AI policy template for market research agencies

What should a market research AI policy cover?#

A market research AI policy covers four things: which tools are allowed, what data may go into them, what clients and respondents are told, and how people check AI output before it reaches a client. Every section of the template supports one of those four.

Write it for the people who will use it: project managers, analysts, moderators, coders and freelancers. Short rules with examples from your own studies work better than general principles, and a one-page summary attached to the project kickoff checklist carries the rules into real work.

Sort data into three classes before writing any rule. Client materials, such as briefs, stimuli, brand plans and results, are governed by the master agreement. Respondent personal data, such as screener answers, contact details, recordings and identifiable verbatims, is governed by consent and privacy law. The agency's own records, such as questionnaire libraries, codeframes and proposals, are governed by internal policy. A tool can be approved for one class and barred for another.

The template, section by section#

Use these sections as the skeleton of the policy. The third column names the obligation each section serves, so you can check coverage against the research code your agency follows and against your client contracts.

Vendor terms: the review behind every approved tool#

Vendor terms decide whether a tool can go on the register, so the policy should require a terms review before approval and again at renewal. The review answers a short set of questions, recorded against the specific plan the agency holds.

Answers differ by product and plan. Zoom's terms state that it does not use audio, video, chat or other communications-like customer content to train Zoom or third-party AI models. For Microsoft 365 Copilot, Microsoft's enterprise data protection documentation says prompts, responses and data reached through Microsoft Graph are not used to train foundation models. Notion says its model providers keep no customer data by default for Enterprise workspaces but may keep it for a limited period on other plans. A consumer account of the same product may sit under different terms entirely.

• 1Does the vendor use customer content to train its own or third-party models, and is that default on or off?
• 2How long do the vendor and its model providers keep prompts, uploads and outputs?
• 3Which subprocessors handle the data, and in which countries?
• 4Who owns outputs, and are they treated as customer content or confidential information?
• 5Does the business plan differ from the consumer plan on any of these points?

Disclosure and labeling: what clients and respondents should see#

Disclosure rules tell project teams when to mention AI to clients; labeling rules tell them how to mark AI-influenced outputs. A workable standard is to name the stages where AI was used in the proposal and the methods section, confirm human review, and label anything a reader could mistake for direct human data.

Synthetic respondents need the clearest labels. A chart that mixes synthetic and human answers without marking them misstates the evidence behind a client's decision. AI-coded verbatims should note that a person validated the coding, and AI-drafted session summaries should be checked against the transcript before anyone quotes them.

Respondents need notice too. If an agency starts processing panel answers with AI in ways its privacy notice did not describe, the notice should change before the practice does. FTC staff have warned that quietly changing terms of service or privacy policies to permit more permissive uses, such as AI training, could be unfair or deceptive.

Closing the gap between policy and practice#

The usual failure in an AI policy is not a missing section but a document that describes something the agency does not actually do. These steps keep the written rules and daily work aligned.

• 1Build the tools register from expense reports, single sign-on logs and a short staff survey, not from memory.
• 2Add an AI line to the project kickoff checklist: which tools, which data and what the client contract allows.
• 3Spot-check a sample of delivered projects against the policy at each review.
• 4Collect a short attestation from staff and freelancers at onboarding and after each policy update.
• 5Log every exception with a reason and an approver, and review the log before revising the policy.

Illustrative: a mixed-method agency writes its first policy#

Illustrative: a fictional mixed-method agency runs online surveys, in-person groups and remote interviews. Its moderators had started using an AI notetaker in remote interviews, and analysts were pasting verbatims into a consumer chatbot to draft codeframes.

The compliance lead builds the register first. The notetaker is approved on its business plan, with recording and transcription consent added to the screener. The consumer chatbot is replaced by an enterprise account whose terms exclude training on customer content. One client's master agreement prohibits any third-party AI on its studies, so that client goes into the kickoff checklist as a named exception.

The first spot check finds a few reports where AI-coded verbatims were not labeled. The fix is a standard line in the report template rather than a new rule.

How the policy connects to your archive and to SourceX#

An AI policy also documents how records were handled, which matters if the agency later considers licensing its own archive. Studies processed only in approved tools, with clear client permissions and labeled synthetic data, are far easier to trace than studies that passed through unknown accounts.

SourceX reviews those facts in the Rights and Preparation steps of the SourceX five-step transaction. The permitted use and privacy record in a SourceX Evidence Packet draw on the same answers the policy already requires: which data, which tools and which consents.