Check how AI content operations applications meet UK rules

What to take away

The live rules for AI-written marketing claims in England are the Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024, enforced by the CMA. The Trade Descriptions Act 1968 is largely superseded, though not repealed.
Advertising claims also sit under the ASA and the CAP Code, which ban misleading claims whoever or whatever drafted them.
Personal data in prompts, logs and outputs is an ICO matter under UK GDPR and the Data Protection Act 2018.
Standards work means BSI BS 8611, ISO/IEC 42001 and the UK AI Assurance framework, not a vendor trust page.
Keep one claim record per customer-facing outputclaim, source, approver, date.

Which applications carry the most legal exposure?

Applications that write or edit customer-facing claims sit closest to the law. Once published, a generated line about price, health or performance counts as your own claim.

Internal work carries less risk. Meeting summaries, draft briefs and tagging rarely create exposure. Pricing, guarantees and comparative claims sit at the top, and those need a named human approver.

Application risk bands and sign-off rules

Band	Example output	Who signs off	Recheck
Drafting	Internal briefs, meeting notes	Team lead	Quarterly
Review and edit	Blog drafts, product descriptions	Editor plus topic owner	Quarterly
Publishing and claims	Pricing, health, comparative claims	Named senior approver plus compliance check	Before each campaign

Sort each application into a band, then agree the sign-off rule for that band.

Risk bands by application type

Low risk

Example: Meeting notes
Sign-off: Team lead
Evidence: None needed
Band: Internal

Medium risk

Example: Draft briefs
Sign-off: Editor
Evidence: Source notes
Band: Review

High risk

Example: Pricing claims
Sign-off: Named approver
Evidence: Verified source
Band: Publishing

Which UK regulators and rules apply?

Three bodies matter, and each owns a different slice of the risk. The CMA enforces the Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024, which raised penalties for misleading commercial practices.

Advertising sits with the ASA. Its advertising codes set the standard your copy must meet, whoever wrote it.

Personal data sits with the ICO, and the UK GDPR guide sets out duties for prompts, logs and outputs that hold personal data.

The Trade Descriptions Act 1968 still bans false trade descriptions, though a regulator rarely uses it now.

Where do standards fit?

Three documents shape supplier questionnaires: BSI BS 8611 on ethical design, ISO/IEC 42001 on AI management systems, and the UK AI Assurance framework on testing and evidence.

None is a legal duty on its own. They matter because buyers and suppliers cite them in contracts. The BSI artificial intelligence programme publishes the guidance behind many of those questionnaires.

Ask each vendor to name the framework it maps to, in writing. A team with no written policy should start from our AI content governance framework for UK enterprises, which fixes owners and review dates in one document.

What evidence should you hold before signing?

Keep one claim record per customer-facing output. Four fields are enough to defend it.

Field / What goes in it

Claim: The exact sentence published
Source: The document, dataset or named expert supporting it
Approver: The person who signed it off
Date: Sign-off date and next review date

Example: a tool drafts a line calling your service the fastest in the region. Without a dated source for that comparison, the claim is held rather than published. The evidence file decides, not the tool.

How should you sequence the check before signing?

List every application in live use, by name and owner.
Mark each one as customer-facing or internal only.
For customer-facing applications, write the evidence needed to defend a claim.
Test one live output against that standard.
Record gaps and give each a fix date and a named person.
Set a review date, and repeat the test after any tool or terms change.

Six-step compliance check sequence

List applications by name and owner
Mark customer-facing or internal only
Write evidence needed per claim
Test one live output
Record gaps, assign fix date
Set review date, retest after change

A small team can finish the sequence in about a day. Our fact-checking guide shows how to test a claim against source material without holding up the publishing queue.

What should trigger a recheck?

Four triggers matter: a change in law or regulator guidance, a new version of a cited standard, a change in platform terms, and a shift in your own use.

Each one needs an owner and a response window. A fortnight suits policy review, and same day suits anything touching live claims. Ad copy carries extra wording rules, and our checklist of advertising rules for England covers the phrasings that catch teams out.

Budget for review time, not just licences. A team paying about £400 a month for tooling can spend more on checking output than on the subscription itself.

Common questions

Do we have to follow BSI BS 8611 or ISO/IEC 42001?

Not as a legal duty. Both are benchmarks that suppliers cite in contracts and questionnaires, so reading them helps you ask sharper questions.

Does the Trade Descriptions Act 1968 still apply to AI-written copy?

It remains in force and makes no distinction between human and machine authorship. In practice the CMA pursues misleading claims through the Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024.

How often should we recheck applications?

Quarterly is a sensible baseline for a small team. Add an immediate recheck after any change to the law, a cited standard, platform terms, or the way you use the application.

What is the cheapest first step?

Test one live customer-facing output against the evidence you would need to defend it. That single test usually shows whether your review process is real or assumed.