Restrict the affected AI use, identify the actual requirement and give the work a permitted route while the responsible owners resolve it. A company-approved tool does not settle every customer engagement. Customer approval can also leave a separate supplier's restrictions unresolved.
Make the decision about the information, operation and deliverable involved. “AI is allowed” and “AI is banned” can both hide important conditions. A rule about training on customer data differs from a rule about uploading it, generating a draft or sending an answer automatically.
For an account owner working with procurement and legal colleagues, the useful result is a clear instruction the employee can apply. It should say what may proceed, what must wait, who resolves the open question and what alternative keeps the delivery realistic. Employees should not have to improvise an interpretation of several agreements under a deadline.
Translate the restriction into a work decision
Start with the applicable agreement, policy or instruction and its current version. Identify the customer, supplier, service and material it covers. If the wording is unclear, preserve that uncertainty for the responsible commercial, legal or information owner to resolve.
Separate the questions rather than treating every restriction as the same prohibition:
| What the requirement concerns | Question for the proposed work |
|---|---|
Inputs | May these customer records, supplier files or licensed assets enter this service? |
Processing and reuse | Does the permission cover drafting, analysis, retention, training or another use? |
Outputs and actions | May AI assistance appear in the deliverable, and who may send or publish it? |
Conditions and evidence | Is prior approval, a particular account, human review or a specified record required? |
A narrow restriction must not be quietly widened into a company-wide ban. Equally, a narrow permission must not become approval for every input or later use. Have the appropriate owner resolve the actual scope before the disputed work begins.
Cushman & Wakefield's supplier AI terms, checked October 26, 2026, provide a concrete customer-side example. Their consultancy section requires written approval of both the tool and use case. It separately addresses authorization to put customer data or materials into an approved AI tool. That is a particular customer's published arrangement, with its own scope and qualifications, rather than a universal rule for consulting work.
The employee-facing instruction should reflect the decision reached for your engagement. Use the acceptable-use policy guide for the wider organizational rules, then make the customer-specific conditions easy to find alongside the task.
Check the supplier side of the permission too
Customer consent answers only the question that customer has authority to resolve. Your company may also be using a supplier's photographs, research, software, source files or other licensed material. Find the applicable rights and conditions for that material before including it in the proposed AI step.
For example, the Getty Images content licence, updated April 2026, contains an AI-use restriction and specific exceptions for creative content, including internal archiving, searching, indexing or sorting and permitted editing. It separately excludes training and other model data ingestion from those exceptions. Read the applicable licence and any specific authorization with the rights owner. “All AI use is forbidden” would lose the qualifications; “we licensed the picture” would lose the restriction.
This is why a customer's enthusiasm for AI-assisted work cannot settle every permission in the workflow. Nor does removing customer names settle a supplier's restriction on its material. The question may concern the work being processed, the purpose or the rights granted, even where personal information is absent.
An account owner can collect the relevant documents and describe the intended operation. The authorized owners decide what the agreements permit and whether an additional permission or different arrangement is needed. Keep a disputed interpretation open rather than asking an employee to choose the most convenient reading.
Preserve a useful route around the affected step
Suppose Claire Bennett leads a commercial property marketing team. Sam Taylor manages a customer's tenant brochure. The customer has approved AI-assisted wording from an agreed property fact sheet in the team's approved work account. Separately supplied photographs are licensed for the brochure, but the team has not resolved whether the proposed AI image variations are permitted.
Sam needs a brochure with accurate property details and usable images. Uploading the entire brochure folder to generate variations would mix the approved text task with the unresolved photo use. The customer saying “use AI to speed this up” does not close the supplier-rights question.
Keep the work separated:
The same brochure has two permission questions
Stay within the approved text task
The customer has permitted drafting from the agreed facts in the work account. Claire’s reviewer still checks the property details before delivery.
Hold the unassessed AI image changes
Sam needs the supplier-rights decision. An ordinary layout using the supplied photographs is an alternative only if its own permission and delivery conditions are confirmed.
The text reviewer still checks floor area, facilities and stated availability against the approved facts. A fluent draft must not invent a feature or promise a date. The ordinary layout route also needs to stay within the photo licence; omitting the AI variation does not create new reuse rights.
If a permitted route uses the licensed photographs as supplied, Sam can plan that delivery while the rights owner assesses the separate variation request. If the route is not yet confirmed, keep it conditional and agree a realistic next update. Do not promise unchanged scope and timing before checking whether the alternative can deliver them.
