AI policy

Position

I use AI extensively in my work, and I'm transparent and cautious throughout. Writing about AI governance is also part of what clients hire me for - policy frameworks, capability assessments, and evaluation rubrics for organisations adopting AI, including cross-domain reconciliation, and regulated environments where the cost of getting it wrong can constitute a serious breach. So this document does two jobs. It's the policy VCC actually operates under, and it's a fair sample of the standards I hold client governance to.

Scope

This policy covers work delivered through Visual Content Consultancy: client engagements, content production, thought leadership, and this website. I hold board and advisory roles at other organisations; each of those operates under its own governance, and where I've helped write it, the same principles apply. Where a client's own AI policy is stricter than mine, theirs wins inside their engagement.

How I use AI in client work

Discovery, audits, and research

AI accelerates research, competitive analysis, and opportunity mapping (and tracking) - it helps me cover far more ground than I could alone, and track multiple interdependent factors, both real and synthetic. It helps me model predictions, refine vision and direction, and test hypotheses. Every recommendation that reaches a client has been through my multi-modal evaluation frameworks, and through my judgement, and I can explain the reasoning and strategy throughout. Strategy is tested with cognitive friction - not just 'best practice'.

Content production

For clients who need AI-augmented content, I use specific generative AI across imagery, video, spatial, audio, and text - including custom models, datasets, LoRA models, and AI-assisted production workflows. Every generated asset is identified (and agreed) with the client before production and delivery, with a record (heritage) of how it was developed and produced.

Strategy and frameworks

AI assists with theory, drafting, structuring, and refining strategic documents. The thinking, positioning, and recommendations are mine.

Automation and integration

When I help clients integrate AI into their operations, I build frameworks that are transparent, auditable, and designed to be run by their own teams. No black boxes, no SaaS dependency, and no dependency on me to keep it running.

Client data

This is the section most policies leave vague, so here are the commitments in plain terms:

• No client material in consumer AI tools. Client documents, datasets, and commercially sensitive information go only into enterprise-grade, data-isolated deployments, and local MCPs - tools where inputs aren't retained for training and access is fully controlled.
• No training on client data without written consent. Where an engagement involves building custom models, rubrics, or datasets from client material, ownership, usage rights, and boundaries are agreed in writing first.
• Confidentiality survives the tooling. NDAs and engagement terms apply to AI workflows exactly as they apply to everything else. Where confidentiality demands it, I run models locally or on infrastructure the client controls. My architectures aren't tied to any single vendor's tooling.
• Minimum necessary data. My AI workflows get the material they need for the task - which is anonymised or reduced to factored data where the task allows it.

Personal data handling, including what this website collects, is covered by the privacy policy.

Quality and evaluation

All AI outputs are checked, and the checking is designed (and recorded) rather than ad hoc:

• Human review before anything reaches a client. No AI output goes to a client unreviewed. For strategy and advice, that review and cognitive friction is the work.
• Evaluation rubrics for repeated workflows. Where AI runs as part of an ongoing pipeline, output is assessed against defined criteria - the same evaluation discipline I build into client programmes.
• I use multiple models, deliberately. I cross-check significant outputs across different models and use 'switching frameworks' to reduce single-model bias and error propagation.
• Provenance for generated assets. Generated imagery and video carry a record of what produced them, so a client can answer "where did this come from?" with evidence.

Content labelling

I label content I produce, and content I help clients produce, on a four-step ladder. It's built to satisfy the transparency obligations in the EU AI Act (Article 50) and the direction of UK guidance, ahead of being required to:

Where I draw the line

There are things VCC won't do with AI:

• Deepfakes without consent - I won't create synthetic content of real people without their explicit, informed, and licensed permission.
• Undisclosed generation - I won't pass off AI-generated work as entirely human-made. Clients (and their clients) always know what's AI and what isn't.
• Replacing thinking with prompting - I won't hand over vision, thought, strategy, or recommendations I haven't critically evaluated. A model's output is a starting point, and synthetic sparring partner, not an answer.
• Automating past accountability - I won't build a client workflow where nobody can say who's responsible for the output. Every framework I deliver names its human owner (through-the-line stakeholder accountability).
• Bias without mitigation - I actively work to identify and reduce bias in AI outputs, wherever it sits - through model diversity, human review, and evaluation against defined criteria. That includes the client's own source data: years of unnoticed skew in departmental records will reproduce themselves faithfully in anything trained on them, so correcting the data comes before connecting it.

Regulation

I track the regulatory landscape as part of the job: global AI sentiment mapping, market- and sector-specific legislation, the EU AI Act and its transparency obligations, UK guidance as it develops, and the sector rules that bite hardest in regulated industries. I've built AI governance documentation that was adopted as internal policy inside enterprise organisations, and workflows updated to EU AI Act Article 50 compliance. When regulation moves, these policies (and this policy) move with it - that's what the quarterly review is for.

This website

This site was built with AI assistance. The code was developed using AI-assisted workflows. The written content is my own thinking, structured and refined with AI tools to track and adapt to change - AI-assisted, on the ladder above. The design direction, strategy, and editorial decisions are human. The abstract artwork across the site is generated by code from the brand's own design system - drawn line systems and gradient fields, not model output. Where photography or AI-generated imagery appears, it's labelled or self-evidently sourced.

Client agreements

Every engagement starts with a conversation about AI: where the risk landscape sits, what you already align to, what I plan to use, why, what the alternatives are, and what it means for their data. The agreed approach goes into the scope of work in writing. If a client doesn't want AI involved in their project, we don't use it - that's respected completely.

Governance and review

This policy has an owner - me - and a cycle. It's reviewed quarterly, and immediately when something material changes: new regulation, a significant model or tooling shift, or a gap found in practice. Versions are dated so you can see when it last moved. A policy nobody revisits is just window dressing - not compliance.

If you're reading this as a prospective client

Good - that's partly why it's public. Frameworks like this are part of what I build: AI policy, governance structures, capability assessments, and evaluation rubrics that fit how your organisation actually works. If your organisation doesn't have one yet, or has one nobody follows, that's a conversation worth having. Ask anything about this policy through the contact form - I'd rather have that conversation than state 'we have an AI policy and a team'.