Which AI content operations advertising rules apply to my ad copy?

What to take away

The Data Protection Act 2018 received Royal Assent on 23 May 2018, and it still governs the personal data that moves through AI content operations: UK rules and compliance.
The CAP Code applies across the UK, and rule 3.7 puts the evidential burden on you: hold proof for every claim before the ad goes live, whoever drafted it.
When customer data feeds a model, the anonymisation test decides whether the output is personal data, not the label on the file.
Prompts, outputs and prompt logs are records, so the retention clock covers them too.
Rule 2.1 requires an ad to be obviously identifiable as an ad. It does not require a label saying AI wrote it.

CAP Code rules for AI-assisted ad copy

The CAP Code covers the whole UK

The Committee of Advertising Practice writes the CAP Code, and the Advertising Standards Authority enforces it. The rules reach paid and unpaid marketing, including social posts, emails and web copy.

Three rules carry most of the weight in the 12th edition. Rule 3.1 says marketing communications must not materially mislead. Rule 3.7 requires documentary evidence for any claim capable of objective substantiation, held before publication. Rule 3.33 covers comparisons with identifiable competitors.

CAP Code: what it covers

Covered by CAP Code

Paid marketing: Yes
Unpaid marketing: Yes
Social posts: Yes
Emails: Yes
Web copy: Yes
AI-assisted copy: Yes

Not exempt

Paid marketing: Rules apply
Unpaid marketing: Rules apply
Social posts: Rules apply
Emails: Rules apply
Web copy: Rules apply
AI-assisted copy: No exemption

The ASA's account of how advertising regulation works explains who is covered and how complaints are handled. For teams in England, AI content operations advertising rules come from the same UK-wide code that applies in Scotland, Wales and Northern Ireland.

Enforcement in England starts with the ASA. A complaint goes to the ASA, its investigations team decides whether the Code has been breached, and the ASA Council publishes a ruling that names the advertiser.

The ASA cannot fine. It orders the ad withdrawn or amended, publishes the adjudication, and can refer persistent non-broadcast breaches to Trading Standards. Trading Standards acts under the Consumer Protection from Unfair Trading Regulations 2008, which make misleading commercial practices a criminal offence.

AI-assisted copy sits under the same rules as copy written by hand. A model's involvement brings no exemption, and the advertiser stays responsible for what goes live.

The ASA publishes its ruling on Ryanair's low emissions claim with the airline named. The same pattern holds for AI-assisted copy: the advertiser answers for the wording, and no one asks which tool drafted it.

The code's core expectations are longstanding: marketing communications should be legal, decent, honest and truthful, and claims need evidence. Name an owner for review, and keep a record that survives a change of staff.

Claims, prices and comparisons

A headline claim needs evidence held before publication. If a model invents a statistic and you publish it, the error is yours. Price statements and comparisons with named competitors attract the most attention.

Superlatives such as best or number one need proof behind them. Green claims sit in Section 11, health claims in Section 12 and ads aimed at children in Section 5, and each draws closer scrutiny than a plain product description.

Before you brief a supplier, read the site's page on AI content operations commercial contracts. Liability for a misleading claim is usually allocated in the contract, not in the tool's settings.

DPA 2018 and the content workflow

Audience data and model training

The Data Protection Act 2018 is the primary statute covering how personal data is collected, used and retained. It applies UK-wide, so an England campaign carries the same duties as one run from Cardiff.

Schedule 1 of the DPA 2018 sets the conditions for processing special category data such as health information, and section 170 makes it an offence to obtain or retain personal data without the controller's consent.

The Information Commissioner's Office regulates this UK-wide and can issue enforcement notices. Its maximum fine is £17.5 million or 4 per cent of annual worldwide turnover, whichever is higher. An individual can complain to the ICO under Article 77 of the UK GDPR.

Data protection workflow

Check lawful basis before prompts
Set and write down retention limit
Delete on schedule
Treat prompts and outputs as records
Handle subject access requests
Record anonymisation test, who, when

Check the lawful basis before any customer list reaches a model. For retention, one workable example is six months for prompt logs and 12 months for sign-off records. Article 5(1)(e) of the UK GDPR, the storage limitation principle, requires you to justify whichever period you choose.

Prompts and outputs count as records too. An exported chat log can therefore fall inside a subject access request under Article 15 of the UK GDPR.

Someone in your audience data can ask what you hold about them. Keeping it tidy is cheaper than reconstructing it later.

Anonymisation and the guidance to watch

The European Data Protection Board has published draft Guidelines 02/2026 on Anonymisation for consultation. It is EU guidance, but the test it describes helps teams handling UK audience data.

Anonymisation means the data can no longer be linked to a person. Pseudonymisation is weaker, and an export carrying account numbers is still personal data.

Small groups are the usual trap. A table showing average spend across five accounts can identify someone even without a name column. Record the test you applied, who applied it and when.

The pre-publish gate: checks before an AI-assisted ad goes live

The pre-flight list

Run these in order and keep the record:

Evidence: name the source for every factual claim and attach it to the draft.
Datarecord the lawful basis and the deletion date for each dataset that fed the prompt.
Fairnessconfirm any comparison with a rival is like-for-like and evidenced.
Sign-offa named person accepts the copy and dates the record.
Reviewrun the gate again when your data sources or tooling change.

A worked example: the draft says the product cuts a heating bill by 30 per cent. The claim file names that figure, holds the trial data behind it before sign-off, and records the marketing lead's approval and the date. With all three entries, the copy passes the gate.

This article is general guidance. A specific campaign, dataset or contract needs a qualified adviser.

Pre-flight publish check

Source named for every factual claim
Lawful basis for each dataset
Ad clear without original brief
Comparison fair, evidenced, like-for-like
Named person signed off final copy
Retention schedule covers prompts and exports

Decision table

Choose

A headline figure from a model draft: Checking the source and keeping a record
Customer emails used as prompts: A lawful basis and a retention limit
A testimonial in the ad: Verifiable, permission-based quotes
A comparison with a named rival: Fair, evidenced, like-for-like wording
Audience data shared with a supplier: Written terms on use and deletion

Avoid

A headline figure from a model draft: Publishing the number because it looks plausible
Customer emails used as prompts: Assuming purchase history covers every use
A testimonial in the ad: Invented or lightly edited praise
A comparison with a named rival: Implying they are worse without proof
Audience data shared with a supplier: Relying on default tool settings

Common questions

Do the advertising rules differ across the UK?

The CAP Code is UK-wide, so the same standard applies in England, Scotland, Wales and Northern Ireland. Broadcast advertising adds extra codes, but the core duty to substantiate claims does not change.

Must we disclose that AI helped write the ad?

UK advertising rules do not require an AI label. If an endorsement or testimonial is used, it must be genuine, and the audience must not be misled about who said it.

Who is liable when a tool generates a misleading claim?

The advertiser, because the CAP Code binds the business that places the ad. Supplier contracts can shift the cost of a fix, so read the terms before launch.

How often should these checks be repeated?

Run them at each campaign sign-off and after any change to your data sources or tooling. A quarterly review of retention and deletion records keeps the paperwork current.