Most agencies already have people using AI tools at work. Usually nobody has written down what client information can go into those tools, who approved them, or who checks the output before it reaches a client or a carrier. Carriers, E&O underwriters and larger clients have started asking about it.
This template gives you a starting policy that you can copy, edit and adopt this week. It was written for independent P&C agencies and employee benefits brokerages, so it covers personally identifiable information, protected health information, carrier data and producer workflows. Replace everything in [brackets] with your own details, and have your attorney or compliance lead review it before you adopt it. This template is not legal advice.
The same rules are what we put in place on the Foundation. Benefits brokerages and P&C agencies can see how those rules fit their work. The cost guide shows what the engagement costs. What the sections are for, before you fill them in, is in what belongs in an agency's AI governance policy.
How to use it
- Copy the policy below into your own document.
- Fill in the bracketed fields and the approved-tool list in Appendix A.
- Have your principal, your compliance lead and your attorney review it.
- Walk your team through it, collect a signed acknowledgment from each person, and review it every six months.
The policy
The full policy is below. Nothing is behind a form. Copy it, or download the same text as a Word file or a Markdown file.
[AGENCY NAME] ARTIFICIAL INTELLIGENCE (AI) GOVERNANCE POLICY
Version: [1.0] Effective date: [DATE] Policy owner: [NAME, TITLE] Next review date: [DATE, no more than six months after the effective date]
1. PURPOSE
This policy explains how [Agency Name] staff may use artificial intelligence tools in their work. Its goals are to protect client, carrier and agency information, to meet our legal and contractual duties, and to make sure a qualified person stays responsible for every piece of advice and every document we send.
2. SCOPE
This policy applies to every employee, producer, contractor and intern who does work for [Agency Name], on any device, whether owned by the agency or personally owned. It covers chat assistants, writing and summarizing tools, AI features built into agency software (such as the agency management system, email, CRM, quoting and enrollment platforms), meeting note-takers, and browser extensions.
3. DEFINITIONS
- "AI tool" means any software that generates text, images, code, summaries, or analysis from a prompt or from data it is given.
- "Approved AI tool" means a tool listed in Appendix A, used through an account that the agency controls.
- "Restricted data" means the information listed in Section 5.3.
- "Output" means anything an AI tool produces.
4. APPROVED TOOLS AND ACCOUNTS
4.1 Staff may use only the AI tools listed in Appendix A for agency work.
4.2 Agency work must be done in agency-controlled business accounts, never in personal or free consumer accounts.
4.3 Approved tools must be configured so that agency data is not used to improve the vendor's models, and data retention must match the settings recorded in Appendix A.
4.4 Staff may request a new tool from the Policy Owner. A tool is not approved until it has passed the vendor review in Section 8 and been added to Appendix A.
4.5 Meeting note-takers may be used only with the consent of every participant, and recordings that contain restricted data must be stored and deleted under our records policy.
5. DATA RULES
5.1 Green (allowed in approved tools): public information, agency marketing content, general insurance and benefits questions, and internal documents that contain no client data.
5.2 Yellow (allowed only in approved tools and only after masking): client business names, plan designs, rate exhibits, census files, loss runs, schedules of insurance and carrier quotes, once individual identifiers have been removed or replaced with placeholders.
5.3 Red (never entered into any AI tool, including approved tools, unless the Policy Owner has approved a specific workflow in writing and a business associate agreement or equivalent contract is in place):
- Social Security numbers, driver's license numbers, passport numbers and dates of birth tied to a name
- Protected health information, including diagnoses, claims detail, prescriptions and large-claimant reports that identify a person
- Bank account, credit card and payment information
- Usernames, passwords, and access codes for carrier or client systems
- Anything a client or carrier contract says may not be shared with third parties
5.4 When in doubt, treat the data as Red and ask the Policy Owner.
6. HUMAN REVIEW
6.1 A qualified staff member must review and approve every output before it is sent to a client, prospect, carrier or regulator, or used to make a coverage, eligibility, pricing or claims recommendation.
6.2 Staff must check figures, plan details, coverage terms, and dates against the source documents. AI tools can produce confident errors.
