AI & Protecting Creative IP

Your designers are already using AI. So are your editors, your copywriters, and probably your account managers. The question isn't whether to allow it. It's whether your setup protects client IP when they do.

That's the reality at most creative agencies right now. The tools are incredible. Midjourney, Runway, ChatGPT, Claude, Figma AI, Sora, they genuinely make people faster and more creative. But every time someone on your team pastes client work into one of these tools, you're trusting that platform with someone else's intellectual property.

And that trust might be misplaced.

Here's what a lot of agency owners don't realize: many of these AI platforms, especially the free and consumer-tier versions, include terms of service that allow the provider to use your inputs to train their models. That means the unreleased product shots your designer uploaded could theoretically influence outputs that other users see. The National Cybersecurity Alliance found that 65% of workers are using AI tools at work, and 43% admitted to sharing sensitive information with AI platforms without their employer knowing. That's not a future risk. That's your Tuesday.

Let me be specific about what this looks like at a creative agency:

The "it's just a tool" problem. A screenplay outline fed into an AI tool. Proprietary design processes shared for "optimization." Confidential business strategies analyzed by AI. Any of these could potentially leak to competitors or the public. Your team doesn't think of AI as a third party, but it is with its own data policies, its own servers, and its own terms of service.

The shadow AI problem. An UpGuard report found that more than 80% of workers are using unapproved AI tools on the job. At small companies with 11 to 50 employees, researchers found roughly 269 unsanctioned AI tools per 1,000 employees. That means for every four people on your team, there's probably an AI tool your IT doesn't know about. Tools connecting to your client data, your file servers, your project management systems with zero oversight.

The personal-professional blur. One of the trickiest scenarios I see is team members using the same AI accounts for personal and professional work. Their personal ChatGPT is also where they paste client briefs. Their personal Midjourney is where they test campaign concepts. The lines blur fast, and when they do, data ends up in places you have zero control over.

The "it could end a relationship" problem. Creative agencies aren't handling generic data. You're handling unreleased campaigns, embargoed product launches, client financials, and creative IP that represents months of work. A leaked concept or premature reveal doesn't just violate a policy. It can end a client relationship and the referrals that come with it.

So what does a practical AI policy actually look like?

You can't ban AI tools at a creative agency. The productivity gains are too real, and your team will use them anyway. What you can do is build a framework around it. I've been helping our agency clients work through this, and here are the five things I recommend putting in place this month:

1. Data Classification. Not all data carries the same risk. Create three simple tiers: Public (published work, general reference material), Internal (team processes, internal templates), and Confidential (client assets, unreleased work, financials, strategy docs). Anything in the Confidential tier never goes into a consumer-grade AI tool. Period. Post this somewhere your team sees it every day.

2. Approved Tool List. There's a massive difference between a free ChatGPT account and an enterprise-grade platform with data retention guarantees. Build a short list of AI tools your team is authorized to use, and specify which tier of data each tool can handle. Enterprise versions offer contractual guarantees that your data won't be used for training. Free tiers almost never do. The investment in enterprise licenses is worth it.

3. Access Controls. Your junior designer and your creative director probably shouldn't have the same level of access to AI tools connected to client assets. Implement role-based access: who can use which tools, what data they can feed in, and what outputs need review before going to a client.

4. Audit Trails. You can't protect what you can't see. Implement basic monitoring so your IT team (or your MSP) has visibility into which AI tools are being used across the organization. You don't need to spy on your team. You need to know what's connecting to your systems.

5. Client Agreements. Your clients are going to start asking about your AI policies, if they haven't already. Some already require it. Get ahead of this by adding an AI use disclosure to your agreements. Specify what tools you use, how client data is handled, and what protections are in place. The agency that can clearly articulate how they protect client IP in an AI-heavy workflow wins trust faster than the one that hasn't thought about it yet. It’s not just risk mitigation but competitive advantage.

The wild west of AI at creative agencies isn't going to regulate itself. And you don't need to wait for the government to tell you what to do. You just need a clear, simple policy and the IT infrastructure to enforce it.

Five things. One page. Start there.

Sources:

• 65% of workers using AI / 43% sharing sensitive info (National Cybersecurity Alliance): Tenable Blog
• 80%+ of workers using unapproved AI tools (UpGuard): Cybersecurity Dive
• 269 unsanctioned AI tools per 1,000 employees at small businesses: Reco.ai — 2025 State of Shadow AI Report
• 58% of employees using AI daily (KPMG): KPMG Shadow AI Report (PDF)
• AI-associated breaches costing $650K+ (IBM): ISACA — Rise of Shadow AI