A strategist drops a confidential client brief into a summarising tool.
A copywriter runs the summary through a different tool to rewrite it.
A campaign manager feeds the result into an AI-enabled workflow that generates ten ad variations.
A chatbot serves the final copy to prospects the same afternoon.
4 tools. 4 people. Little visibility into what happened between step one and step four.
This workflow assembled itself, one convenient tool at a time.
This is a story about what the job increasingly requires: moving faster, personalising more, producing more content and operating across a growing stack of connected tools.
What AI governance means in marketing
AI governance is often described in terms of policies, regulation, ethics, accountability and oversight.
For marketing, AI governance can be expressed more simply:
It is how you decide what AI can do, what it cannot do, who is responsible, and what happens when something goes wrong.
That includes:
Visibility into the AI tools, features and workflows actually in use.
Rules for what data may and may not enter those tools.
Appropriate human review before content, recommendations or decisions reach a client, customer or the public.
Clear ownership when an output is questioned.
Role-specific AI literacy.
A process for escalating and investigating incidents.
Enough documentation to reconstruct what happened.
AI governance turns:
“Everyone uses AI in their own way”
into:
“
We use AI in a way we can explain and defend.”
That distinction - explainable versus improvised - is the heart of the issue.
Why marketing deserves specific attention
1. Marketing often relies on personal data
Targeting, segmentation, CRM enrichment, personalisation, retargeting and customer analytics may involve personal data. That data can move between CRM systems, analytics platforms, advertising tools, data providers and AI-enabled services.
Each transfer or new use raises questions about the existing data-protection framework:
Is the processing lawful?
Is the purpose compatible with the original purpose?
Is the data limited to what is necessary?
Is the processing transparent?
Are appropriate security measures in place?
Are vendors acting as processors, independent controllers or in another role?
These questions relate directly to the GDPR’s principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
2. Marketing workflows are increasingly connected
Marketing teams have long used automated sequences. AI adds new capabilities to those sequences, including content generation, summarisation, classification, recommendation, personalisation and conversational interaction.
A possible workflow might look like this:
brief → research → draft → adaptation → approval → scheduling → optimisation → reporting
The risk is the accumulation of decisions and transformations across the chain.
A claim can be introduced during drafting, altered during rewriting, embedded in multiple variants and then distributed through a campaign system. If the workflow is poorly documented, the final team may not know where the claim originated or who was expected to verify it.
This matters particularly for:
Product and performance claims.
Comparative advertising.
Health, finance, environmental or sustainability claims.
Pricing and promotional information.
Translations and localised content.
Customer-facing recommendations.
Content created for regulated or reputation-sensitive sectors.
3. AI systems can produce recommendations or decisions
The term “AI agent” can describe anything from a chatbot with access to tools to a more autonomous system that plans and executes a sequence of actions.
Examples might include:
Selecting content variants for further testing.
Adjusting campaign parameters.
Prioritising audiences.
Classifying leads.
Recommending next actions.
Generating or sending customer-facing responses.
Triggering downstream actions in connected systems.
The more authority a system has, the more important it becomes to define:
Its permitted scope.
Its data access.
Its decision thresholds.
Its escalation conditions.
Its logging and monitoring.
The actions that require human approval.
The actions that must remain outside its authority.
This is a requirement to design controls proportionate to the potential impact of the system’s actions.
Under Article 22 of the GDPR, individuals have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning them or similarly significantly affects them. The provision includes limited exceptions, such as situations necessary for entering into or performing a contract, authorised by law, or based on the individual’s explicit consent.
The EU AI Act adds a separate, risk-based layer. If a system qualifies as high-risk, providers must design it so that human oversight is possible during operation. The oversight must be proportionate to the system’s risks, level of autonomy and context of use. Human overseers must be able to understand relevant capabilities and limitations, detect anomalies, interpret outputs, disregard or override them, and intervene or stop the system when necessary.
4. Synthetic content is becoming part of normal production
Marketing teams can now generate and adapt text, images, video, audio, voiceovers and other creative assets at considerable volume.
Article 50 of the EU AI Act includes obligations relating to direct interaction with natural persons, synthetic or manipulated content, emotion recognition and biometric categorisation, and certain AI-generated text published to inform the public on matters of public interest.
Make sure you know your transparency obligations, and who is responsible for determining and implementing it.
Where the risk lands
-
Marketing teams handle personal data, behavioural information, audience segments, campaign logic and confidential client material.
AI can create exposure when teams:
enter personal or confidential information into an unsuitable tool;
use AI-generated audience segments without understanding the underlying logic;
publish inaccurate or misleading claims;
use profiling or targeting systems without appropriate review;
fail to identify whether a particular AI use triggers relevant obligations.
The EU AI Act does not treat every marketing use of AI in the same way. The relevant analysis depends on the system, its purpose, the context and the organisation’s role.
The GDPR and consumer protection rules may also apply, depending on the data and activity involved.
This does not require a major public incident. A client question, procurement review or internal investigation can reveal that nobody knows how a workflow actually operates.
-
AI can produce content quickly.
It can also produce brand-damaging content quickly.
A misleading claim, inappropriate image or tone-deaf message can be reproduced across multiple channels before anyone notices.
