Outlook
Part of Planning assumptions to test with marketing agencies
How marketing agencies can plan AI for client work
A practical guide for agencies to plan AI use in client work, record tools and data, and handle privacy, disclosure and advertising rules.
What to take away
Marketing agencies AI applications are the tools and models an agency uses to research, draft, analyse or optimise client work, from copy generation to audience clustering.
For example, ChatGPT, Claude and Gemini can support research, summarising and drafting; Jasper and Copy.ai are marketed for copy workflows, while Midjourney generates images. Treat these as examples, not endorsements, and assess each provider's terms and data controls against the use case.
- Plan use case by use case, because disclosure and data protection duties attach to what you do with data, not to the tool itself.
- Keep a written record of which client data enters which model, and why.
- Check the regulator's enforcement record before treating any processing as settled.
- Review ad claims and testimonials separately, since advertising rules sit outside the data regime.
Start with the use case
Write down the task before you choose a tool. Summarising call notes and generating ad copy from customer data carry different risk. A short note listing inputs, outputs and the reviewer prevents most disputes later.
Use case record
- Task written down before tool
- Inputs listed
- Outputs listed
- Reviewer named
- Owner assigned
- Record kept to one page
Assign an owner for each use case. That person answers client questions and keeps the record current. Teams that skip this step find problems when a client asks how a deliverable was produced.
Keep the record short and plain. A one-page note beats a policy document that nobody reads, and it is quicker to update when the work changes.
Include the task and purpose, inputs and outputs, provider and model version, retention period, reviewer and owner. Record the lawful basis too if the work uses personal data.
| Field | What to record | Example |
|---|---|---|
| Inputs | Client data entering the model | Call transcripts, CRM notes |
| Model | Provider and version | Named model, version number |
| Purpose | Why the processing happens | Summarise call notes |
| Retention | How long prompts and outputs are kept | Delete prompts after 30 days |
| Reviewer | Who checks the output | Senior editor |
| Owner | Who maintains the record | Account lead |
Personal data is the line
The UK GDPR, supplemented by the Data Protection Act 2018, governs personal-data processing. Identify and document an appropriate lawful basis, provide required transparency information and respect data-subject rights; consent is only one possible lawful basis.
An agency may be a controller, processor or both for different activities; decide roles by who determines the purposes and means of processing, not by contract labels alone. If you act as a processor, the written contract must include the Article 28 UK GDPR terms. For wider market context, see the marketing agencies trends and outlook for England in 2027.
If you make a restricted transfer of personal data outside the UK, identify a lawful transfer route. Depending on the destination and circumstances, this may be a UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses.
Use the ICO's data protection fee self-assessment to check whether your organisation must pay the fee, and check the ICO register of fee payers. Exemptions apply.
Complete a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to people's rights and freedoms.
Disclosure and client consent
Clients increasingly ask whether AI produced a deliverable. Answer plainly. State which stages used AI, which did not, and who checked the output. Vague assurances create more risk than a clear account of a limited use case.
AI disclosure wording
- State which stages used AI
- State which stages did not
- Name who checked output
- Agree position in writing if contract silent
- Put wording in proposal, not only contract
Where a contract is silent, agree the position in writing before the next campaign. Buyers now ask this question in pitches, so a prepared answer is a commercial advantage rather than a burden.
For example, if accurate: “We use ChatGPT to summarise call notes and draft initial copy. A named editor reviews and edits all output before delivery. We do not use client data to train models.”
Learning from enforcement
The Information Commissioner's Office (ICO) publishes decision notices showing how data protection rules apply. Its Guidance on AI and data protection and AI and data protection risk toolkit are useful starting points for assessing an agency workflow. The ICO's 2022 action against Clearview AI, with a £7.5m fine and an order to delete UK data, illustrates its approach to transparency and retention. Check the guidance and enforcement record when designing a workflow, and build lessons into your record.
Advertising claims and reviews
AI-generated claims still count as advertising claims. If a model drafts copy promising a result, the agency and client remain responsible for substantiating it. The same applies to testimonials and case studies.
The ASA ruled against Ryanair on 22 February 2023 over a 'lowest emissions' claim, and Oatly on 15 January 2020 over a '73% less CO2' claim. Both failed on substantiation.
Where a ruling is disputed, the Independent Reviewer of ASA Rulings provides an independent review route, subject to its criteria. Agencies that understand it can advise clients on how to respond.
Before and after workflow
Before
- Brief intake
- Manual notes in a shared doc
- Research
- Analyst reads sources
- Drafting
- Writer drafts from scratch
- Data handling
- Client data in internal tools
- Review
- Editor checks copy
After
- Brief intake
- Structured brief with AI summary, human sign-off
- Research
- Model clusters sources, analyst verifies each claim
- Drafting
- Model drafts, writer edits and owns the final text
- Data handling
- Named model, recorded purpose, retention limit
- Review
- Editor checks copy plus AI disclosure note
Set update triggers
Decide now what would force a change. A new client sector, a provider change or a regulator notice should each trigger a review of the use case record.
Scenario planning helps here. Work through plausible disruptions to identify which AI dependencies would hurt most if a provider changed terms; the marketing agencies risk scenarios in England provide further context.
Provider terms change quietly. Diarise a review of every model you rely on, and note the date the terms were last read.
Common questions
Do agencies have to tell clients when AI is used?
There is no single statutory duty to disclose every AI use. Transparency obligations apply when personal data is processed, and client contracts often add their own disclosure terms. Agree the position in writing.
Can client data be used to train a model?
Only with a lawful basis and, in most cases, a clear contractual right. Training is a distinct processing purpose, so document it separately and check retention limits.
What happens if a client disputes an AI-assisted deliverable?
The contract and your use case record decide the outcome. Keep the record showing inputs, outputs and human review. Advertising claims face a separate route through the ASA.
How often should the record be reviewed?
At least annually, and whenever a provider, model or client sector changes. Treat a regulator notice or client complaint as an immediate trigger.
