Operations
Part of who should sign off AI marketing tools output?
Why an AI marketing tools operating workflow needs named owners
Assign owners, inputs and approvals at every stage of an AI marketing tools operating workflow, with copy clearance and breach reporting built in from day one.
What to take away
- The ICO breach reporting process starts a 72-hour clock when you become aware of a personal data breach, so one named person must be able to act inside it.
- An AI marketing tools operating workflow needs an owner, a required input and a recorded decision at each stage.
- Route AI-assisted ad copy through the ASA Copy Advice service before publication, while a complaint is still hypothetical.
- Follow the AI Playbook for the UK Government and score evaluated outputs against criteria you wrote in advance.
- Treat any unwritten step as a single point of failure, and review the workflow after every incident.
Why does an AI marketing tools operating workflow need named owners?
Most teams adopt tools faster than they assign responsibility. A prompt library grows, three people edit it, and nobody can say which version produced last month's campaign. Naming owners fixes this. Each stage gets one person who signs the output, not a committee.
The same workflow can govern tools such as ChatGPT, Adobe Firefly and HubSpot's AI features. Record which tool is approved for each use case before anyone puts it into campaign work.
Ownership also shortens recovery time. When a model drafts copy that misstates a price, the person who owns the copy step withdraws it. That is a delivery question, not a technology one, which is why the wider operations and delivery guide sets out the surrounding structure before you choose vendors.
Authority matters more than technical skill here. An owner needs the standing to pause a campaign, plus a deputy who can cover annual leave. For example, assign the senior brand manager as copy-step owner and the head of marketing as deputy. Put both employees' names in the document, because a role or a single name with no cover is a gap waiting to open.
Which steps belong in the workflow?
A workable sequence has seven stages. Keep it short enough that people remember it without opening the file. The owner column gives a role to assign; enter the individual employee's name in the working workflow.
| Stage | Owner (role; enter one person's name) | Required input | Recorded decision |
|---|---|---|---|
| Scope the campaign and check data | Campaign manager | Approved brief, intended audience and data classification | Proceed, revise the brief or exclude data |
| Approve the tool and access | Marketing operations lead | Use case and tool privacy and security review | Approve or block the tool for this use |
| Set up the prompt | Campaign copywriter | Approved brief, source material and prompt template | Save the prompt version or revise it |
| Generate and log content | Campaign executive operating the AI tool | Approved tool and prompt | Retain or discard the output; record its version |
| Review factual claims and brand fit | Senior brand manager | Draft, supporting sources and brand rules | Accept for clearance or return for revision |
| Clear and publish | Compliance lead | Reviewed copy, evidence for claims and channel details | Clear, amend or stop publication; record any ASA Copy Advice sought |
| Monitor and respond | Marketing operations lead | Live asset, performance, complaint and incident alerts | Keep live, pause or escalate; record the action and who took it |
Seven stages, one owner each
- Briefobjective and success measure
- Inputsfirst-party data confirmed
- Draftinglog tool, prompt, date
- Reviewcheck claims and superlatives
- Clearancepre-clear borderline wording
- Publicationrecord approval and date
- Lookbackcheck at 7 and 30 days
Each row needs one accountable person, not a team: put that employee's name beside the role and name a deputy. Gaps are the useful signal: an unowned stage is where work stalls, and where nobody notices for a fortnight.
How do you clear copy and handle a data incident?
Ad copy is the highest-risk output. A model can produce a claim that reads well and still breaks the CAP Code, so use the ASA's Copy Advice service to pre-clear borderline wording before it runs.
Two clocks: copy and breach
- Before runningPre-clear borderline copy via ASA Copy Advice
- Within 72 hoursNotify ICO of personal data breach
- OngoingLog what ran, who approved, when
Data incidents run on a separate clock. If a tool leaks prompt data containing personal information, assess whether it is a personal data breach that is likely to result in a risk to people's rights and freedoms. Under UK GDPR Article 33, the controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach. Name the controller's data protection lead (or data protection officer, if appointed) as the person who assesses and submits the report through the ICO's online personal data breach reporting form, with a deputy named for cover. Record the decision and, if no notification is made, the reason. The ICO breach reporting process sets out the reporting route.
Record decisions as you go. A short log of what ran, who approved it and when gives you evidence if a complaint arrives months later. Reconstructing that history afterwards is slower and less convincing.
How do you keep the workflow from drifting?
People leave and tools change. A workflow that lives only in someone's head disappears with their notice period. Keep one dated document with a named maintainer, and review it monthly. The team roles article helps you map each owner to a real job title instead of goodwill.
Evaluation is the stage teams skip under deadline pressure. The AI Playbook for the UK Government offers practical guidance on building and using AI, including evaluation against agreed criteria. Borrow that structure: write criteria first, score outputs blind, keep the scores. For marketing copy, criteria could include whether every factual claim is traceable to an approved source, whether the copy fits the brand, whether it avoids prohibited personal data, and whether it meets the CAP Code. Set a pass/fail threshold in advance: an unsupported claim, a privacy failure or an unresolved compliance concern means reject or revise; only outputs meeting every criterion proceed.
Set a trigger for repeated failures: if outputs keep failing the agreed criteria, review the prompt before reviewing the vendor. For example, a team paying £400 a month for a drafting tool could agree that low acceptance rates trigger a prompt review ahead of a vendor review.
Common questions
Who owns the workflow when nobody has an operations title?
Give it to the person who already signs off campaign spend, and name their deputy. Ownership follows accountability, not seniority, so a senior brand manager can hold it as easily as a head of marketing.
How long should the workflow document be?
One page per stage, plus a one-page index naming every owner. Anything longer stops being read, and an unread document protects nobody.
What should trigger a review outside the monthly cycle?
A personal data incident, a regulatory complaint, a new tool or a change of owner. Each one can invalidate an assumption the workflow depends on.
Do we need to log every prompt we try?
No. Log the prompt versions behind anything published, with the approval and the date.
