What Do Agency Account Managers Need to Know About AI Legal Risks?
Quick answer
Agency account managers are on the front line of AI risk conversations with clients, whether they realise it or not. Questions about confidential data in AI platforms, tool usage by freelancers, IP ownership of AI-generated work, and client consent are all landing on account managers’ desks - often before anyone has worked out the answers. Agency lawyer Sharon Toerek, founder of Toerek Law, describes the AM role as “strategist, therapist and teacher,” and says AMs don’t need to become lawyers. They need to know enough to spot a potential issue, start the conversation, and bring in the right people. This post covers six practical areas every account manager should understand right now.
AI risk and legal liability is becoming an account management conversation - and most account managers are not prepared for it.
I recently interviewed agency lawyer Sharon Toerek, founder of Legal+Creative/Toerek Law, for the Creative Agency Account Manager podcast to help AMs get to grips with this. The questions agencies and clients need to be asking are sometimes uncomfortable, but it is important to have answers ready:
● What happens to confidential client information when someone puts it into an AI platform?
● What AI tools are your freelancers using?
● Who owns work that is partly AI-generated and partly created by humans?
● Does your client actually know how your agency is using AI on their business?
“The client conversations that occur around it are definitely an AM issue because you're the face of the agency before the brand.”
You do not need to become a lawyer. You do need to know enough to spot when there is a potential issue, start the conversation, and bring in the right people.
Sharon described the account manager role as “strategist, therapist and teacher.” The teacher part is becoming particularly relevant as agencies and clients work out how they want to use AI together.
1. Keep checking your client’s appetite for AI risk
One of the most striking things I am seeing across agencies is huge variation in how clients feel about AI.
Some clients have been very restrictive. A medcomms agency account director explained their pharmaceutical client has expressly asked for no AI to be used at all. At the same time, at the PharmaBrands Europe Age of AI Conference in April 2026, pharmaceutical companies were sharing AI agent use cases and expecting their agencies to lead the charge.
Those positions keep changing. And they vary from client to client, project to project.
“A case by case discussion with the clients about tool usage and a check-in on risk tolerance.”
Sharon’s “case by case” framing matters. A contract might have been signed months ago. It does not necessarily tell you how the client feels about a new tool being used on a new project today.
So if you are scoping a piece of work where AI is going to play a significant role, ask:
● What tools are acceptable?
● What data can be used?
● Are there restrictions you need to know about?
● Does anyone else inside the client organisation need to approve the approach?
And do not assume a change of client contact means a continuation of the same position. One agency I work with recently found a new client contact with a much higher level of AI proficiency who was actively drilling down into how AI was being used across all their suppliers.
The safest rule: do not assume the MSA covers each individual new project type.
2. Find out what your team is doing with client information
This was probably the most immediately practical part of my conversation with Sharon.
“Imagine dumping any part of that brief that you've received from the client into an AI platform without properly anonymising it or having one of your freelancers put it into their free level ChatGPT account or Claude account.”
“You've automatically put the confidentiality at risk.”
Think about how easy that is to do. Someone wants help summarising a brief, analysing research, or generating ideas, and they copy and paste client information into an AI tool without realising they have jeopardised the agency’s legal contract terms with the client.
The same applies to freelancers, contractors and other partners working on the account. Sharon noted she has spoken with agencies who simply did not know enough about what their external partners were doing:
“It's less that they know they have a problem than that they know that they don't know whether they have one or not.”
That is a useful question for any account manager to ask their team right now: do we actually know what tools everyone working on this account is using?
If the answer is no, that is where to start.
Gartner predicts that by 2030 more than 40% of enterprises will experience security or compliance incidents linked to unauthorised shadow AI. That is not a distant problem.
3. Don’t assume a general AI clause in the contract covers everything
Sharon made a really practical distinction around contracts that account managers need to understand.
“It's great to have a blanket provision in your master service agreement around your use of AI, but a one size fits all isn't always going to eliminate those difficult conversations with the clients.”
Her suggestion is to use the Statement of Work as another point to have the conversation:
“The SoW is a great juncture... We're doing a new project. We want to use a new tool. We want you to acknowledge that this new tool might create this new risk. We've mitigated it the best we can.”
This is directly relevant to account managers, who are often involved in scoping work and agreeing how deliverables will be produced. If the team wants to introduce an AI tool that processes client data or plays a significant part in the final output, the Statement of Work is the moment to have that conversation.
Do not leave it until after the work has started.
4. Understand “yours, ours and somebody else’s”
Account managers need at least a basic understanding of intellectual property, and Sharon has a simple framework for thinking about it: “Yours, ours, and somebody else’s.”
In practice:
Yours: the work the client is paying for and intends to own.
Ours: the agency’s own processes, methodologies, systems or other IP that it needs to retain.
Somebody else’s: third-party assets such as stock photography, fonts and AI-generated material.
This matters because agencies are increasingly looking to monetise their expertise rather than simply selling hours. An agency might have developed a methodology, framework, diagnostic tool or training programme that it uses across multiple clients. Sharon’s warning was clear: you can accidentally give too much away in a client agreement.
“If this is something that you'd want to be able to use again to deliver work in your area of specialty to another brand or client you just have to knuckle down and hold your position on it.”
So if you are involved in conversations about ownership of the work, know when to ask: is there anything here that belongs to the agency and needs to stay with us? That question is only going to become more important as agency business models change.
5. If ownership matters, document the human contribution
AI-generated work creates a complication that is new to most agencies: what happens when the final deliverable contains a mixture of machine-generated and human-created work?
“The best advice we can give agencies right now is you need a very clear way of documenting what the human contributions have been to the final deliverable.”
