Your agency already has an AI policy. Right now it is whatever each person on your team decided on their own. This one-page template replaces that with ten rules your staff can follow and a carrier reviewer can read: which tools are approved, what client information may go where, who checks AI output before a client sees it, and what to do when something goes wrong.
We wrote it for independent and captive agencies of five to twenty people, in October 2026. It is a starting point, not legal advice. Your carrier agreement, your state’s rules, and your E&O carrier’s requirements come first. Copy it, change it, and put your agency’s name on it.
Why one page beats a long policy
We open our agency training sessions with two questions. Who has used ChatGPT or a similar tool for work this month? Most hands go up. Who has been given written rules for it? Almost every hand goes down.
The fix is not a 20-page document. A long list of bans gets ignored, and people keep using AI on their personal accounts where you can’t see it. A short policy that says “here is how to use AI safely here” gets followed. That is the whole design goal of this template: short enough to read in five minutes, specific enough to settle real questions.
Why agencies need this now
- Carriers are asking. When Farm Bureau Insurance Company of Idaho reviewed our tools, we gave a live walkthrough to its technical services and security team, answered its vendor security worksheet in writing, and documented every Microsoft 365 permission we request. The approval named specific tools. Agencies should expect similar questions about the tools they use.
- Regulators expect oversight of AI vendors. Roughly half of the states have adopted the NAIC model bulletin on insurers’ use of AI. It is aimed at carriers, but it expects oversight of third parties, and agencies are part of that chain. Our AI regulation guide for insurance agents has the state-by-state picture.
- The real risk is already in the office. As we explain in Is AI safe to use with client data?, the biggest exposure is usually a personal AI account someone is already using, not the vendor you are evaluating.
The template
Fill in the brackets. Keep the numbering so people can refer to “rule 5” in a team meeting.
[Agency name] AI Use Policy · Version [1.0] · Effective [date] · Policy owner: [name]
1. What this covers. This policy applies to everyone who works for [agency name], including owners, producers, service staff, and temporary help. It covers any AI tool used for agency work, including AI features built into email, phone, CRM, and document software.
2. Use approved tools only. Use only the tools on the Approved AI Tools list below, on the account type listed. Do not use personal AI accounts for agency work. Business accounts must have training on our data turned off where the tool offers that setting.
3. Carrier rules come first. If a carrier we represent has rules about AI, vendors, or its data, those rules override this policy. Do not connect any AI tool to a carrier system or carrier-provided data until [policy owner] confirms it is allowed.
4. Follow the data rules. Green: no client information (marketing drafts, general questions, training) may use any approved tool. Yellow: client names, policy details, and notes may go only into tools approved for client data. Red: Social Security numbers, driver’s license numbers, full dates of birth, bank or card numbers, health information, and passwords never go into an AI tool unless that tool is specifically approved for that data.
5. A licensed person reviews before a client sees it. Any AI output about coverage, eligibility, price, or claims is reviewed by a licensed team member before it reaches a client. AI does not bind, change coverage, or decide whether something is covered.
6. Tell people when AI or recording is involved. Announce recording at the start of every recorded call or meeting. When people are in different states, follow the stricter consent rule. Tell clients when they are talking to an automated assistant.
7. Messages follow our normal rules. AI-drafted emails and texts follow the same consent, opt-out, and advertising rules as anything else we send. Automated texts or calls go only to people who have given the consent the law and our carriers require.
8. Ask before adding a tool. Anyone may suggest a new AI tool. [Policy owner] approves it after checking how the vendor uses our data, how long it keeps it, who it shares it with, how we delete it, whether it requires multifactor sign-in, and what account permissions it requests. Approval is added to the list with a date.
9. Report mistakes the same day. If client information goes into an unapproved tool, or AI output reaches a client without review, tell [policy owner] the same day. Reporting quickly will not get anyone in trouble. Hiding it will.
10. Review every quarter. [Policy owner] reviews this policy every quarter and whenever we add a tool or a carrier issues new guidance. Each team member signs the current version.
The Approved AI Tools list
Rule 2 only works if the list is specific. “ChatGPT” is not specific enough. “ChatGPT Business, agency workspace, training on our data turned off” is. Keep the list on the same page as the policy.
| Tool and account type | Used for | Client data allowed? | Approved by and date |
|---|---|---|---|
| [General AI assistant, business tier] | Drafting, summaries, training | Green only | [Name, date] |
| [Agency CRM with AI features] | Client notes, tasks, follow-up | Green and yellow | [Name, date] |
| [Policy document tool] | Coverage questions, renewal comparisons | Green and yellow | [Name, date] |
| [Meeting recording tool] | Meeting notes after consent | Green and yellow | [Name, date] |
Our own lesson from a carrier review applies here: approvals are specific. Idaho Farm Bureau Insurance approved three of our tools by name. Your list should be just as precise, so nobody assumes one approval covers every tool a vendor sells.
Captive agencies: add one more step
If you represent a single carrier, rule 3 does most of the work. Before you finalize the list, ask your carrier three questions:
- Do you keep a list of approved AI vendors, or a process for reviewing one?
- Which of your systems and data may an outside tool connect to, if any?
- Are there limits on recording calls, texting clients, or using AI in marketing?
Write the answers and the date on your policy. If the answer is “we don’t have a rule yet,” write that down too. For more on where the carrier’s boundary sits, read what to check when the carrier dictates your tech stack.
Roll it out in one week
| Day | Task | Time |
|---|---|---|
| Monday | Ask each person which AI tools they use for work and on what account. | 15 minutes |
| Tuesday | Move anyone using a personal account to a business account, or stop that use. | 30 minutes |
| Wednesday | Fill in the template and the Approved AI Tools list. Send carrier questions if you are captive. | 45 minutes |
| Thursday | Walk the team through the ten rules with two real examples from your office. | 20 minutes |
| Friday | Collect signatures and put the next review date on the calendar. | 10 minutes |
That is about two hours in total. The Thursday meeting matters most. Use examples like “can I paste this renewal into the chatbot?” and answer them with the rule numbers. For prompt templates your team can use on day one, see our free guide, What Your Staff Is Already Doing with ChatGPT.
What the policy looks like in daily work
Here is one example. A service rep wants help explaining a renewal increase to a client. Under this policy, the rep uses the approved policy document tool, not a personal chatbot (rules 2 and 4). The tool compares the expiring and renewal declarations, and a licensed agent reviews the explanation before it is sent (rule 5). Our renewal review checklist walks through that exact workflow.
Applied AI’s own controls, subprocessors, and permission details are on our security page, written for carrier reviewers. Use it as an example of what to ask any vendor on your list, including us.
Want help putting this in place? Our AI training for insurance agencies starts with exactly this conversation, or you can talk with us about your agency’s tools. Bring your current list of tools, even if it is just “we think a few people use ChatGPT.”