AI Governance for Marketing Teams: A Working Framework
A marketing-sized AI governance framework - risk tiers, tool approval, escalation and records - built from NIST, ISO 42001 and the EU AI Act without the binder.
Marketing teams have AI in production and governance in a shared doc nobody has opened since it was written. The adoption side is settled: Salesforce’s State of Marketing research has 75% of marketers using AI. The governance side is catching up fast at the organizational level, with the IAPP’s governance survey finding 77% of organizations working on AI governance, rising toward 90% among those already using AI. The catch in my experience is where that work happens: legal and IT write the enterprise policy, and the marketing-specific questions, which tools, whose sign-off, what happens when a model invents a discount, stay unanswered until an incident answers them.
This post is the marketing-sized version. I have read the big frameworks so you can take the four decisions they actually require from a marketing team, and the result fits on one page, which is the only length a policy gets followed at.
What the official frameworks say, translated
Four documents dominate every AI governance conversation, and a marketer needs about a paragraph of each.
NIST’s AI Risk Management Framework organizes the work into four functions. Govern “cultivates and implements a culture of risk management,” Map “establishes the context to frame risks,” Measure covers the tools to “analyze, assess, benchmark, and monitor AI risk,” and Manage is about “allocating risk resources to mapped and measured risks.” It is voluntary, and it is the vocabulary your risk and legal colleagues will use, so adopting it costs nothing and buys alignment. NIST’s generative AI profile narrows the frame to twelve GenAI risks with proposed actions, and its list reads like a marketing team’s incident log waiting to happen: misinformation, harmful content, and systems “confabulating or ‘hallucinating’ output.”
ISO/IEC 42001 is the certifiable version, the world’s first AI management system standard, published in December 2023. Marketing teams do not pursue the certificate. Your vendors increasingly do, which turns it into a procurement filter rather than homework.
The EU AI Act’s Article 50 transparency obligations are the part with teeth for marketers, in force from August 2026: chatbots that must identify themselves, synthetic media that must be detectable, disclosure duties that name the surfaces marketing runs. I walked through which duties actually land on a marketing team in the EU AI Act checklist, so here I will only say that your governance framework is how you prove you thought about any of this before a regulator asked.
The framework: four decisions on one page
Everything a marketing team needs from those hundreds of pages compresses into four standing decisions.
1. Risk tiers for AI output
Not all model output carries the same risk, and a policy that treats a brainstorm like a press release gets ignored by Thursday. I run three tiers.
Tier one, internal and disposable: brainstorms, summaries, first drafts nobody outside the team sees. Rule: use freely, no review required, never paste confidential data into unapproved tools.
Tier two, published content: blog posts, emails, ads, social. Rule: a named human edits and approves, every factual claim passes the verification gate, and disclosure follows your published policy.
Tier three, live and autonomous surfaces: chatbots, dynamic pricing or offers, anything that speaks to a customer without a human between the model and the send button. Rule: named owner, pre-launch review by someone outside marketing, containment (the bot only answers from approved content), and a kill switch someone on call can actually operate.
The tiers exist because review capacity is scarce. Spending it on tier one is theater, and skipping it on tier three is how companies end up in tribunal decisions.
2. Tool approval
I keep the intake for a new AI tool to five questions, answerable in an afternoon: what data goes into it (and does that data include anything covered by GDPR or client confidentiality), does the vendor train on your inputs, who owns the output, what tier of work will it touch, and who is the internal owner. Write the answers down, approve or reject, and revisit annually. The list of approved tools is public inside the company, because a quiet approval process is how shadow AI happens: the marketer who pastes the unreleased pricing into a free tool was never trying to cause a breach, they were trying to hit a deadline with no approved option in sight.
3. Escalation
The escalation matrix is one column wider than most teams expect, because AI incidents come in kinds: a factual error shipped (owner: the content lead, response: correct and log), an off-brand or offensive output shipped (owner: brand, response per the brand safety playbook), a data exposure (owner: legal or DPO, immediately), and a tier-three surface making commitments (owner: whoever holds the kill switch, then legal). The matrix’s real job is speed. In every incident post-mortem I have read, the damage grew in the hours someone spent working out whose problem it was.
4. Records
Keep the tool register, the tier assignments, the approvals, and a log of incidents with what changed afterwards. This is lighter than it sounds, a spreadsheet and a habit in my version, and it is the difference between “we take reasonable care” as a sentence your lawyer can prove and as a hope. The record-keeping instinct is the same one GDPR already demands for data processing, extended one shelf over.
The liability floor under all of it
If the framework feels like overhead, the case I anchor it to is Moffatt v. Air Canada, where the airline’s chatbot invented a bereavement fare policy and the tribunal made the airline honor it, holding that a company is responsible for all the information on its website and that it makes no difference whether that information came from a static page or a chatbot. Every tier-three rule above is that reasoning turned into a checklist. The company answers for the model’s words, so someone at the company has to own them before they ship, and governance is just the name for deciding who, in writing, in advance.
Keeping it alive
A governance framework dies two ways: it is too heavy, so people route around it, or it is written once and never reread while the tools change monthly. My countermeasures are boring on purpose. The whole policy stays on one page. It gets a quarterly half-hour review, tied to the same cadence as the KPI review, where the only agenda is what changed in our tools, what near-misses happened, and which rule nobody followed (delete it or enforce it, never leave it decorative). And ownership sits with a named person in marketing, not with a committee, because frameworks owned by everyone are maintained by no one. Budget owners who want the executive-level version of this argument will find it in the CMO playbook.
FAQ
Do we need a governance framework if we already have an AI policy from IT? Probably yes, as a supplement. Enterprise policies decide which tools are permitted and what data may touch them. They rarely decide who approves a tier-two blog post or who owns the chatbot’s mistakes, and those marketing-shaped gaps are where the visible incidents happen.
Should we get ISO 42001 certified? For a marketing team, almost never. Use it as a vendor question instead: a tool vendor holding or pursuing 42001 certification has done governance homework you would otherwise have to do to them via questionnaire.
Who should own AI governance in marketing? One named senior marketer, with legal as a standing consult. In small teams it is whoever owns brand and quality anyway. The anti-pattern is parking it with the most junior enthusiast because they like the tools.
How is this different from an AI use policy? A use policy tells individuals what they may do. Governance adds the structural half: tiers, approvals, escalation and records. Most published “AI policies” I see are use policies, which is why they go quiet exactly when something breaks.
This framework is part of the ethics and governance topic. The verification gate lives in the hallucination guardrails, the legal specifics in the EU AI Act checklist, and the wider practice starts at the complete guide to AI marketing.