How to Write an AI Policy for Your Insurance Agency (Template)

By the end of this you will have a one-page AI policy you can adapt this afternoon, and a 30-day plan to get your whole team living by it.

Here is a quiet fact about your agency. Someone used ChatGPT on a client file this week.

Did they use the agency account or their own? Did the client's name go in? Did a licensed person read the answer before it went out?

If you are not sure, you are in good company. And that is the problem.

Most agencies are flying without one

The numbers line up across every survey this year.

• The 2026 Big "I" Agents Council for Technology report, as reported by Insurance Journal, found only 13% of agencies have a formal AI policy. 56% have none, and almost 44% rely on peer-to-peer training for new tools.
• The same report found 45% of respondents already use ChatGPT and other public models.
• Liberty Mutual's 2026 study found 65% of agents used AI for work in the past year, up from 37%, but only 18% said their agency has a well-defined AI policy.

Use is running far ahead of rules. ACT's own warning: that gap has to close for agencies to deal with significant security and liability gaps.

Why your E&O carrier cares

AI makes confident mistakes. In insurance, a confident mistake about an exclusion is an E&O claim with a timestamp.

In a September 2026 piece in Independent Agent magazine, Timothy Ventura and Dana A. Gittleman laid out five ways agencies can cut AI-driven E&O exposure. In short:

1. Licensed producer oversight. Treat AI output as a draft and verify terms, limits, deductibles, exclusions and endorsements against the actual forms.
2. A formal written AI policy, distributed, trained on and acknowledged in writing.
3. Control of third-party and data risk. Confidential client information stays out of unapproved public AI platforms.
4. Documentation of AI use alongside the rest of the file.
5. A review of your own E&O policy for AI exclusions or limits.

Your policy is where all five live.

The seven parts of a good policy

A useful policy fits on one page. Long ones do not get read.

1. Approved tools. Name the products and the plan. "ChatGPT" is not an answer; "ChatGPT Business on agency accounts" is.
2. Data rules. What may go in, what never goes in, and when to redact first.
3. Human review. What output a licensed person must check before a client or carrier sees it.
4. Prohibited uses. Binding, changing limits, coverage advice or coverage decisions without human review.
5. Records. What gets saved to the client file when AI shaped the work.
6. Vendors. Who approves new tools and what you ask them first.
7. Training and sign-off. Everyone reads it, everyone signs it, every year.

The one-page template

Copy this, replace the brackets, cut what does not fit your shop.

[AGENCY NAME] ARTIFICIAL INTELLIGENCE USE POLICY
Effective: [DATE]    Owner: [NAME, TITLE]    Next review: [DATE]

1. PURPOSE
AI tools can save time on drafting, summarizing and organizing. They can also be wrong,
and the agency is responsible for everything that leaves this office.

2. APPROVED TOOLS
Only these tools, on agency accounts, may be used for agency work:
- [TOOL AND PLAN, e.g. ChatGPT Business]  Admin: [NAME]
- [TOOL AND PLAN, e.g. Microsoft 365 Copilot]  Admin: [NAME]
Personal AI accounts may not be used with agency or client information.
New tools need written approval from [NAME] before first use.

3. DATA RULES
Never enter: Social Security numbers, tax IDs tied to a person, driver's license numbers,
bank or card numbers, dates of birth with names, health or injury information,
passwords, or [OTHER].
Redact names, addresses and policy numbers unless [TOOL] is approved for them.
Blank forms, carrier guidelines and our own drafts may be used freely.

4. HUMAN REVIEW
A licensed producer reviews any AI output that describes coverage, compares policies,
summarizes a loss history, or goes into an application or submission,
and checks it against the policy forms and source documents first.

5. NEVER ALLOWED
AI may not bind coverage, change limits or deductibles, give coverage advice,
or tell a client whether something is covered without licensed review.
AI may not sign, approve or send anything on its own.

6. RECORDS
When AI shaped advice or a submission, note in the client file: what was asked,
which tool was used, what it produced, and what the reviewer verified or changed.

7. VENDORS
Before approval, [NAME] confirms: training on our data (Y/N), retention period,
breach notice terms, BAA if health data is involved, and data export on exit.

8. TRAINING AND ACKNOWLEDGMENT
Everyone reads this policy and signs below at hire and every [MONTH].
Questions go to [NAME]. Mistakes get reported, not hidden.

Signed: ____________________   Date: __________

Roll it out in 30 days

Week one: find out what is already happening. Ask each person, without blame, which AI tools they use and for what. Write it in an inventory. The NAIC AI model bulletin guide has a copyable inventory table.

Week two: pick the tools and set them up. One business plan, agency accounts, settings checked. Is ChatGPT safe for insurance client data? compares the plans line by line.

Week three: train and sign. Thirty minutes, real examples from your own desks. Show one redacted prompt and one bad one. Everyone signs.

Week four: check the work. Pull five AI-assisted items from the week. Was the review step done? Is the record in the file? Fix the policy where it did not match reality.

Then put the next review on the calendar. Quarterly is about right while vendors keep changing their terms.

When someone breaks it

Someone will. Probably in the first month, probably with good intentions and a deadline.

Handle it the way you handle any near miss. Find out what went in, where, and whether a client saw the result. If client data went into a personal account, delete the chat, note what happened, and check whether your state's rules or your E&O carrier expect a report. Then ask the useful question: why was the wrong tool the easier one? Usually the agency account was slower to reach, or nobody knew the redaction habit. Fix that, and the policy starts enforcing itself.

Make the safe path the easy path

People skip policies that slow them down. So give them a faster route that is also the safe one.

For the most repetitive work, that route can skip the chat window entirely. With Salience, you forward the certificate request, the application or the renewal, Salience prepares it, and nothing goes out until someone at your agency approves it. Your review step is built in.