Use of AI policy
Revision 7. Approved 1 October 2026. Owner: Group chief executive (Nan Williams). Maintained by: Head of AI. Reviewed at minimum every quarter.
Our approach
We use artificial intelligence (AI) every day, in our own work and in the work we do for clients if we have their permission. We expect everyone at Four to use the approved AI tools to a very high standard and with a view to accuracy and responsibility. We also govern that use with care, because our clients trust us with their information, brands and reputations.
This policy sets out the principles we follow, who is accountable and how we keep the policy current. It applies to everyone who works for or on behalf of Four Agency Worldwide and its group companies in every office, including contractors and freelancers. It covers every AI tool we use for Four or client work. That includes chat assistants, AI built into other software and tools that create images, video or voices. It also covers the AI tools we build ourselves.
Alongside this policy, we publish practical guidance for staff on which tool to use for which task and how to get help.
Our principles
We use AI lawfully. We follow data protection law in every country where we work, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Each office also follows its own local data law, such as data protection law in the United Arab Emirates and Saudi Arabia.
We are honest about AI. We never pass off AI-generated work as wholly human. We agree AI use with clients before we start and we disclose it in the right way.
A qualified, trained expert from Four is always accountable for our outputs. Every piece of work that uses AI has a named owner. AI can suggest and support, but a person decides.
We protect information. We use approved tools paid for and vetted by Four and keep client and personal information separate and secure.
We check for fairness. We review AI output for bias and for anything that could mislead or cause harm.
We are tool-flexible. We work across a range of AI providers and choose the right tool for each task and each client. When we advise clients on AI, we advise on fit, not on a specific platform.
Approved tools
Our core AI tools today are ChatGPT Business, Microsoft 365 Copilot and Claude (business). We also test other providers' models to keep our advice current.
Our AI tools register, which the Head of AI keeps current, is a single list of approved tools current at any point in time at Four. For each tool, the register sets out what we may use it for and what kinds of information it may hold.
We do not allow unauthorised personal accounts or free consumer versions for Four or client work. Where an AI tool connects to other systems such as email, calendars or file stores, we switch on only the connections approved in the register. A tool that can act on someone's behalf asks for their approval first.
Information and data
What goes into an AI tool depends on the kind of approved information and what the register allows for that tool.
Every AI tool that processes personal data has a DPIA before we use it.
Client work
Our use of AI on a client's work is restricted where the client has specifically precluded it or precluded specific use cases or specific tools. We are able to track and monitor AI use on client work. We follow each client's AI rules and contract terms where provided. The Head of AI reviews any AI clause in a client contract or brief to ensure compliance. We use client information only for the purpose the client gave it to us.
AI outputs stay as drafts until they pass the client's usual review and have been approved by expert humans from Four. Failing to disclose AI use in client work may lead to disciplinary action.
Being open about AI
Every Four email signature links to our public statement on our use of AI. That statement is enough for routine use, such as an AI first draft that a person rewrites and checks. Where AI use could mislead, or where a client asks, we show it clearly next to the content.
People always know when they are dealing with AI. Chatbots, voice assistants and AI personas say they are AI.
Likeness, voices and synthetic people
We never create the likeness or voice of a real person without that person's written consent for that use. We label synthetic personas. We also label any AI-generated or AI-altered image, video or audio that people could mistake for a real person, place or event. We follow the transparency rules of each market where we publish, including the European Union's AI Act where it applies.
Before AI-generated images, video, music or voices go into client work, we check that the tool's licence allows commercial use and that the output does not copy an identifiable work.
Checking what AI produces
The person who uses the tool owns the output. Before anyone uses, shares or publishes the output, its owner checks facts, figures, quotes and sources against the original. AI tools can invent all four. The owner also checks the work for bias and for anything that could offend or mislead, then makes sure it meets the brief and our quality standard.
AI does not make decisions about people. It may help prepare information for decisions about hiring, performance or access to services, but a person makes the decision.
New tools and testing
Our AI operations (AI Ops) team tests new models and tools before anyone relies on them or is approved to use them. A new tool joins the register only after the Head of AI approves it, following a review of its data handling, security and terms.
AI tools we build
The AI tools we build for our own work or for clients follow this policy too. Each one has a named owner and uses only approved models and services. We test each tool before release. A person checks its outputs before they leave Four.
When AI models change
AI suppliers change their models and terms often, and a change can alter how an approved tool behaves. The Head of AI owns our model update procedure. We monitor supplier changes and reassess significant ones for accuracy, bias, data handling and compliance. If a change creates risk, we limit or suspend the tool.
Governance
The Group chief executive owns this policy and approves each revision. She also chairs the company’s AI Council.
The Head of AI maintains this policy and the AI tools register, approves AI tools, owns the model update procedure and leads AI training. He chairs the company’s AI Steering Committee.
The AI Council oversees how we use AI. The Group chief executive chairs it and the Head of AI convenes it. It meets every quarter. The council reviews our use of AI and hears appeals on tool decisions, and it advises on new uses, risks and client AI terms.
Our data protection lead approves DPIAs for AI tools.
Training
New joiners get AI training at induction. Everyone gets regular updates through training sessions, short films, guides and the AI tip in our Monday newsletter.
We run AI training sessions at least every quarter. Every member of staff completes AI training at least once a year. We record attendance. Specialists who build or test AI get training specific to their role.
Help and reporting problems
For help with AI, staff contact our AI Ops team at AiOps@four.agency or use the AI channel on the Everyone at Four team in Microsoft Teams.
Staff tell AI Ops and our information technology (IT) team straight away if they put information into the wrong tool. They do the same if they lose access to an AI account or if AI output that someone has shared or published contains an error. If the problem may involve personal data, they follow our data breach procedure at once. The law sets a 72-hour deadline for reporting some breaches to the regulator.
Breaking this policy may lead to disciplinary action.
Review
We review this policy and the AI tools register every quarter. The Head of AI leads each review with the AI Council and keeps a short record of what we checked and changed.
Changes to the register, such as adding or retiring a tool, take effect when the Head of AI approves them. Changes to this policy need the Group chief executive's approval and a new revision number. We also review the policy sooner after a significant change in the law, in a supplier's terms or in the tools we use.
Revision history
First issued in November 2023. Revision 7 approved on 1 October 2026.