Your CSMs are already pasting customer notes, call transcripts and renewal details into AI assistants, whether or not you have a rule about it. This guide gives you a practical AI policy for customer success teams: what data may go where, which tools are approved, how to review output, and a one-page template you can adapt this week.

A policy does not need to be long or legal-sounding. It needs to be short enough that a CSM can apply it in the ten seconds before they paste something.

Why customer success teams need an AI policy

Customer success sits on some of the most sensitive data in a B2B company: contract values, renewal terms, internal sentiment about named people, escalation history and sometimes personal data about your customers' employees. AI assistants make that data easy to move. A CSM who asks an assistant to "summarize this account before my call" may be sharing all of it with a third-party service.

Three risks are worth naming plainly:

  • Data exposure. Sensitive details end up in a tool your company has not vetted, under terms you have not read. The OWASP list of top risks for LLM applications ranks sensitive information disclosure among its leading risks, alongside prompt injection.
  • Untrusted content steering the model. Prompt injection happens when crafted text, for example inside a web page or an email you ask an assistant to summarize, tries to change what the model does. OWASP ranks it first on its LLM list. This matters most when an assistant can take actions, not just write text.
  • Confident mistakes. Assistants can state wrong facts fluently. A wrong renewal date or an invented commitment in a customer email is a CS problem, not just an AI problem.

Regulators are also paying attention. The European Data Protection Board's opinion on AI models addresses when a model can be considered anonymous, when legitimate interest can be a legal basis, and what follows when personal data was processed unlawfully. It is not a CS playbook, but it is a reminder that "we pasted it into a chatbot" is not a neutral act if the data includes personal data of EU residents. For a broader risk framework, NIST's Generative AI Profile is voluntary guidance that companion-pairs with its AI Risk Management Framework and lists risks specific to generative AI. This article is general information, not legal advice; involve your security or legal contact for your own policy.

Step 1: Classify your customer data in three tiers

Do not try to list every field. Use three tiers that everyone can remember.

  1. Green: fine to use. Public information: the customer's website, press releases, public job postings, your own product documentation.
  2. Amber: use only in approved tools. Account context that is business-sensitive but not personal: usage trends, health score bands, renewal dates, plan names, ticket themes with names removed.
  3. Red: never paste into an AI tool without explicit approval. Credentials and API keys, payment details, contract pricing and legal terms (unless your approved tool is cleared for it), personal data beyond a business contact's name and role, health or financial information about individuals, and anything covered by a customer's confidentiality clause that prohibits sharing.

When in doubt, a CSM treats the data as one tier more sensitive than it looks.

Step 2: Decide which tools are approved

"Approved" should mean someone checked it. Before you add a tool to the list, get answers to these questions from the vendor's documentation or contract:

  • Is your data used to train the vendor's models? Can you opt out, and is the opt-out the default for business plans?
  • Where is data stored and processed, and who are the sub-processors?
  • Is there a data processing agreement that fits your GDPR obligations?
  • How long are prompts and outputs retained, and can an admin delete them?
  • Can admins control who has access and see an audit trail?

Keep the result as a short table: tool, who may use it, highest data tier allowed, and the date it was last reviewed. Personal accounts on free consumer plans should default to "green data only."

Step 3: Prefer connecting AI to the system of record

Copy-pasting is where most leaks happen. A cleaner pattern is to let an assistant read from your CRM directly, with the permissions of the signed-in user, instead of exporting data into a chat window. That keeps access controlled in one place and avoids stale copies of customer data floating around in chat histories.

This is how the AI connector in XPI CRM works: it acts as the signed-in user with their permissions, it cannot delete anything, and every change it makes shows in History. You can see how to set it up in the AI connection guide. Whatever CRM you use, ask the same questions: does the assistant inherit the user's permissions, are writes limited, and is there an audit trail?

Step 4: Set review rules for AI output

AI drafts are inputs, not outputs. Make the review rules explicit:

  • Anything sent to a customer is read and edited by a human first. No exceptions for "quick" emails.
  • Numbers and dates are checked against the source. Renewal dates, ARR, ticket counts and contract terms come from your CRM, not from the model's memory.
  • No commitments from the model. Discounts, roadmap promises and SLAs are never accepted from a draft without the owner's approval.
  • Read-only first. When you connect an assistant to live systems, start with read-only tasks (summaries, prep) before allowing changes.
  • Treat outside content as untrusted. If an assistant is summarizing an inbound email or web page, do not let it trigger actions on its own.

For prompt ideas that fit these rules, see AI prompts for customer success managers, and for recorded calls specifically, AI call summaries for customer success.

Step 5: Handle customer-side concerns

Larger customers increasingly ask how you use AI with their data. Prepare a two-sentence answer in advance: which tools are approved, what data tier they may touch, and where your vendor stores data. If you have a signed data processing agreement with each vendor, say so. Add AI use to your security questionnaire answers so sales and CS give the same response.

Copyable template: one-page AI use policy for CS

AI USE POLICY - CUSTOMER SUCCESS
Owner: [name]          Last reviewed: [date]

1. PURPOSE
We use AI assistants to save time on research, prep and drafting.
We do not use them in ways that expose customer data or
replace our judgment.

2. APPROVED TOOLS
Tool | Who may use it | Highest data tier | Last reviewed
[Tool A] | All CS | Amber | [date]
[Tool B] | CS leads | Amber | [date]
Anything else: Green data only.

3. DATA TIERS
Green: public information
Amber: account context without personal data
Red: credentials, payment data, contract pricing/terms,
     personal data beyond business contact name and role,
     anything under a customer confidentiality restriction
Red data is never pasted into an AI tool without written approval.

4. REVIEW RULES
- A human reads and edits everything sent to a customer.
- Numbers and dates are checked against the CRM.
- AI never makes commitments (pricing, roadmap, SLAs).
- Connected assistants start read-only.
- Content from outside sources is treated as untrusted.

5. INCIDENTS
If you pasted something you should not have, tell [owner]
within one working day. No blame; we fix the process.

6. REVIEW
This policy is reviewed every [6] months or when a new tool
is added.

Rollout checklist

  • Pick one owner for the policy (usually the head of CS with a security contact)
  • Review each AI tool you already use against the vendor questions in Step 2
  • Agree the three data tiers and give two examples of each
  • Fill in the template and publish it where CSMs work, not in a forgotten drive folder
  • Run a 20-minute team session with three real examples: one green, one amber, one red
  • Add a standing line to your customer security questionnaire answers about AI use
  • Put a recurring reminder in the calendar to review the policy

Common mistakes

  • Banning AI outright. People keep using it, just out of sight. A clear allowed path beats a ban nobody follows.
  • A policy nobody can recall. If it takes more than a page, it will not be applied.
  • Forgetting browser extensions and meeting bots. These often process data automatically. Include them in the tool review.
  • Skipping the incident rule. A no-blame way to report mistakes is how you learn about problems early.

Try it in XPI CRM

If you want AI assistance without copy-pasting customer data into chat windows, XPI CRM's AI connector works with Claude, ChatGPT, Gemini, Grok, Microsoft Copilot, Cursor and VS Code, acts with the signed-in user's permissions and logs changes in History. Data is stored in the EU (Ireland), and a GDPR Data Processing Agreement is available. Start free — every feature included, no credit card.