Which rules and ethics govern AI content operations?

What to take away

Does the EU AI Act apply to UK content teams?

The EU AI Act, Regulation (EU) 2024/1689, is an AI-specific law, but it is not a general UK domestic law. It may apply to UK organisations where they place an AI system on the EU market, put one into service in the EU, or use an AI system whose output is used in the EU. Its transparency requirements cover certain AI-generated or manipulated content, including deepfakes; check the system's role and use before publishing into EU markets.

Which data protection rules shape AI content operations?

The ICO regulates data protection across the UK. The UK GDPR is Regulation (EU) 2016/679 as retained in UK law; read it alongside the Data Protection Act 2018 and the Data (Use and Access) Act 2025, which amends aspects of the UK data protection regime. The retained text is Regulation (EU) 2016/679. Content teams meet it early, because prompts, briefs and transcripts routinely carry personal data. A complaint pasted into a chat window is processing, whoever does the typing.

Choosing a lawful basis and cutting the data you send

The UK GDPR expects a lawful basis to be settled before processing starts, not reconstructed after a complaint lands. Article 6(1) sets out seven lawful bases, since recognised legitimate interest took effect on 5 February 2026:

Marketing content may rest on consent, while an internal knowledge base may rest on legitimate interests. Write the basis next to the workflow so a new hire can find it.

Minimisation is the duty teams breach by accident. A prompt carrying a full customer record when the task needs only a complaint category sends more data than the job requires. Redact first, then brief the tool.

Retention applies to prompt logs, drafts and model output as much as to a CRM. If a draft has no continuing purpose, agree a deletion date when the project starts rather than when it ends.

A processor agreement with your supplier governs the supplier relationship. It does not create your lawful basis, and it does not turn an unnecessary transfer into a necessary one.

Purpose limitation is the quieter risk. Data gathered to answer support tickets was not gathered to train a writing assistant, and reusing it needs its own assessment.

Consent needs a record. Where marketing email or personalised content relies on consent, you need evidence of when and how it was given, plus a route to honour withdrawal quickly.

Anonymisation is harder than it sounds. Removing names rarely makes a data set anonymous, because job titles, account numbers and dates can re-identify a person.

Electronic mail marketing is also governed by the Privacy and Electronic Communications Regulations 2003 (PECR). The ICO guidance on direct marketing using electronic mail explains consent, the soft opt-in and unsubscribe expectations under PECR when a tool helps draft or personalise a campaign. Personalisation does not create permission.

Record each workflow's purpose, data types, recipients, retention period, lawful basis and safeguards. Where UK GDPR Article 30 applies, include the processing in the organisation's records of processing activities.

Moderation, special category data and automated decisions

Moderation is where platform rules and data protection meet. The European Data Protection Board has consulted publicly on Guidelines 3/2025 on the interplay between the DSA and the GDPR, which examines how content moderation duties and data protection duties sit together.

Ask separately whether the processing touches special category data and whether a decision is based solely on automated processing and has legal or similarly significant effects. For special category data, identify an Article 9 condition; where processing is likely to be high risk, assess whether a DPIA is required. For significant solely automated decisions, check UK GDPR Article 22 and the applicable safeguards, including human review where required.

Under UK GDPR Article 9, special category data needs an Article 6 lawful basis and a separate condition under Article 9(2), such as explicit consent where applicable. The appropriate condition depends on why and how the data is used. Health, ethnicity and political opinion appear most often in moderation and personalisation work, usually by accident rather than design.

UK GDPR Article 22 and related provisions govern decisions based solely on automated processing that produce legal or similarly significant effects. The Data (Use and Access) Act 2025 amended this regime, so check the applicable exceptions and safeguards; where required, provide a route for the person to obtain human intervention and contest the decision.

Accuracy is the principle content teams underestimate. Published material that misstates someone's circumstances can be a data protection problem as well as an editorial one, and it needs a correction route that works.

Where processing is likely to result in a high risk to people's rights and freedoms, UK GDPR Article 35 requires a data protection impact assessment (DPIA) before processing begins. Not every workflow needs one, but the assessment can reveal whether the design needs less data, stronger controls or human review.

If moderation relies on a third-party classifier, ask what categories it flags and how borderline material is handled. Vague vendor documentation is a risk signal rather than a detail.

How do disclosure and advertising rules apply to AI content?

Disclosure and claim rules overlap, and teams often treat them as one job. They are separate questions: one is about what the audience knows, the other is about what the audience is promised.

Disclosure when a tool writes or edits the copy

No single UK statute says every AI-assisted paragraph must carry a label. The duty comes from the situation: what readers expect, what the presentation implies, and what the platform's terms require.

Marketing communications must be obviously identifiable as such under the CAP code. A paid partnership drafted with a tool is still a paid partnership.

Editorial content is a different case. A byline implies human authorship, so a brand blog that publishes under a named writer should know where the tool stopped and the writer started.

Client work needs a paper trail. Statements of work, briefs and content calendars are the places to record who reviews AI-assisted drafts and what a client has agreed to disclose.

For client-facing work, agree in the brief or statement of work who decides whether AI assistance or synthetic media needs disclosing, who approves the wording and where any label will appear. This does not replace the CAP Code requirement for marketing communications to be identifiable as such.

Platform terms add their own layer. Some advertising systems require disclosure of synthetic media, and some publishing tools expect a label on certain formats, so read the terms for the placement you are buying.

Over-labelling has a cost. A footer disclaimer on every page trains readers to ignore it, so put the disclosure where the audience meets the claim.

