AI Compliance

AI compliance sounds like a legal project. For most marketing teams it is a filing problem. The rules that apply to a campaign made with AI are mostly the rules that applied before: no false claims, no personal data where it does not belong, no music or faces you have no right to use. What changed is the speed. A team can now produce in an afternoon what used to take a month, and the paperwork did not speed up with it.

This post is not legal advice. Laws differ by country and they are still moving. It is a working list of what to check, what to keep, and where teams usually get caught, so the conversation with your legal team starts from facts instead of screenshots.

What AI compliance actually covers

Four areas come up in almost every review. Keep them apart, because they have different owners and different fixes.

• Data. What went into the prompt. Customer lists, unreleased numbers, personal details, a client's brief under NDA.
• Rights. What came out and what was used to make it. Music, voices, faces, logos, and the license of the tool on the plan you pay for.
• Disclosure. When an audience or a platform has to be told that something is synthetic or was made with AI.
• Claims. Whether the words are true. A model will write a price, a statistic, or a health claim with full confidence.

Most incidents are not exotic. Someone pasted a spreadsheet into a free chat tool. A voice was cloned without a signed release. A generated testimonial read like a real customer. Each of those breaks a rule that already existed.

The rules you will hear about

In Europe the main one is the EU AI Act. It entered into force in August 2024 and applies in stages. Bans on certain practices and a duty to make sure staff who use AI have enough AI literacy have applied since February 2025. Obligations for providers of general purpose models followed in August 2025. Transparency duties around deepfakes and AI generated content were set to follow from August 2026, and parts of the timeline have been under review in Brussels. Check the current dates before you write them into a policy.

For a marketing team that uses AI rather than builds it, the parts that matter most are simple to state. Train the people who use the tools. Label realistic synthetic images, audio, and video of real people, places, or events when the law or the platform asks you to. Do not use AI to manipulate or deceive. Most ad and content work is not high risk under the Act, but a chatbot that talks to customers or a system that scores leads deserves a closer look.

GDPR still sits underneath all of it. Personal data in a prompt is processing. You need a lawful basis, a data processing agreement with the vendor, and a clear answer to where the data is stored and whether it is used for training. Our own position is on the GDPR statement and the data protection and trust page.

Outside the EU the picture is a patchwork. In the United States, consumer protection rules already cover AI: fake reviews and testimonials, including ones written by AI, are banned, and deceptive claims about what a product can do are treated like any other deceptive claim. Several states have their own rules on deepfakes, voice cloning, and political ads. Platforms add a layer on top. Meta, TikTok, and YouTube all ask for a label on realistic synthetic content, and an ad that skips it can be pulled.

Where marketing teams get caught

• Customer or employee data pasted into a personal account on a free plan.
• A cloned voice or a generated face that looks like a real person, with no consent on file.
• Music, templates, or effects licensed for organic posts, then used in a paid ad.
• Reviews, quotes, or case study numbers that a model invented.
• A photorealistic product shot that shows something the product does not do.
• No record of which tool made an asset, so nobody can answer a takedown or an audit.

The rights questions are usually tool specific. We covered them for voice in ElevenLabs and for editing and music in CapCut. The pattern is the same everywhere: the free plan and the paid plan do not always grant the same rights, and the terms change. Read the terms for the plan you export from, this month.

A simple AI compliance checklist

This fits on one page. That is the point. A policy nobody opens does not protect anyone.

1. Keep a list of approved AI tools, with the plan, the owner, and a signed data processing agreement for each.
2. Write down what never goes into a prompt: personal data, client material under NDA, unreleased financials.
3. Get written consent before you clone a voice or generate a likeness of a real person.
4. Check the license for music, voices, and templates against the placement, including paid ads.
5. Label realistic synthetic content where the law or the platform requires it.
6. Fact check every number, price, quote, and claim before publishing.
7. Keep a record per asset: tool, prompt or brief, source files, reviewer, and publish date.
8. Give everyone who uses the tools a short training, and log that they took it.

Compliance is a record, not a feeling

When a regulator, a client, or a platform asks a question, the answer is a file. Which tool, which plan, which brief, who approved it. Teams that work across ten logins cannot produce that file. They can only say they think it was fine. That is the same problem we described in AI transformation is a problem of governance: the risk lives in the gaps between tools, not inside any single one.

The fix is boring and it works. Fewer tools. One place where briefs, assets, and approvals live together. Brand rules and banned claims written down once, so every generator reads from the same list. Brand Kit holds the logo, the tone, and the claims you may and may not make. AI Workflows puts a review step between generation and publishing. For larger teams, Enterprise adds the access controls and data terms a legal review will ask about.

Frequently asked questions

Do we have to label every piece of AI content?

No. The duties focus on realistic synthetic content that could be mistaken for real, such as a deepfake of a person or an event, and on certain text published to inform the public. An AI assisted product description or a stylised illustration is usually not in scope. Platform rules can be stricter than the law, so check both.

Is AI compliance the same as AI governance?

They overlap. Compliance is meeting the rules that apply to you. Governance is how you run the work so you can meet them: owners, approved tools, review steps, and records. Good governance makes compliance cheap.

Who should own AI compliance in a marketing team?

One named person, usually marketing operations, working with legal and the data protection officer. Legal sets the rules. Marketing operations makes sure the tools, the checklist, and the records actually exist.

Conclusion

AI compliance is mostly old rules at a new speed. Know what goes into the prompt, know what rights come out, label what needs a label, check every claim, and keep the record. If your team can answer which tool made this, on what data, and who signed off, you are ahead of most. Get Started with Content24, or read brand voice across AI tools for the brand side of the same problem.