AI in marketing: where it delivers measurable results and where it does not
Which marketing tasks are worth speeding up with AI, where human control stays essential, and how to measure the results.
An AI policy for a marketing team is a short internal document, usually one or two pages, that names the AI tools people may use, lists the data that must never be pasted into them, says who checks and approves the output, and explains when to disclose AI use to the public. Clear rules, known to everyone, prevent data leaks and embarrassing mistakes.
What goes wrong when there is no AI policy
Many marketing teams are already using AI, whether or not management has decided to allow it. Someone drafts subject lines in a chat assistant, someone else summarises a call with a transcription app, a freelancer generates images for a campaign. The problem is rarely the tool itself. It is that nobody has agreed on the ground rules, so every person improvises.
Picture three ordinary situations. An account manager pastes a spreadsheet of customer emails into a free chatbot to “tidy it up”. A copywriter publishes a paragraph containing a precise-sounding figure that the tool simply made up. A designer delivers a lifestyle photo in which the product label is garbled. None of these people acted in bad faith. They just had no line to follow.
That is why the policy should be practical rather than defensive. Its job is to say “yes, use AI, like this”, and to make the safe route the easy one. If you want a quick view of where your company stands digitally before drafting rules, the digital maturity scanner is a reasonable first step.
The five questions a good AI policy answers
You do not need a legal treatise. A useful policy answers five questions in plain language:
- Which tools are approved? Name them, state which account type to use (company, not personal) and which tasks they are meant for.
- What data may go in? Use simple categories, not a long list of exceptions.
- Who checks the result? A named person, not “the team”.
- What must be disclosed? To clients, to the public, to ad platforms.
- What happens when something goes wrong? Who to tell, how fast, and what is recorded.
Add two housekeeping lines: who owns the document, and when it will be reviewed. In a small business the owner might be the marketing lead; in a larger one it is often a shared responsibility between marketing, IT and whoever handles data protection. What matters is that one name sits next to the document.
Sort your data with a traffic-light system
The single most useful rule is a three-level classification. Before pasting anything into an AI tool, the person asks which colour it is.
| Colour | Typical examples | Rule |
|---|---|---|
| Red — never | Customer names with emails or phone numbers, national ID numbers, health data, passwords and API keys, confidential contracts, unpublished financial results | Not allowed in any AI tool unless the policy owner approves it in writing. |
| Amber — with care | Internal strategy, budgets, campaign reports, unreleased product details, client briefs | Approved tools only, company accounts, privacy settings checked; remove client names where possible. |
| Green — fine | Public web copy, published prices, general ideas, article outlines, research questions | Allowed in approved tools. Output is still reviewed. |
Two cautions. First, “anonymised” is harder than it sounds: a job title, a town and an order value can together point to one person. Second, terms differ between free, personal and business plans. Some services may use conversations to improve their models, others promise in the contract that they will not. Read the current terms and settings of each tool you approve, and re-read them when the vendor announces changes.
Human sign-off: who is accountable for AI-assisted work?
The principle is short: the tool suggests, a person answers for it. Once a text goes out under your company name, it is yours, whoever or whatever drafted it. So every AI-assisted deliverable needs a named reviewer.
A reviewer should check:
- Facts: figures, dates, names, quotations. Language models can produce plausible-looking sources and statistics that do not exist.
- Promises: guarantees, prices, deadlines. They must match what you can deliver.
- Voice: does it sound like your brand or like every other brand?
- Sensitive areas: claims about health, money or law need a specialist, not just a proofread.
- Visuals: warped hands, illegible text, borrowed logos, faces that look suspiciously like a real person.
Scale the checking to the risk. A batch of headline ideas needs a quick read by the author. An ad making product claims, a press release or a reply to an angry customer needs two people. And one rule should have no exceptions: AI must not be used to invent testimonials, reviews or “satisfied customers”. That is a reputational problem and, in many jurisdictions, an advertising-law problem as well.
Copyright, likeness and brand safety
This is an area where law and practice are still moving, so write your rules cautiously. A sensible baseline:
- Check each tool’s terms for what you may do with the output commercially.
- Do not ask a tool to imitate a named living artist or photographer.
- Do not upload material you have no right to share, such as stock photos licensed for one project or a client’s unpublished copy.
- Keep a simple log of which tool produced which asset, especially logos and campaign imagery.
- Never generate the face or voice of a real person without their written consent.
Who owns, or can protect, AI-generated work is not settled in the same way everywhere. For assets with long-term value, such as a logo or a brand mascot, take legal advice before you commit, not after the campaign has launched.
When to tell people you used AI
There is no single rule, but one test works well: could a reasonable person believe they are looking at something real when they are not? If yes, label it. If the tool only fixed your grammar or suggested a headline, no label is needed.
- Photorealistic images, synthetic voices, generated “people”: state that they are AI-generated, particularly in advertising.
- Chatbots and automated replies: tell users they are talking to an automated assistant and offer a route to a human.
- Ad platforms: Meta, Google and TikTok each have their own rules on AI-generated or altered content, sometimes with mandatory labels. Check the current policy before you launch.
- Inside the team: people should feel able to say “I started from a generated draft” without being blamed. Honesty at that level is what makes the policy work.
GDPR and the EU AI Act: what a marketing team should know
GDPR (Regulation (EU) 2016/679) applies whenever personal data goes into a tool. That is processing, so you need a lawful basis, you must inform the people concerned and, as a rule, you need a contract with the vendor. Where the data is stored, and whether it leaves the EU, also matters. Data minimisation is the safest habit: if you can get the same result without names and email addresses, take them out.
