An agency owner told me recently about a tool his team had started using. It drafted first-pass copy for client campaigns, and it was good. Fast, on-brand after a bit of tuning, genuinely useful. Then a client in a regulated industry asked a simple question during a review: where does the content go after we submit our brief, and is anything we share used to train the model?
He did not know. Not because he was careless, but because the question had never come up. The tool worked, so he used it. That gap, between a tool working and a tool being safe to build a client relationship on, is worth sitting with.
Here’s what’s strange about that moment: he’d sat on the other side of it dozens of times. Clients run agencies through exactly this kind of scrutiny constantly, security questionnaires, data handling forms, the “walk us through your process” call before a contract gets signed. He knew that scrutiny cold. He’d just never turned it back on his own stack.
That’s the habit worth naming. Not a new discipline borrowed from somewhere else, but a familiar one, aimed in a direction it has never had to face before.
You already know this scrutiny. You’ve just been on the other side of it.
Being vetted and doing the vetting are the same discipline from different seats, and the risk underneath is shared. When you put a third-party AI tool inside a client-facing workflow, you inherit its behaviour. If it handles data carelessly, that becomes your carelessness in the client’s eyes. If its outputs carry a hidden bias or a licensing question, that becomes your problem to explain. You are not just using the tool. You are vouching for it, whether or not you meant to, in exactly the way a client is vouching for you when they sign off on your process.
Most agencies are already good at this instinct in other areas. You vet a freelancer before putting them in front of a client. You check whether a stock image is actually cleared for commercial use. You read the important parts of a contract. The discipline exists. It simply has not been pointed at AI tools yet, partly because they arrive looking finished and friendly, and finished, friendly things do not invite scrutiny.
A short list worth keeping
You do not need a legal team or a procurement process to close most of this gap. A handful of questions, asked before a tool becomes load-bearing, does the work.
What happens to the data we put in. Is it stored, is it used for training, can we turn that off. This is the one clients ask most, and the one worth knowing cold.
Who stands behind this, and what is their track record. A well-funded company with clear documentation is a different proposition from a wrapper built over a weekend, even if both produce similar output today.
What does the tool claim about responsible use, and does the claim hold up. Look for specifics. Vague reassurance is a signal in itself.
What breaks if this tool disappears. If a workflow depends entirely on one product with an uncertain future, that is a business exposure, not just a software one.
None of this needs to slow you down. Most of these questions can be answered in an afternoon of reading and one honest email to the vendor. The point is not to build a fortress. It is to know what you are standing on before a client asks you to explain it.
The underlying advantage
Doing this well isn’t only protective. It’s a position you can hold in front of a client. When a brand asks how you use AI, and you can answer plainly, which tools, what they do with data, why you chose them, you are demonstrating exactly the judgement they are paying an agency for. The scrutiny becomes part of the service rather than a cost of it.
The agencies that will be trusted with AI-assisted work over the next few years are not the ones with the most tools. They are the ones who can account for the ones they have.
