Paper 034 · AI Governance

The AI Layer

The AI wrote the campaign copy in thirty seconds. It also invented the quote, missed the compliance flag, and left no record of who checked its work. Where AI helps a marketing plan, where it hurts it, and where it exposes the house that trusted it.

Audience CMOs · brand marketers · in-house counsel · anyone signing off on AI-generated copy before it publishes Published July 30, 2026

This file is offered from the standpoint of a tenured marketing and manufacturing house — not a financial, investment, legal, or advisory firm. It is general commentary on standing and stewardship, not financial, investment, legal, tax, or compliance advice. Read it as perspective, and consult your own licensed advisers and compliance counsel before acting.

A Note from the House

We are not the quintessential know-it-all international experts in building an AI-use policy a marketing plan can actually survive. We are a house with some experience in the area that also happens to have always done our homework steadfastly. To help keep us abreast, we also run Markets Edge, Sports Edge, Voyage Edge, The Briefing, and Fending — reporting every three hours — and we have a little more than most in the way of real-world experience serving the layer of relationships this paper describes.

This is a working operator's field notes, never the definitive treatise. The human interaction and a little humble kindness should never get undersold. You literally never know exactly whose money you are interacting with unless it's your own; and let's be honest, most people don't notice until it's too late who funded the fund.

If something in here contradicts what you've seen on the floor, yours is probably more accurate — and we'd like to know.

— The House · Virginia Beach · Hako Shikin LLC

1 · The Speed Was Free, the Record Was Not

The AI wrote the campaign copy in thirty seconds. It also invented a quote, missed a compliance flag a junior copywriter would have caught, and stored the customer list on a server nobody on the team could name. The speed was free. The record of what happened is not — and the bill for that arrives later, usually at the worst possible time to discover it is missing.

This is not an argument against using the tools. It is an argument against using them the way most teams currently do: as a faster typewriter, with no more governance around the output than there was around a new hire's first week. A new hire gets a manager, a review process, and a paper trail. Most AI output gets published the moment it reads "fine."

Where AI actually helps a marketing program is narrow and real. Where it hurts is just as real, and less discussed.

Where AI Helps

First drafts — headlines, social copy, email subject lines
Pattern recognition — which segments respond to which messages
Speed to market — campaigns launched in hours, not weeks
Personalization at scale — content variants for micro-segments

Where AI Hurts

Facts it invents — quotes, statistics, regulatory claims
Tone it misreads — your brand voice becomes generic, or worse
Bias it encodes — training data skews output in ways you don't catch
Dependency it creates — your team forgets how to write without it

2 · Where the AI Layer Exposes You

This is the part most plans skip. Here is what an AI-safety policy has to cover:

Data Input

What customer data actually feeds the model

Assuming "anonymized" is the same thing as safe

Model Choice

Which model, which version, which provider — decided on purpose

Using whichever is cheapest that week, unrecorded

Prompt Storage

Where the prompts live and who can open them

Treating a prompt as disposable instead of as a record

Output Review

A named human who signs off before anything publishes

"It reads fine — just post it"

Retention Policy

How long outputs live and how they're archived

Keeping everything indefinitely, governed by no one

Vendor Contract

What the AI provider is contractually allowed to do with the data

Clicking "accept" on the terms without a read

3 · The One-Rule Decoder

Every prompt is a data handoff. Every output is a brand exposure sitting in public the moment it publishes. If the team cannot answer which model, which version, which human reviewed this, and where the record lives — the program does not have AI marketing. It has AI gambling, with the brand's name on the table.

A control that isn't documented and auditable on its own isn't a control — and an AI tool with no name, no version, and no reviewer is not a control at all.

The houses that hold up over time do not treat the model as smarter than a vendor. They treat it as a vendor: vetted before onboarding, contracted in writing, reviewed on a schedule, and replaceable the day it stops earning the access it was given.

4 · What Most AI Policies Self-Inflict

Assuming "the vendor probably handles that." Most AI vendor contracts are written to protect the vendor, not the brand feeding it customer data.

Skipping human review because the output "sounds right." Confidence and accuracy are not the same signal, and AI output is built to produce the first one.

Letting every account touch every model with no log. Once nobody remembers which tool wrote which claim, nobody can trace it back when a customer — or a regulator — asks.

Treating the AI-use policy as a one-time document. Models change versions monthly; a policy written in January describes a tool that no longer exists by June.

5 · Appendix

The AI-Exposure Checklist — the six questions a vendor contract has to answer before a model touches customer data
The One-Rule Decoder — single-sentence card
Output-Review Sign-Off Template — a one-line record for the human who checked it, and when

Research by H. Goodman

Cited: Mata v. Avianca, Inc. (S.D.N.Y. 2023) and Seyfarth Shaw's analysis of the sanctions that followed — the standing case study for confidently-wrong AI output with a real professional consequence attached. Opening scenario illustrative and anonymized, not drawn from a specific incident. Second in the series, The Safe Marketing Plan; preceded by File 033, continued in File 035, The Chain of Custody. Offered from the standpoint of a tenured marketing and manufacturing house, not a legal, cybersecurity, or compliance adviser — general commentary on stewardship, not advice.