When I asked what that looks like in practice, her answer was:
“That's down to project management, careful documentation of how you've put the deliverable together.”
Yes, she knows exactly what you are thinking. Who has time for that?
Her point was that if ownership matters - to the agency or the client - then documenting the work becomes part of the process. For account managers, the practical question is: does ownership of this deliverable actually matter?
If it does, make sure the people managing the work know what needs to be recorded. If it does not, establish whether the same level of documentation is really necessary. Either way, it is worth asking the question before the work starts rather than after it is finished.
6. Get comfortable saying “I think we need to check this”
This is probably the most important habit any account manager can build right now.
Sharon repeatedly returned to the value agencies can add simply by raising these issues proactively. She was clear about the boundaries:
“It's not your job to be your client's legal counsel. They've got their own teams for that and their own resources for that.”
But she was equally clear about the opportunity:
“Boy, will you look like a hero and also like a forward-thinking organisation if you surface these as things that the brand needs to be thinking about.”
Your client probably does not expect you to know the legal answer. They will value you spotting the potential question. For example:
“I think we should check whether your legal team is comfortable with us using this tool.”
“We’re planning to use AI in this part of the work. Before we start, can we confirm that fits your current policy?”
“This part of our methodology is agency-owned IP, so I want to make sure we’ve reflected that correctly in the agreement.”
=“We’re using customer data here. Have we checked the implications before we put it into this platform?”
Those are good account management conversations. They are also a long way from blindly getting the work done and hoping someone else has thought about the risks.
Where should account managers start?
At the end of our conversation, I asked Sharon for her final practical advice.
“Audit your contracts if you haven't done it in a while. Audit your AI policies and practices if you haven't done it in a while.”
“Articulate what those policies are. What do you want your teams to know about AI usage? What do you want your clients and the rest of the world to know about the way you're using AI?”
“Progress, not perfection. So start there.”
That seems more manageable than trying to have everything sorted immediately. The tools are changing fast. Client policies are changing. Agency use cases are changing.
But there is a meaningful difference between having some unanswered questions and having no idea what questions you should be asking.
If you are managing accounts today, here is a checklist worth working through for each priority client:
What is this client’s current position on AI?
What tools are we actually using on their account, and what licences do we have?
Do our freelancers and partners follow the same rules? Are we confident they are not using their own free AI tools on our client work?
Are we putting confidential information or client data into those tools? What is the AI tool’s policy for holding or processing that data?
Does the client know how we are using AI on their work?
Is there agency IP involved that we need to protect?
Does ownership of the final work matter enough that we should document how it was created?
Is there anything here where I need to say “I think we should check this”?
You do not need the legal answer to every one of those questions. You need to notice when the question needs asking.
That is exactly what Sharon means by the modern account manager being a strategist, therapist and teacher.
Summary
AI legal risk is now an account management conversation, whether agencies are ready for it or not. Account managers need to understand six areas: checking client appetite for AI risk on every project, knowing what tools their team and freelancers are actually using, understanding that a general AI clause in the MSA does not cover every new project, applying the “yours, ours and somebody else’s” IP framework, documenting human contributions when ownership of a deliverable matters, and building the habit of saying “I think we need to check this.” As Sharon Toerek puts it: “Progress, not perfection.” Start with the checklist above and work out which questions you cannot currently answer.
FAQ
What AI legal risks do agency account managers need to understand?
The main areas are: confidential client data being put into AI platforms without proper controls, freelancers and contractors using AI tools the agency has not approved, IP ownership of AI-assisted deliverables, and whether clients have actually consented to the way AI is being used on their work. Account managers are the face of the agency and are increasingly the ones having these conversations with clients first.
Do account managers need to become legal experts on AI?
No. As agency lawyer Sharon Toerek puts it, account managers need to know enough to spot when there is a potential issue, start the conversation, and bring in the right people. The value is in noticing when a question needs asking, not in providing the legal answer.
What should account managers ask clients about AI on every new project?
At minimum: what tools are acceptable, what data can be used, whether there are any restrictions in place, and whether anyone else inside the client organisation needs to approve the approach. These questions should be asked at the scoping stage, not after work has begun.
Does a general AI clause in the master service agreement cover everything?
Not always. Sharon Toerek’s advice is to use the Statement of Work as an additional point to raise AI tool usage, especially when introducing a new tool or when AI plays a significant role in the final deliverable. The MSA may have been signed months before the specific project and may not reflect the client’s current position.
What is the “yours, ours and somebody else’s” IP framework?
A simple way of categorising intellectual property in agency work. “Yours” is the work the client is paying for and intends to own. “Ours” is the agency’s own methodologies, processes and IP it needs to retain. “Somebody else’s” covers third-party assets including AI-generated content. Account managers involved in contract or scoping conversations should know when to ask whether any agency IP needs to be protected.
What does Gartner predict about AI security incidents?
Gartner predicts that by 2030, more than 40% of enterprises will experience security or compliance incidents linked to unauthorised shadow AI. This makes it important for account managers to know what tools everyone working on a client account is actually using, including freelancers and external partners.
How should account managers document AI use on client work?
Sharon Toerek’s advice is to have a clear way of recording what human contributions have been made to any deliverable that contains AI-generated content. In practice this means project management and careful documentation of how the work was put together. It is most important when ownership of the final deliverable matters to the agency or the client.
Listen to my full conversation with Sharon Toerek on the Creative Agency Account Manager podcast. And if you want to build the skills to handle these conversations with confidence, find out more about the Account Accelerator programme.
How confident are you that every account manager in your agency could have these conversations with a client today?
