An acceptable-use policy people can follow
Most AI policies fail by being either a ban nobody obeys or a set of principles nobody can apply. A workable policy fits on two pages and answers practical questions. Which tools are approved, and for which tasks? What must never be generated: realistic depictions of real people without consent, fake reviews or testimonials, imitations of living artists or of competitors' campaigns, unsubstantiated claims? What needs extra review, such as health, finance, children or political topics? When must AI use be disclosed? Who approves exceptions? Give an example for each rule, update the policy as tools and laws change, and date every version.
What data may go in
The largest governance risk in marketing is data, not output. Classify what people handle and map each class to allowed tools. Public material can go into most approved tools. Internal material, such as unreleased campaigns and plans, goes only into tools with contractual zero retention and no training on inputs. Restricted material, such as customer personal data, unreleased product details, financial results before announcement and anything under a non-disclosure agreement, goes only into systems approved for it, which may mean private or self-hosted models. Name the tools for each class, because a rule like 'use appropriate tools' will be read generously when a deadline looms.
Roles, approvals and the tool register
Governance needs owners. Name a policy owner, often in marketing operations, with legal and security as co-signatories. Keep a register of approved tools and models recording what each is approved for, its data terms, who owns the relationship and when it was last reviewed; anything missing from the register is not approved. Tie approvals to risk: routine adaptations follow the normal workflow, while new use cases, new tools and high-risk content need sign-off from named people. In the EU, Article 4 of the AI Act has required organisations using AI to take AI literacy measures for their staff since 2 February 2025; a July 2026 amendment recast it as supporting the development of staff AI literacy rather than ensuring a sufficient level, and training remains a governance item rather than an optional extra.
Incidents, training and review
Plan for things going wrong before they do. Typical marketing incidents include an asset published with a wrong claim or a distorted product, confidential material pasted into an unapproved tool, a deepfake of an executive circulating, and a complaint about undisclosed AI use. For each, define who is told, how fast content comes down, who speaks externally and how the cause gets fixed. Train by role, with short sessions on the policy, the data classes and real examples of failure, and repeat them when the policy changes. The studio supports governance in practice through SSO and SCIM for access, roles and approvals with an audit trail, and a per-asset record of which model made what.
Updated 25 September 2026 · General information, not legal advice. Rules change, so check the current text with your legal team before relying on it.