How to write an AI policy for your marketing team, with a free template

Many marketing teams started paying for AI before anyone wrote down how to use it. In a team like that, a few people use the tools well. Everyone else uses them like a search box, pastes the brand guidelines in by hand when they remember, and checks every number because nobody trusts what comes back.

The research shows the same gap. In SmarterX's 2026 State of AI for Business Report, a survey of more than 2,100 professionals, 48% said their organisation has a generative AI policy and 29% have an AI roadmap. Only 13% have all four of the foundations SmarterX tracks: a roadmap, an AI council, a generative AI policy and an AI ethics policy.

A marketing team doesn't need a council to close that gap. It needs two short documents, written for two different readers.

The two documents, and who reads each

The policy tells people what's allowed. The rulebook gives the AI the facts it would otherwise guess, such as what counts as a lead or which words your brand never uses. A policy on its own still leaves the AI guessing.

What goes in the AI policy

Keep it to one page, so people read all of it. Each line should be something a person can follow without asking anyone.

• Who it covers. Everyone who uses AI for company work, including contractors and agencies.
• The tools you use. Name the business AI subscription and any other approved tools. Company work stays out of personal accounts.
• What people can use. Published material, internal documents with a given label, and data from the accounts connected to your AI tool.
• What never goes in. Customers' personal details unless the tool is approved for them in writing, passwords and API keys, unreleased financials and pricing, and anything a contract says must stay private.
• Before anything goes out. A person checks every fact, number and quote against its source, and a named approver signs it off. The person who publishes is responsible for it, whoever drafted it.
• Disclosure. When you say AI helped: for example, on fully AI-generated images, or wherever a platform or regulation requires it.
• Images and people. No real person's likeness without written permission, and no copies of another company's logo or campaign.
• When something goes wrong. Who to tell, straight away.
• Owner and review date.

Have legal or HR read it before you share it, especially in a regulated industry. The policy is the document they'll want to see.

What goes in the rulebook

The rulebook holds everything the AI would otherwise have to guess. These are the nine sections we use, each with an example of a rule that belongs in it:

1. Company facts. What you sell, to whom, and where the facts that change are kept. "Prices come from the pricing page, never from memory."
2. Tone of voice. How you sound, product names, the words you never use, and examples of writing you like and dislike. "Never use 'synergy' or 'world-class'. Sentences under 25 words."
3. Numbers. Which accounts to use and how you count things. "A lead is a form submission with a work email. Webinar sign-ups don't count." And: "Compare each week with the same weekdays last year, and say which comparison you used."
4. Sources. The sources you trust, the ones you never quote, and any wording you must or must not use. "Statistics link to the organisation that collected them, with the date. If the original can't be found, the claim comes out."
5. Approvals. Who signs off what, and where approved work goes. "Press releases need the head of marketing's approval. Blog posts need the editor's, then go to the website as drafts."
6. Access and changes. "The AI can read our accounts but not change them. Changes arrive as drafts or preview links that a person accepts."
7. Images. Colours, logo rules and rules about real people. "Never generate a logo. Leave room for it and place the real file afterwards."
8. Checks before anything goes out. A short checklist the AI runs on its own work before anyone sees it.
9. Owner and review. A name at the top, a monthly review, and a list of changes at the bottom.

You don't need all nine on day one. Start with numbers and tone of voice, which in our experience cause most of the mistakes people notice. Then add a section each time the AI gets something wrong that a rule would have prevented.

How to write rules the AI follows

A rule works when you could check whether it was followed. Vague rules sound good and change nothing.

Four habits help:

• Write instructions. "Compare with the same weekdays last year" works. "We value fair comparisons" doesn't.
• Show examples. One paragraph you love and one you'd reject teach tone faster than a list of adjectives.
• Put the important rules first. Definitions and approvals at the top, nice-to-haves at the bottom.
• Fix the rulebook as well as the draft. When the AI gets something wrong, correct the draft, then add the line that would have stopped it. That's how the document gets better every week.

Where the rulebook lives

Business AI subscriptions let you save instructions and files in a shared project or a custom assistant. Paste the rulebook into those instructions, or upload it as a file and have the instructions tell the AI to read it before every task. Everyone working in that project then starts from the same rules, and a change happens in one place.

Keep the master copy in your shared drive, with the list of changes, and paste from it into each project when it changes. Because it's plain text, it works with whichever AI provider you use and moves with you if you switch.

Roll it out in a week

1. Day 1: write the one-page policy and send it to legal or HR.
2. Day 2: spend 45 minutes each with the two people who use AI most, and write down what they paste in, what they correct and what they've stopped trusting.
3. Day 3: write the numbers and tone of voice sections.
4. Day 4: add sources, approvals, images and the checklist.
5. Day 5: load the rulebook into your shared projects, run five real tasks through it, fix what breaks, and name the person who looks after it.

Keep it up to date

A rulebook goes stale when nobody looks after it. Give one person the job, put a monthly review in their calendar, and keep the list of changes honest. Pick one thing to measure, such as the hours spent on Monday's report, write it down before you start, and check it again after a month. If it hasn't moved, the rulebook is the first place to look.

Get the template

We publish the twelve rules every AI setup we do follows, free to copy. The Rulebook template is a plain text file with a heading for each section above and example rules to replace with your own. The one-page policy is the appendix. Fill in the rulebook and paste it into your AI tool's saved instructions, then send the appendix to everyone who uses AI at work.

Frequently asked questions

Is an AI policy the same as a rulebook?

They're different documents for different readers. The policy tells people which tools to use, what must never go in and who approves what. The rulebook gives the AI your definitions, tone of voice, sources and checks. Most teams need both.

How long should a marketing AI policy be?

Aim for one page. People read a one-page policy in full and follow it, and they skim a longer one. The detail belongs in the rulebook, where the AI reads all of it every time.

Who should look after the rulebook?

One person in marketing who uses AI every day and has time set aside to keep the rulebook up to date. In many teams that's the marketing operations lead or the content lead.

Does a rulebook work with any AI tool?

Yes. It's plain text, so it goes into the instructions of any business AI subscription, and it moves with you if you change provider.

Does legal need to approve it?

Have legal or HR read the policy before you share it, especially in a regulated industry. The rulebook rarely needs a legal review, except for any compliance wording you add to it.