The service-continuity guide explains how to rehearse an alternative with the people who will use it. Here, the trigger is a permission constraint rather than an outage. The practical question is still whether the alternative can produce an acceptable result with the available information, people and time.
Take a specific exception request to the right owner
A useful request describes the disputed operation and the permission it needs. “Can we use AI for this client?” gives the decision maker too little to assess. Include the actual input, service, purpose, expected output and the requirement that appears to constrain it.
In a September 2026 Reddit discussion, a user describing work at a DevOps and infrastructure consultancy said their team checked client agreements and statements of work for AI language. They also described tailoring the work description to the engagement. In a follow-up, they distinguished a report-only assessment from delivering infrastructure code. The organization and results were unverified, but the practical detail matters: the proposed AI work can change materially between engagements at the same company.
Give that review a clear sequence:
- Describe the affected use. Sam identifies the supplier photographs, proposed image-variation service and intended brochure output, separately from the approved wording task.
- Locate the unresolved condition. Attach the applicable terms and the specific question. Have the commercial or rights owner establish who can authorize the proposed use.
- Choose the working arrangement. Obtain the required decision, revise the proposal or use a confirmed alternative. Keep the affected use on hold while approval is missing.
- Translate the result into instructions. Record permitted material and operations, account, reviewer, conditions and the next review trigger where employees actually do the work.
An internal exception process can resolve your own policy questions. It cannot, by itself, grant a customer's consent or a supplier's rights. If a needed party declines the request, revise the work or delivery arrangement through the responsible owner. Do not treat silence, a deadline or an employee's paid subscription as authorization.
When the uncertainty concerns the AI service's handling of information, use the vendor evaluation guide to establish the assessed product, configuration and applicable assurances. A promise about model training still needs to be checked against the actual use and other commitments.
Keep the delivery record consistent with the decision
Save enough information to explain the working arrangement without copying restricted material into another unnecessary record. The account owner should be able to locate:
- The decision and authority. Who resolved which requirement, for which engagement and version of the proposed use.
- The permitted route. Allowed inputs, operations, account and review, plus the instruction for excluded material.
- The open work. Missing permission, alternative-delivery condition or remaining service-assessment question, with an owner and next update.
- The change trigger. A different input, service, processing purpose, recipient or deliverable that needs another decision.
Check any required disclosure with the responsible owner and communicate accurately about the work actually performed. A disclosure that AI was involved does not supply missing permission. A no-AI commitment must also match the route used, including relevant features inside familiar software.
For Sam's brochure, the record should not describe approved AI image generation while the photo question remains open. It should distinguish the permitted wording task, the intended ordinary photo placement and the held variation request. That distinction makes a later change visible to the people doing and checking the work.
Choose one live engagement and ask the employee to explain the current route from that record. If they cannot identify the permitted input or next owner, repair the instruction before expanding the use. Return to the tools and workflows guide for the broader approval, support and maintenance arrangement.
Questions about customer and supplier AI constraints
Does customer approval override a supplier's AI restriction?
Do not assume that it does. A customer may approve AI assistance for its engagement while a separate supplier or rights holder controls the proposed use of particular material. Identify both permissions and have the authorized commercial or rights owners resolve the actual agreements. The supplier-side review explains why approval of a deliverable can leave an input restriction unresolved.
Is a private or no-training AI service enough?
A private arrangement or no-training commitment may address a relevant concern, but it does not settle every customer or supplier condition. A restriction may cover uploading material, producing a particular output or using AI at all for the affected task. Verify the actual service, terms and configuration with the responsible owners, then obtain the required use decision. Do not infer permission from a privacy label alone.
Can disclosure replace prior permission?
Disclosure and permission answer different questions. A statement describing AI assistance does not establish that the input, processing or deliverable was authorized. Identify the applicable requirement before proceeding and ask the responsible owner what approval and disclosure are needed. Describe the actual use accurately when reporting it; do not use a generic disclosure to cover an unapproved operation.
What should employees do while an exception is unresolved?
Hold the affected use and follow a confirmed permitted alternative, if one exists. Name the decision owner and next update, and check whether the alternative changes scope, quality, capacity or timing. Avoid sending the disputed input to another tool as a workaround. The brochure example shows how one part can remain conditional while another has a defined permitted scope.
What if restricted material has already entered an AI tool?
Stop further sharing through the affected route and use the organization's established incident or concern channel. Give the responsible team the relevant task, material, account, timing and known actions without spreading the material unnecessarily. Let authorized owners assess containment, records and any required communication. Do not claim that deleting a chat has resolved every retained copy or obligation, or start an unauthorized deletion to hide what happened.