The central question is :
“Does the final work meet the standards your audience and clients expect?”
As HubSpot’s 2026 report indicates, AI is creating efficiency opportunities while also increasing complexity. Authenticity and human-created content remain important to audiences. HubSpot
-
AI is often, although not always, presented as a productivity engine. But producing more content is not the same as creating more value.
In my opinion, when AI brings the cost of producing content close to zero, the value shifts even more towards quality. And, in my opinion again, quality has always been the true differentiator.
I may be biased here. As I mentioned earlier, I tend to optimise for quality rather than time saved.
The hidden costs of ungoverned AI may include:
correcting inaccurate outputs;
reviewing inconsistent drafts;
managing additional subscriptions;
repeating work after client feedback;
explaining weak campaign decisions;
coordinating tools that nobody clearly owns;
measuring activity without proving business impact.
Jasper’s 2026 research illustrates this gap: 91% of surveyed marketing teams reported using AI, but only 41% said they could confidently prove AI ROI. Jasper
This is close to my own experience. When AI gives me time back, I tend to reinvest it in quality.
That can be a good choice—but it means that “time saved” is diametrically different as “value created”.
-
Some employees use approved tools. Others use personal accounts, browser extensions or AI features built into existing software. It is easy—and tempting 😈—to try a new tool. It is often one click away, and many tools offer a free trial.
I think the shadow AI problem has grown significantly with the rise of generative AI.
Marketing teams were already using a wide range of software before ChatGPT launched. But since then, they have been exposed to a much larger number of AI tools and AI-enabled features. The rise of vibe coding may accelerate this further by reducing the time, resources and technical skills needed to create a tool or prototype.
This is shadow AI: AI entering professional workflows without complete organisational visibility.
When something goes wrong, leaders may not know:
which tool was used;
what information was entered;
which model or feature produced the output;
who reviewed it;
who can pause the workflow;
who is accountable for the final decision.
It is an operational blind spot.
-
For agencies, AI governance is also a commercial issue.
Clients may want to know:
whether their data is entered into AI tools;
which tools support the delivery of the work;
how confidential information is protected;
who owns AI-assisted outputs;
how accuracy and human review are managed;
what happens if an AI-supported deliverable causes harm.
If an agency cannot answer these questions clearly, the consequences may appear during a pitch, procurement review or contract negotiation.
Governance can therefore become a differentiator.
I think it will become a differentiator, although I may be biased here too. 😁
Consider website creation.
Having a website in the late 1990s was impressive. Today, it is normal. A website now needs to meet a long list of expectations in order to stand out: conversion, accessibility, performance, security, user experience and, increasingly, environmental impact.
I think AI governance will follow a similar path. Clients already know that agencies use AI—in many different ways. What they will increasingly want is a clear explanation of how that use is controlled.
What good governance should do
Many marketing leaders associate governance with bureaucracy, slower delivery and additional restrictions. I understand that reaction.
When you look at legal texts, official guidance and ISO frameworks, the language can feel complex and difficult to digest. It takes real effort to understand what those requirements mean in a specific professional context.
Good governance should help teams:
know which tools they can use;
understand which data is sensitive;
recognise when human review is required;
make ownership visible;
reduce avoidable rework;
respond quickly when something goes wrong;
answer client questions with confidence.
It prevents teams from wasting time on activities that are not permitted, not defensible or not aligned with the organisation’s risk appetite.
Where to start
Begin with visibility.
1. Map your shadow AI
Ask each team member:
“Which AI tools, browser extensions, personal accounts or embedded AI features have you used in the last five working days?”
Do not ask only about the tools approved by procurement. Ask about the tools people actually use.
The tricky part is that people may have created accounts for tools they no longer use.
So I would also recommend checking company email inboxes for billing receipts, account-confirmation emails and other signs that an account has been created.
Do this transparently and in line with your organisation’s internal policies and applicable employment and privacy rules.
2. Connect tools to workflows
For each tool, record:
who uses it;
what marketing activity it supports;
what data enters it;
where the output goes;
whether a client or customer sees the output;
who reviews the result.
Example: an AI writing assistant used for client emails → enters client strategy + customer data → output seen by clients → requires editorial review.
This turns a list of tools into a view of actual exposure.
3. Prioritise the connected risks
Start with workflows that involve:
confidential or personal data;
public-facing content;
client deliverables;
customer interactions;
targeting or profiling;
important brand or revenue decisions.
Then assign an owner and decide on the first practical control.
That might be:
a data rule;
an approved-tool list;
a mandatory review step;
a vendor check;
an incident process.
You need a clear view of where your team is exposed and a few rules people can realistically follow.
Conclusion
Every team should have ownership of its AI use.
When the internet became widely used over the past 30 years, organisations did not create one “chief of digital” to own every digital activity forever. Digital became part of every department’s work. Each team developed responsibility for its own tools, processes and workflows.
I believe AI will follow a similar path.
I cannot see how one person, team or department could understand the specificities of every AI use case across an entire organisation.
The goal is for your marketing team to understand:
where AI is being used;
what information enters the tools;
what could go wrong;
how the risks connect;
who is responsible for the final decision.
