In most hotel groups the first AI use nobody planned was a general manager replying to reviews with a free tool, because it was faster than writing them by hand. Head office hears about it later and wants to know what else those accounts can reach. A hotel group's AI policy has to answer that question across every property, including the ones with the busiest front desks and the most turnover.
The first rule: guest payment and identity data
Card numbers, passport and identity scans and registration cards never go into an AI tool on any account or for any reason. The card payment industry's security standard does not mention AI by name. Because its requirements apply to any system that touches card data, the only safe design keeps AI out of that scope entirely. Put the rule first, in one sentence that a night manager will remember.
Five parts that carry more weight
The structure is the same as any AI policy, set out in what an AI policy should contain. These are the parts where a hotel group's version differs.
Guest data beyond payments
Names, stays, preferences and complaints are personal data, and a guest's dietary or access needs can be health information, which carries a higher bar. Guest records belong in the data list with a default of no outside the approved tools, and AI and data protection covers the checks behind that line.
Review replies and guest messages
Replying to reviews is a good use of AI and usually the first one a group approves. When a group approves it, the policy should say which tool, on which account and what a reply never does: promise compensation, admit fault on the group's behalf or repeat a guest's personal details in public.
Shared accounts at the properties
Front desks run on shared logins and high turnover, which is where an AI account ends up belonging to nobody. Every AI account at a property should be a company account tied to a named person or a defined role, removed when that person leaves, and the leaving process at each hotel has to include it. Until joiners and leavers are handled reliably, widening AI to the properties widens every access gap they already have.
Guest-facing AI
On the website, a booking assistant or chat talks to guests directly. Tell guests when they are dealing with AI, give them a route to a person and never let it take card details in the conversation. Some places require that disclosure in law, so take advice on where your guests are.
Who decides, head office or the hotel
Properties should not buy their own AI tools. Head office approves tools, holds the register and owns the policy, and each property has a named person who makes sure it is followed. Where a brand, an owner and an operator are three different businesses, check whether the brand or management agreement already sets rules on data and systems, because the policy has to sit inside them.
Head office first
The order that works is head office, then one property, then the rest. Head office has the most to gain and the fewest shared accounts, and the first property shows what the leaving process and the permissions review need to fix before the others follow.
Where this fits
The policy is written in a half-day with the group's leadership as the first output of Govern, and the readiness snapshot shows which free tools are already replying to reviews and on whose accounts. How the route plays out for a group, including the candidates where a plain workflow does the job, is on the hotels page.