6.3 AI may not make final decisions about coverage, underwriting, claims, eligibility or employment.
6.4 The person who sends a document is responsible for its content, whether or not AI helped draft it.
7. CLIENT TRANSPARENCY
7.1 We will tell clients that we use AI tools to support our work when they ask, and in our [privacy notice / engagement letter].
7.2 We will honor any client request that their information not be processed with AI tools.
8. VENDOR REVIEW
Before a tool is approved, the Policy Owner will confirm and record:
- Where data is stored and how long it is kept
- Whether customer data is used to improve the vendor's models, and how to turn that off
- Whether the vendor will sign a business associate agreement (required for any workflow that touches PHI) and a data processing agreement
- Security certifications (for example SOC 2 Type II)
- Admin controls, including single sign-on, user removal, and audit logs
- How the vendor reports a security incident
9. REGULATORY ALIGNMENT
This policy is intended to support our obligations under [HIPAA, as applicable to our benefits work], the Gramm-Leach-Bliley Act, state insurance data security laws [list applicable states], and our carrier and client contracts. It is also written to meet the expectations in the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (adopted by the NAIC on December 4, 2023) where a carrier contract or our state's adoption of that bulletin reaches this agency. The bulletin is addressed to licensed insurers, not to agencies.
10. INCIDENTS
10.1 Staff must report any suspected misuse, including Red data entered into any AI tool or agency data entered into an unapproved tool, to the Policy Owner within [24] hours.
10.2 The Policy Owner will assess the incident, contact the vendor to request deletion where possible, and follow our incident response plan, including any required client, carrier or regulator notice.
10.3 Reporting a mistake promptly will not by itself result in discipline.
11. ONBOARDING AND ACKNOWLEDGMENT
11.1 Every staff member will review this policy with their manager before receiving access to an approved tool, and annually after that.
11.2 Every staff member must sign the acknowledgment in Appendix B.
12. ENFORCEMENT
Violations may result in loss of tool access and disciplinary action, up to and including termination, consistent with our employee handbook.
13. REVIEW
The Policy Owner will review this policy at least every six months, and whenever we add a tool, change vendors or a relevant law changes.
APPENDIX A: APPROVED AI TOOLS
| Tool | Account type | Approved uses | Data allowed (Green/Yellow) | Retention setting | BAA signed? | Approved by / date |
|---|---|---|---|---|---|---|
| [ ] | [Business] | [ ] | [ ] | [ ] | [Y/N] | [ ] |
APPENDIX B: STAFF ACKNOWLEDGMENT
I have read the [Agency Name] AI Governance Policy, I understand it, and I agree to follow it. I understand that Red data must never be entered into an AI tool and that I am responsible for reviewing any AI output that I send.
Name: ____________________ Signature: ____________________ Date: ________
About the NAIC citation
Section 9 uses the title on the adopted bulletin: NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted by the NAIC Executive Committee and Plenary on December 4, 2023. The bulletin is addressed to insurers licensed to do business in a state. It sets expectations for those insurers. It does not, by itself, impose duties on an agency. The policy applies it where a carrier contract or a state's adoption of the bulletin reaches the agency. The adopted text is the NAIC model bulletin (PDF).
Do we need an AI policy if we only use ChatGPT a little?
Yes. Casual use is where most of the risk sits, because it usually happens in personal accounts with default settings. A short policy that names one approved tool and sets out the data rules will cover most of that risk.
Is this template HIPAA compliant?
A template cannot make an agency compliant by itself. It gives a benefits brokerage the right structure, which covers the PHI rules, the business associate agreement requirement and incident reporting. Your compliance lead or attorney should review it against your own contracts and processes.
Which AI tool should an agency standardize on?
It depends on the systems you already use and on which vendors will sign the agreements you need. Pick one tool on a business plan, turn off the setting that lets the vendor use your data to improve its models, and list it in Appendix A. Having one tool that everyone uses the same way is safer than having several tools that each person sets up differently.
How often should we update the policy?
Review it at least every six months, and update it whenever you add a tool, change vendors or a state changes its rules. AI products change their terms and features often.
Can we copy and edit this template?
Yes. It's free to use, edit and share inside your agency, and you don't need to fill in a form. If you publish an adapted version, we'd appreciate a link back to this page.
The same policy can be drafted with your agency type, state, tools, and size filled in through the AI connector. The draft is the template on this page. It is not legal advice, and the text you submit is not stored.