The practical test is simple. If a reader would feel misled on discovering how the content was made, disclose it before publication.

Say who approved the wording too. A named approver on the asset is more useful than a generic line saying the marketing team reviewed it.

Claims, substantiation and the advertising codes

The CAP non-broadcast advertising code governs published claims and contains no exemption for machine-assisted copy. The Committee of Advertising Practice (CAP) writes the CAP Code, and the Advertising Standards Authority (ASA) administers it and handles complaints. Substantiation is the pressure point, because an outcome claim needs the same evidence whether a person or a tool wrote the line.

Drafting tools invent specifics. A plausible statistic, a customer quote or a competitor comparison can appear without a source. Each of those turns a careless sentence into a regulatory problem.

Comparative claims are the sharpest edge. Where a briefing tool drafts a claim that one product beats another, the advertiser still needs evidence that the comparison is fair and can be verified.

Sector rules sit on top of that baseline. Financial promotions may also need to meet Financial Conduct Authority (FCA) rules, while health claims and advertising to children have additional restrictions. Route those claims for review against the relevant sector rules before publication.

Images need their own check. Undisclosed synthetic imagery can mislead even when the words beside it are accurate, and the advertiser answers for the final asset.

Reviews and testimonials are a common failure point. A generated endorsement is not a real customer's opinion, and presenting one as genuine is hard to defend.

Training helps here. A writer who knows which claims need sign-off catches more problems than a review stage bolted on at the end of a campaign.

Prices, availability and performance figures change quickly. A claim checked in January can mislead by March, so give any published figure an expiry date.

Where an offer depends on conditions, put those conditions next to the claim. Small print that contradicts the headline is a familiar source of complaints.

How do you govern suppliers, records and review?

Process keeps a policy alive. The work divides into contracts, which allocate risk, and records, which prove you did what you said.

Contracts, indemnities and supplier terms

Supplier terms rarely match the risk the publishing brand carries. A model provider's acceptable use policy is not a warranty of accuracy, and many agreements limit liability in ways that leave the customer exposed.

Settle three points before signing: who owns the output, what happens if it infringes someone else's rights, and who answers for a published claim. Where a supplier offers an indemnity, read what triggers it.

Indemnities are narrower than they look. Check whether cover applies to the output as delivered, to changes you make, or only to the raw response from the model.

Confidentiality cuts both ways. If your briefs contain client data, the agreement should say how it is handled, how long it is kept and who can see it.

Where a supplier processes personal data on your behalf, UK GDPR Article 28 requires a written contract with specified data-processing terms. The clause checklist in AI content operations commercial contracts can help with wider commercial risks, but it does not replace those data-processing terms.

Data processing terms belong in the same conversation. If a supplier processes personal data for you, the agreement should set out purpose, duration and security expectations.

Termination should not leave you without a record. Ask what happens to drafts, prompts and outputs when the contract ends.

Set an internal owner for supplier reviews. Shared ownership of renewals tends to mean nobody reads the terms until something goes wrong.

Nothing here replaces advice. Contract positions turn on specific facts, so a qualified adviser should review anything material before you sign or publish.

Records, review cycles and budget

Accountability is proved with documents. Keep the brief, the tool used, the named reviewer, the sources checked and the approval date for each asset. That file should take minutes to assemble.

The OECD AI Principles are a named, non-binding ethical framework for responsible AI. They cover inclusive growth and well-being, human-centred values and fairness, transparency and explainability, robustness, security and safety, and accountability. NIST publishes technical contributions to AI governance covering risk-management and documentation approaches. Use these frameworks as structure for your controls, not as a legal safe harbour.

Set thresholds for escalation. A claim about money, health or safety should reach a named reviewer before publication, while routine product copy may follow a lighter route.

Review cadence matters more than policy length. A quarterly check of your highest-risk templates catches drift, and a re-check after a supplier changes model versions catches surprises before a customer does.

Budget for the work that compliance adds as well as the software: privacy reviews, advertising-claim substantiation, human review and record keeping. A tool subscription is not the full cost of a governed workflow, so account for the editorial time needed to carry out those checks.

Budget for the boring parts too. Redaction, source checking and record keeping are the tasks that get dropped when a campaign runs late.

For example, a team paying £400 a month for a writing tool and spending six editorial hours a month on checks is buying reviewer attention as well as software. The budget should show both.

Report exceptions rather than hiding them. A missed check recorded honestly is easier to fix than a pattern that surfaces during an audit.

Keep the standard short enough to be used. A two-page rule set that people follow beats a twenty-page document nobody opens.

The table below maps common situations to a default choice.

Common questions

Do we have to label AI-generated content in the UK?

No single rule requires a label on every piece of AI-assisted copy. The duty depends on whether readers could be misled, and marketing content already has to be identifiable as such under the CAP code. A short internal note of where a tool was used is useful even when no public label is needed.

Can we rely on our AI supplier's compliance?

No. Supplier terms cover the supplier's own processing and its acceptable use rules. Your lawful basis, your accuracy checks and your published claims stay your responsibility, so ask for a processing agreement and read the liability clause.

Who is responsible if an AI-drafted advertisement misleads?

As a general position, the brand that publishes the advertisement answers for it. That is why sign-off should sit with a named person who has seen the evidence behind the claim.

How often should the rules be reviewed?

Put a fixed date in the calendar and treat certain events as triggers. New tools, new model versions and new markets change the risk most, so review when those arrive rather than waiting for the annual cycle.