Rules and ethics
Part of AI marketing tools: UK rules, ethics and safeguards
Why AI marketing tools commercial contracts deserve a slower read
What to check in AI marketing tools commercial contracts in England: data terms, output rights, sub-processors, liability and exit, with a practical checklist.
What to take away
- The ICO's Children's code sets 15 standards and came into force on 2 September 2021, so tools that profile younger audiences need scrutiny before signature.
- Most disputes turn on data use, output ownership, sub-processors and exit terms rather than headline price.
- Three regulators matterthe ICO for personal data, the ASA for advertising claims, the CMA for digital markets.
- Keep the commercial terms, the data processing agreement and the acceptable use policy in one versioned file.
- Read each item as a question to put to the supplier, not a box to tick.
This list covers contract checks for AI marketing tools bought by marketing teams in England, under an agreement governed by the law of England and Wales.
Court procedure differs in Scotland and Northern Ireland, so check the jurisdiction clause against where you trade. Nothing here ranks products or suppliers, and individual cases need a qualified adviser. The UK rules and compliance guide for 2027 explains how regulation, disclosure and procurement fit together.
Which contract terms carry the most risk?
Start with what the supplier may do with your inputs. A clause permitting service improvement can stretch to training a model on your campaign copy, customer lists or creative assets. Ask for the training purpose to be named, limited and switched off by default.
Four contract risk areas
What to check
- Training purpose
- Named, limited, off by default
- Output ownership
- Licence survives cancellation
- Sub-processors
- Named list, advance notice
- Liability cap
- Compared with annual fee
Risk if ignored
- Training purpose
- Your copy trains their model
- Output ownership
- Supplier serves competitors
- Sub-processors
- Unknown vendors receive data
- Liability cap
- Targeting error exceeds CAP
Output ownership is the second gap. Many tools give you a licence to use what the model produces instead of assigning rights. Check whether that licence survives cancellation and whether the supplier can serve similar output to competitors.
Sub-processors come next. An AI stack leans on hosting, model and analytics vendors, and each one receives your data. A named list in the contract, with advance notice of changes, beats a general promise.
Liability caps decide what you recover after a breach. Compare the CAP with the annual fee. If a targeting error could exceed the CAP, the risk sits with your team.
Where does regulation bite before you sign?
Three regulators and their remit
Regulator
- ICO
- UK GDPR, children's code
- ASA
- Advertising codes, claims
- CMA
- Competition, consumer protection
What it covers
- ICO
- ASA
- CMA
Test the vendor's claims against the AdviceOnline library for marketers covering rules on claims, targeting and content. If the tool promises results your campaign cannot substantiate, repeating that promise transfers the risk to you.
Adtech also sits inside the Competition and Markets Authority remit, which shapes what platforms may do with advertiser and audience data.
How do you check a supplier's data handling claims?
Ask for the data processing agreement before the sales deck. It should name the processing purpose, the retention period and the countries where data is stored or accessed. International transfers need a documented safeguard rather than a line in a FAQ. Our note on AI marketing tools data protection in England sets out how the transfer rules work in practice.
Then test the operational promises. Who tells you about a breach, and how quickly? What evidence of deletion arrives at the end? A supplier that will not say in writing before signature is unlikely to say after it.
What should a contract checklist contain?
Use these eight checks on every quote, whatever the size of the deal.
Contract checklist
- Named purposes for your data, with model training off unless you agree otherwise.
- A current sub-processor list and a notice period for changes.
- Clear output rights, including a licence that survives termination.
- A liability CAP compared with your realistic worst case.
- Retention and deletion rules covering backups and model copies.
- Audit or evidence rights, such as reports or questionnaires.
- A defined exitexport format, timescale and any charge.
- Governing law and jurisdiction, checked against where you trade.
Common questions
Who owns the output an AI marketing tool generates?
Often the supplier grants a licence rather than assigning copyright. Read the grant, the term and the territory, and confirm commercial use continues after the contract ends.
Can a supplier swap sub-processors without telling me?
Only if the contract allows it. Ask for advance notice and a right to object, which is normal in a well-drafted data processing agreement.
Does the ASA cover AI-written ad copy?
Yes. The CAP codes apply to the advertisement, not the software behind it, so substantiation and targeting duties stay with the advertiser.
What happens to my data when the contract ends?
Deletion and export should be spelled out. Agree the format, the timescale and any charge, and keep evidence that deletion happened.
