Rules and ethics
Part of AI marketing tools: UK rules, ethics and safeguards
Five steps to write an AI marketing tools disclosure policy
A workable AI marketing tools disclosure policy sets out what staff may publish, what the law requires in England and who signs it off before launch.
What to take away
- The mistake most teams make is listing approved tools instead of writing rules for the words and images those tools help produce.
- A workable policy covers four thingsscope, approval, disclosure wording and review.
- In England the main hooks are the CAP Code, UK GDPR and, for platform content, the Online Safety Act 2023.
- Someone senior must sign off before an AI-assisted claim, price or testimonial goes live.
- This is general guidance; a specific case needs a qualified adviser.
Why tool lists fail
A policy that names tools goes stale within a quarter. Vendors change terms, and marketing teams adopt new assistants without telling anyone. What matters is output: the claim being made, who checked it, and whether a reader can tell it came from a brand. Write for that, and the tool list becomes an appendix.
If you are still mapping the wider obligations, the AI marketing tools: UK rules and compliance guide for 2027 sets out where advertising, data and platform rules meet.
Scope and lawful basis
Decide who the policy binds: employees, agencies, freelancers and affiliates. Name the channels it covers. State what happens when someone ignores it, otherwise the document is decoration.
Most marketing use of AI sits on ordinary personal data, where a lawful basis is enough. Facial recognition and emotion inference sit higher. The ICO's Biometric data guidance: Biometric recognition explains that biometric data used to identify a person counts as special category data, which needs a lawful basis and a separate condition.
If a tool processes customer data, your privacy notice needs to name that purpose. A short paragraph on AI-assisted processing is cheaper than rewriting the notice after a complaint.
Five steps to a written policy
- Name the owner. One role owns the document, the approvals and the review date. A committee does not.
- Define scope. List the channels, the roles bound by it and the tools in use, each with a review date.
- Write the disclosure wording. Draft the exact sentence staff use when a caption, image or voice is generated.
- Build the approval gate. No AI-assisted claim, statistic or testimonial goes live without a named editor checking the source.
- Set the review rhythm. Revisit quarterly, and whenever a platform changes its own labelling rules.
For example, a team paying £400 a month across three tools can still miss the disclosure line on a paid social caption, because nobody owns that step.
Five steps to a written policy
- Name the ownerone role, not a committee
- Define scopechannels, roles, tools, review dates
- Write disclosure wordingexact sentence staff use
- Build approval gatenamed editor checks every claim
- Set review rhythmquarterly and on platform changes
Wording that satisfies the CAP Code
The CAP Code requires marketing communications to be obviously identifiable as such. A line buried below the fold rarely clears that bar for a promoted post. IAB UK standards and guidelines give teams a technical starting point for wording and formats, so adapt that language rather than inventing your own.
Platform duties worth knowing
The Online Safety Act 2023 places duties on regulated online services, which shapes what brands can run and pass on within those environments. Check where your media plan touches user-generated content before you sign a schedule.
Because the platform carries most of that duty, your own exposure usually sits in the paperwork with an agency or supplier. The guide to AI marketing tools commercial contracts in England walks through the clauses that decide who answers for a failed disclosure.
Sign-off and review
Give one named person the authority to block publication. Record who approved each AI-assisted asset, when, and against which source. That log is the first thing a regulator or a client asks for.
Sign-off and review essentials
- One named person can block publication
- Record who approved each AI-assisted asset
- Record when approval happened
- Record which source was checked
- Brief agencies in writing with escalation route
Brief agencies in writing too. A one-page summary with the disclosure wording and the escalation route prevents most problems.
Most of the duties above apply across the UK. This guide is written for teams based in England, and contract terms in Scotland plus some employment questions in Northern Ireland need their own advice.
Common questions
Does every AI-written caption need a label?
No. A label matters where a reader could be misled about whether content is an ad or who is speaking. Ordinary brand copy that happens to be drafted with a tool does not need a badge.
Who should own the policy?
The marketing lead should own it, with data protection or legal review at fixed points. Approvals work best when one person can say no without a meeting.
How often should it be reviewed?
Quarterly, and again after any platform policy change or new tool rollout. An annual review alone leaves gaps for months.
Does the policy differ across the UK?
Most of the rules here are UK-wide. Contract terms differ in Scotland and employment questions differ in Northern Ireland, so take advice there.
