# How to write an AI usage policy for a design studio

Source: https://cloudbrain.in/insights/ai-usage-policy-design-studio
Last updated: 2026-11-11

An AI usage policy tells everyone in a design studio which AI tools they may use, what data they may share, how outputs must be checked and who is accountable. It can be two pages long. This guide explains each section, gives a template structure you can adapt, and shows how to introduce the policy without slowing the team down.

Most design studios already use AI, whether or not they have decided to. People draft emails in AI assistants, try image generators for concepts and summarise documents. An AI usage policy turns that individual experimentation into a shared, safe practice.

## Why does a design studio need an AI usage policy?

Without a policy, each person makes their own decisions about tools, client data and checking. That creates three risks:

- **Confidentiality:** drawings, briefs or client details end up in tools whose terms nobody has read.
- **Quality:** AI outputs can contain confident errors ([hallucinations](/glossary/hallucination)) that reach clients or authorities unchecked.
- **Accountability:** when something goes wrong, nobody knows who approved the tool or the output.

A policy settles these questions once. It also gives the team permission to use AI well, which matters as much as the restrictions.

## What must the policy cover?

Seven headings cover what most studios need:

1. **Purpose:** why the studio uses AI and what the policy covers.
2. **Approved tools:** which AI tools staff may use, and for which kinds of work.
3. **Data rules:** what may and may not be entered. For example, no client personal data or confidential drawings in unapproved tools.
4. **Review:** who checks AI-assisted work, how the check is recorded, and what must never be issued unchecked.
5. **Disclosure:** when clients are told that AI was used, and how.
6. **Ownership:** the person responsible for the policy, and how to raise a concern.
7. **Review date:** when the policy will next be reviewed, because AI tools change quickly.

## What does a two-page template look like?

Keep each heading to a few lines. For example:

> **3. Data rules.** You may enter project briefs, drawings and specifications into the tools approved for project data (Appendix A). Never enter client or staff personal data, such as names, phone numbers or ID documents, into any AI tool unless the task needs it and the tool is approved for personal data. If in doubt, remove the details or ask the policy owner.

> **4. Review.** A qualified architect or engineer checks every AI-assisted output before it goes to a client, an authority or site. They check numbers, areas and code references against the source and record the check in the project file.

Put the list of approved tools in an appendix, with the plan or account type for each. A tool's business plan often has different data terms from its personal plan, so the appendix should name the plan, not just the tool. Our free [AI for AEC Handbook](/handbook) includes the full seven-heading template and a review checklist.

## How do you roll it out to the team?

- **Approve tools first.** Pick one or two tools for everyday work so people have a safe option from day one.
- **Run a short session.** Walk through the policy with real examples from your projects: what is allowed, what isn't, and how to check outputs.
- **Make the review step easy.** A one-line note in the project file ("AI-assisted; checked by **_ on _**") is enough.
- **Name an owner.** One person answers questions and keeps the approved-tools list current.

If the policy covers personal data, align it with the [DPDP Act, 2023](/insights/dpdp-act-ai-aec-firms). Our [training and AI governance](/services/training) service runs this rollout, including workshops and the policy itself.

## How often should it be reviewed?

Review the policy every six months, and whenever you:

- approve a new AI tool or change a plan
- start a project with stricter client confidentiality terms
- learn of a mistake or near miss involving AI output

Most reviews only change the approved-tools appendix. The principles of minimum data, approved tools, human review and clear accountability rarely change. That is what [AI governance](/glossary/ai-governance) means in practice for a design studio.

## Frequently asked questions

### How long should an AI usage policy be?

Two pages is enough for most design studios. A short policy that everyone reads works better than a long one that nobody opens. Put detail, such as the list of approved tools, in an appendix you can update.

### Should we ban AI tools until we have a policy?

Usually not. A ban tends to push use into personal accounts, where you have less control. It is better to approve one or two tools quickly, with clear data rules, while you write the full policy.

### Do we need to tell clients that we use AI?

Decide this in the policy. Many studios disclose AI use when it shapes a deliverable, such as concept images, and always confirm that a qualified professional has reviewed the work.