The EU AI Act (Regulation (EU) 2024/1689) entered into force in August 2024 and applies in stages. Two parts are relevant to marketing. One is AI literacy: since February 2025 organisations have had to support the AI literacy of staff who work with AI systems, and the Digital Omnibus Regulation (EU) 2026/1744, in force since 27 July 2026, reworded this as a duty to take measures that support the development of that literacy rather than to guarantee a specific level.
The other is the Article 50 transparency duties, which apply from 2 August 2026: telling people when they are talking to a chatbot and labelling synthetic images, audio or video that imitate reality. Obligations for high-risk systems were postponed to 2 December 2027. Timelines and guidance can change, so check the official sources rather than relying on a blog post, including this one. For the website side, including consent banners and forms, see our guide to GDPR and cookies on your website.
Informational note: this is general information, not legal advice. For specific questions such as vendor contracts, data transfers or profiling, speak to a lawyer or your data protection officer. Official resources: dataprotection.ro (Romanian regulator) and eur-lex.europa.eu.
Writing the policy in a week
This does not need to become a quarter-long project. An hour or two a day is enough for a working first version.
- Day 1 — audit. Ask everyone which AI tools they already use, for what and on which accounts. No blame; you want the real picture.
- Day 2 — classify data. Adapt the traffic-light table to the kinds of data your team actually handles.
- Day 3 — shortlist tools. Pick a few, on company accounts, and read their terms and privacy settings.
- Day 4 — first draft. Write the five answers on two pages at most, with a few “do” and “don’t” examples.
- Day 5 — field test. Apply the draft to three real tasks, such as an article, an ad and a report, and note where it was unclear.
- Day 6 — brief the team. Thirty minutes, with questions. A policy nobody understands protects nobody.
- Day 7 — owner and review date. Name the owner and book the first review.
If you already work from a roadmap, add the policy to your 90-day marketing plan as a dated task with an owner, like any other objective.
Common mistakes
- A blanket ban. People will use AI anyway, on personal accounts and without rules. Offer an approved route instead.
- Too long. A thirty-page document is rarely read. Two good pages beat a perfect document that is ignored.
- No owner. Without a name, nothing is updated and nobody receives incident reports.
- Personal accounts for work. You lose control over both data and privacy settings.
- Policy without training. Rules without examples stay theoretical. A few practical sessions change habits more than an internal email.
- Forgetting other formats. Cover images, audio, video, call transcripts and automatic meeting notes. If an assistant records a client call, the people on the other end should know.
- Trusting AI detectors. They are often unreliable and can wrongly accuse a writer. A clear review process is a better safeguard.
Key terms in plain English
Generative AI tool: software that produces text, images, audio or code from an instruction. Prompt: the instruction you give it. Hallucination: an answer that sounds convincing but is false or invented. Personal data: any information that identifies a person, directly or indirectly. Processor: a vendor that handles personal data on your behalf under a contract. AI literacy: enough understanding of how these tools work, and where they fail, to use them responsibly.
How we approach it
When we train marketing teams, we start with what they already do: which tools are in use, what data passes through them and where the real risks sit. Only then do we move on to prompts, workflows and review. The policy is tested on actual tasks and adjusted after the first few weeks, rather than being handed over as a file that gets forgotten.
If you want your team to learn to work with AI inside a clear framework, read about our AI and marketing training for teams. For a wider view of where AI helps and where it does not, start with AI in marketing.
In short
- Write one or two pages: approved tools, data classes, human review, rights, disclosure, incidents.
- Use three data levels (red, amber, green) and keep personal data out of unapproved tools.
- Every AI-assisted deliverable has a named person who answers for it.
- Label content that could be mistaken for reality.
- Re-check GDPR, the AI Act and tool terms regularly, and review the policy twice a year.
Do we need an AI policy if only one person on the team uses AI?
A short one, yes. The risk does not depend on headcount: one person pasting a customer list into the wrong tool is enough. Half a page covering the approved tool, banned data types and who reviews the output is proportionate, and it will already be in place when the second person starts.
Can freelancers use their own AI tools on our work?
Only if your agreement says so. Add a clause to freelancer contracts that covers which tools are allowed, a ban on uploading your confidential material or client data, and an obligation to tell you when AI was used for a deliverable. Otherwise you cannot know what happened to your files.
Is it acceptable to paste a client brief into an AI assistant?
That depends on the brief and on your contract. Briefs often include confidential strategy or customer information, which puts them in the amber or red category. If you do use an approved tool, remove names and figures that are not needed, and check whether your client agreement restricts sharing material with third parties.
Who should own the AI policy: marketing, IT or legal?
Whoever can keep it alive. In small firms that is usually the marketing lead, with a lawyer or data protection officer consulted on the risky parts. In larger ones, shared ownership works if one person is named as the contact. Ownership matters more than department: someone must update it and receive reports.
Do we have to label AI-written blog posts?
There is no general rule that every AI-assisted text needs a label, but expectations are rising and platform or client rules may apply. Labelling matters most where readers could be misled, for example fake testimonials or synthetic experts. Whatever you decide, a human should review and take responsibility for what is published.
What should we do about AI meeting notetakers on client calls?
Treat them as recording tools. Tell participants before the call starts, get consent where your rules or the law require it, and check where transcripts are stored and who can access them. If a client prefers no recording, switch the assistant off and take notes by hand.