A client brief lands in the shared drive. It ends up in a personal AI account that appears on no approved list, because no list exists. The draft goes to the client. Nobody has defined who reviewed it, or what they checked.
Two weeks later, procurement sends a questionnaire: which AI tools process our data, who reviews the outputs, can you show your policy? Sales answers one way. Delivery answers another.
The risk shows up in three places: client confidentiality under the GDPR, your contractual duty to the client, and an RFP answer you cannot give twice the same way. A fourth cost shows up in the P&L. When AI produces output faster, the time moves to senior review and rework — and nobody bills it.
A charter closes these gaps when it answers the right question. Two public documents show which one that is.
2 charters, 2 questions
In February 2026, the French government’s information service published a charter for State communicators. It sets 12 rules under three principles. Rule 2 keeps sensitive, confidential and personal data out of AI requests. Rule 3 limits AI connections to internal resources to the strict operational need and prohibits dangerous automation; AI-generated content must be validated by a human before it is integrated into internal systems. Rule 6 requires verification of the source and quality of data, while Rule 7 makes the final decision to use an AI output a human decision, every time. The charter also applies to the State communicators’ partners and contractors.
A template hosted by NIRSONLINE takes a different route. It defines an AI Governance Committee with seven officers plus up to five rotating members. The committee meets at least quarterly, approves tools and use cases, and can terminate any AI use at any time.
The first document tells each person what they may do. The second tells the organisation who decides. A marketing department will not staff a seven-officer committee, but it can write a usage charter and name one referent this month.
One test to guide you while writing your AI charter: can a copywriter apply the rule without asking anyone?
The compliance questions your charter must trigger
If your work reaches EU clients or audiences, four texts shape what the charter needs to address. This is not legal advice; your counsel should validate the legal analysis for your contracts, clients and jurisdictions.
GDPR, Article 5. Personal data must be processed lawfully, fairly and transparently, with integrity and confidentiality. A CRM export, lead list or client contact sheet pasted into a consumer tool is a processing operation. The French government charter likewise ties AI use to GDPR principles including transparency, data minimisation, storage limitation and security.
AI Act, Article 2. The Act can reach organisations outside the EU, including when their AI systems are placed on the EU market, put into service in the EU, or when their output is used in the Union. A US or UK agency running campaigns in Europe should determine whether it acts as a provider, deployer or another regulated actor before assuming the Act does not apply.
AI Act, Article 4. (Omnibus) Providers and deployers must take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The obligation has applied since 2 February 2025. A short charter plus a role-based training session gives you a measure you can document.
AI Act, Article 50. Transparency duties for certain systems — including some chatbots and synthetic content — have applied since 2 August 2026. Whether a particular deliverable triggers them depends on the system, the use and the audience. The charter does not answer that question; it names who asks it, who decides and who documents the answer.
Where AI touches a marketing workflow
The charter has to give each use the level of care it deserves. Over-restricting ideation sends people back to personal accounts.
| Use | Example | Vigilance |
|---|---|---|
| Ideation and research | Topic brainstorming, editorial angles, article outlines | Low, as long as no confidential data goes in |
| Writing and SEO | Titles, meta descriptions, rewrites, ad variants | Human review and fact-check required |
| Data analysis | Performance summaries, recommendations, reporting | Validated professional tool; anonymise where needed |
| Visual creation | Social visuals, mockups, illustrations | Check rights, brand and visual bias |
| Client relations | Template replies, emails, proposals | No client personal data without a validated tool; validation before sending |
| Web development | Code, integrations, automations | Technical review; security and IP checks |
The 6 blocks
1. Scope
Name who is covered: employees, freelancers, interns, apprentices, contractors and subcontractors. Cover AI built into software already in use — CRM, office suite, SEO tools, ad platforms — not only chat assistants.
Embedded features arrive through a software update, with no one deciding to adopt them. Make that explicit:
Embedded AI is still AI. Any AI feature activated inside a CRM, office suite, SEO platform or ad platform follows the same data, validation and approval rules as a standalone tool.
2. Tools
Separate consumer accounts from enterprise accounts. Put the approved list in a dated, versioned annex. For each tool, record the maximum data level allowed and who validated it.
