not text [19] [20].

What we could not find

We looked for an FTC document requiring disclosure of AI use in marketing or advertising content and found none in the documents we could read. Two FTC pages would not load, so that is a claim about what we could read, not about what exists. What the FTC does require is disclosure of a material connection between an endorser and a seller that the audience would not reasonably expect [15] — a paid-relationship rule, not an AI rule. The Endorsement Guides "themselves don't have the force of law", though practices inconsistent with them may lead to Section 5 enforcement [16].

We also found no official source in any jurisdiction requiring disclosure of AI use in B2B marketing content as such.

When a client says no AI

Three options, and each one costs something.

Decline the work. Cleanest, and the only one that costs you nothing later. Say so in the reply, not three weeks into the engagement.

Deliver without AI and accept the change in turnaround and price. If the work takes longer, the quote has to say so. A no-AI promise at an AI price is a loss you agreed to in advance.

Scope AI to steps that never touch the deliverable. Research, outlining and query analysis can involve AI while the draft is written by a person. This is the option most agencies want and the one that needs the most precise wording, because "we don't use AI" and "we don't use AI on the draft" are different promises.

Whichever you choose, put it in the contract line and repeat it in the brief for every article. The one thing not to do is agree to "no AI" on a call and change nothing about the process.

Prove the oversight claim, or drop it

"Human-reviewed" is an adjective until an artefact sits behind it. The Commission's FAQ says formal or procedural checks — spell-checking, grammar correction — do not count as human review or editorial control [21]. A spell-check is not editorial control, and neither is a read-through by someone who cannot reject the piece.

So show the difference between the claim and the evidence. Who reviewed it, by name or role. What they checked it against. What the result was. What happens to a draft that fails. The six checks we run before publishing is our method; it ends in a score against a public rubric of 20 criteria, 16 scored 0–5 and weighted, four pass/fail [22]. A draft passes at 80 or more with no hard check failed and at least 3 on Accuracy, Sourcing and Intent match [23]. The weights total 102 rather than 100, which is why we say "normalised" and why the exact formula is not published [24]. Read the rubric every article must pass.

If you cannot produce the evidence, drop the claim rather than keep it. That is the rule we apply to a claim we cannot trace: it gets cut, not softened [5].

Rolling it out without a client-by-client rewrite

One master policy, plus a per-client annex. The master holds the eight sections above. The annex holds what changes by client: sector rules, any no-AI instruction, the named approver, and the disclosure wording they chose.

Put it where clients already look: the proposal, the statement of work, the onboarding pack, and the delivery email that carries the first article. One owner for updates, and the review date from section 8 in their calendar rather than yours.

Common questions

Do I have to tell clients I use AI for their content? Not because a rule we could read says so. Tell them because the question is already in their inbox. The policy exists for the client relationship and the evidence trail, not because the law compels a public disclosure.

Does every article need a public AI disclosure? No. The duty is conditional on purpose and subject matter, and content generated before 2 August 2026 does not need labelling retroactively [14]. The grace period to 2 December 2026 applies only to systems placed on the market before 2 August 2026 and only to the provider marking obligation in Article 50(2) [14]; it does not move the deployer text duty.

Will telling clients I use AI lose me the account? We have no data on that and will not invent one. What loses accounts is a client finding out from someone else after asking you directly.

Should I name the specific tools? Name the steps and the review, and name tools only if you can keep the list current. A tool list six months out of date is worse than no list, because it is a specific claim that is now false.

What to do now

Three decisions before you send it: whether you name specific tools, whether the reader-facing disclosure is a footer line or an author note, and what you do when a client says no AI. Settle those and the eight sections write themselves.

Then draft the eight sections this week, even badly. Send it to one client and ask what is missing before it goes to the rest. Put the review date in a calendar with a reminder a month before.

See how white-label works for agencies

Sources

1. Article 3: Definitions — point (4) 'deployer' — European Commission — AI Act Service Desk, 2026-07-27
2. Transparency obligations under Article 50 of the AI Act — FAQ: who is a deployer — European Commission — Shaping Europe's digital future, 2026-07-24
3. Google Search's guidance on using generative AI content on your website — Google for Developers — Google Search Central, 2026-10-01
4. Article 50: Transparency obligations for providers and deployers of certain AI systems (Regulation (EU) 2024/1689) — European Commission — AI Act Service Desk, 2026-07-27
5. Rankwrite AI disclosure — 'We never fabricate' — Rankwrite, 2026-11-05
6. Rankwrite AI disclosure — 'You see every score' — Rankwrite, 2026-11-05
7. Rankwrite AI disclosure — Rankwrite, 2026-11-05
8. Rankwrite AI disclosure — 'Your readers can be told too' — Rankwrite, 2026-11-05
9. Creating helpful, reliable, people-first content — Google for Developers — Google Search Central, 2026-10-05
10. Creating helpful, reliable, people-first content — 'Why (was the content created)' — Google for Developers — Google Search Central, 2026-10-05
11. Article 113: Entry into force and application — European Commission — AI Act Service Desk, 2026-08-02
12. Article 50(4) — the human review / editorial responsibility exemption — European Commission — AI Act Service Desk, 2026-07-27
13. Transparency obligations under Article 50 of the AI Act — FAQ: what AI-generated text must deployers label — European Commission — Shaping Europe's digital future, 2026-07-24
14. Transparency obligations under Article 50 of the AI Act — FAQ: application date and grace period — European Commission — Shaping Europe's digital future, 2026-07-24
15. 16 CFR § 255.5 — Disclosure of material connections (Guides Concerning the Use of Endorsements and Testimonials in Advertising) — U.S. Federal Trade Commission / eCFR (16 CFR Part 255), 2023-07-26
16. FTC's Endorsement Guides: What People Are Asking — U.S. Federal Trade Commission, 2017-09-07
17. Artificial Intelligence Deceptive Advertising Act — Section 4, Clear and conspicuous disclosure — Pennsylvania General Assembly (Act No. 99 of 2026, from SB 806), 2026-10-22
18. Artificial Intelligence Deceptive Advertising Act — Section 3, definition of 'synthetic content' — Pennsylvania General Assembly (Act No. 99 of 2026, from SB 806), 2026-10-22
19. Governor Hochul Announces First-in-the-nation Law Requiring Disclosure When Advertisements Include AI-generated Synthetic Performers is in Effect — Office of Governor Kathy Hochul (New York), 2026-06-09
20. Governor Newsom signs new law to protect workers, require disclosures on AI-generated advertising — Office of Governor Gavin Newsom (California), 2026-09-16
21. Transparency obligations under Article 50 of the AI Act — FAQ: what counts as human review or editorial control — European Commission — Shaping Europe's digital future, 2026-07-24
22. Content scoring rubric: the 20 criteria our editor applies — Rankwrite, 2026-10-20
23. Content scoring rubric — the pass rule — Rankwrite, 2026-10-20
24. Content scoring rubric — on the weights and normalisation — Rankwrite, 2026-10-20

This article was researched, written and edited by AI under human supervision, and checked against Rankwrite's public editorial rubric.