Apply the government charter’s logic to connected AI: it gets only the access the task needs, and AI-written emails are never sent automatically.
3. Data classes
Use three levels everyone remembers:
Public: published content, generic information, non-confidential briefs.
Internal: performance data, strategies, budgets, processes, internal code.
Confidential: personal data, client contracts, credentials, financial data, non-public information.
Tie each level to the tools allowed, so nobody guesses. The government charter’s approach is broader than “personal data”: it excludes sensitive and confidential information from AI prompts, because such information may be retained, reproduced or exposed to unauthorised third parties.
4. Human validation
One rule, no exceptions: no AI-generated or AI-assisted deliverable goes to a client or gets published without review. AI assists; a human decides.
Name the validator on the deliverable. That person remains the identified control point. The review covers:
Facts, figures, sources and legal statements.
Brand consistency, tone and spelling.
Commercial and regulatory promises.
Personal data inside a visual, a document or a prompt.
Invented or approximate links, references and quotes.
Bias, discrimination and accessibility issues in text or visuals.
This mirrors the French charter, which requires verification of sources, human review of generated content, and systematic human validation before use.
5. Disclosure and IP
Define when AI use is mentioned: client deliverable, publication, sponsored content, or any decision affecting a person. Write the rule down so it does not depend on individual judgment.
The government charter goes further for State content and prescribes standard mentions, such as stating that content was generated or improved with AI assistance and verified by a human. Your client contracts will set your own version.
Add an IP clause: content under a restrictive licence or an NDA never goes into an AI tool, and the status of generated content is checked before delivery. The French charter also requires human verification that AI-generated or AI-improved content does not infringe copyright or related rights
6. Incidents and review
Write a short procedure: who to contact, within what time, and what to do after a data leak, major error, problematic content or unauthorised use.
Appoint an AI referent, backed by security, legal/GDPR and leadership. Review the charter at least once a year, and whenever a new tool, use or regulation appears.
What a working rule looks like
Three rules, written so nobody has to interpret them:
Data. Personal data of clients or prospects, credentials, non-public financial information, confidential briefs and anything under an NDA are never entered into a tool that is not on the approved list.
Deliverables. Any AI output is a draft until a named person has reviewed, verified and validated it.
Incidents. Any leak, significant error or non-compliant use is reported to the AI referent immediately.
Each one passes the copywriter test. None needs a committee.
Price the review, not the generation
If AI cuts drafting time by 60% but senior review and rework absorb the difference, the agency has bought speed without margin.
The charter should define what “reviewed” means, who performs it, and whether it is included in the deliverable price. Otherwise, AI does not reduce cost; it moves cost from junior production time to unbilled senior control time.
A practical rule:
Review is part of the deliverable. Every AI-assisted deliverable includes a named reviewer, a documented check, and the time required for that check in the project estimate.
Writing it so the team uses it
Start from real usage. Ask teams which tools they use, for which tasks, and with which data. A charter written from guesses gets ignored.
Write short and concrete. Use daily marketing examples instead of abstract principles.
Open with what is allowed. List encouraged uses first, then a limited number of prohibitions, each with its reason.
Isolate the technical part. Keep durable principles in the body and the tool list in an annex you can update in minutes.
Train, then collect confirmation. Present the charter in a workshop with good and bad cases, then have each person confirm they read it. This workshop is also a documented AI-literacy measure.
Schedule the review. Put the annual date and the new-tool trigger in the calendar before you publish.
A one-page starter charter
Scope. This charter applies to all employees, freelancers, interns and subcontractors working on marketing deliverables. It covers standalone AI tools and AI features embedded in business software.
Tools. Only tools listed in the approved annex may be used for professional work. New tools require validation by the AI referent.
Data. Personal data, credentials, confidential briefs, non-public financial information and NDA-protected material must not be entered into unapproved tools.
Deliverables. Every AI-assisted output is a draft until a named person has verified facts, sources, brand, legal claims, personal data and references.
Disclosure and IP. AI use is disclosed where required by client contract, platform rules or applicable law. Licensed or NDA-protected content is never submitted to an AI tool.
Incidents and review. Data leaks, material errors and unauthorised use are reported immediately to the AI referent. This charter is reviewed annually and whenever a new tool, use case or regulation materially changes our exposure.
