What I Learned Building an AI Governance Framework for a Marketing Agency

When people talk about using AI in marketing agencies, the conversation usually jumps straight to tools.

ChatGPT. Claude. Gemini. Automation. Prompt libraries. Content generation.

But once AI becomes part of everyday work, the harder questions are not really about which tool is best. They are about how people use those tools safely, consistently and responsibly without slowing the team down.

That became clear to me while working on an AI-focused consulting project with a marketing agency. The goal was not to produce a long policy that sat in a folder. It was to build something practical enough that people could actually use it.

Governance cannot feel like bureaucracy

My first instinct was to think about governance in terms of rules. What can people do? What should they not do? What data can be used? Who approves what?

Those questions matter. But in an agency environment, teams are already moving quickly between campaign work, client communication, reporting, content, research and strategy. If governance adds too much friction, people will work around it.

So I started thinking about governance less as a control document and more as a decision-making guide.

Good governance should reduce uncertainty, not create another layer of uncertainty.

The useful questions were much more practical:

• Can I put this client information into an AI tool?
• Does this output need human review before it goes to a client?
• Who is responsible if the AI produces something inaccurate?
• Which tools are approved?
• What happens when someone wants to introduce a new tool?

Human review has to stay central

One of the most important parts of the framework was human-in-the-loop review.

AI can speed up research, ideation, drafting and analysis. But responsibility for the final output still sits with the person using it.

That matters particularly in marketing because an AI-generated response can sound polished and still be wrong. It can invent a statistic, misunderstand a brand tone, misread a brief or produce something that should never be sent to a client.

For me, that meant identifying situations where human review should be non-negotiable:

• client-facing content
• campaign or strategic recommendations
• financial and performance claims
• sensitive or confidential information
• public-facing material

Data protection becomes real very quickly

Marketing agencies work with more sensitive information than people sometimes realise: campaign data, customer information, internal plans, briefs, brand strategy, commercial documents and client communications.

This is also why data governance needs to sit alongside AI adoption. The Information Commissioner’s Office provides specific guidance on how data protection law and good practice apply when AI systems process personal data.

When AI tools are introduced, it becomes very easy to copy and paste information without thinking about where that data is going or how it may be processed.

The framework therefore needed to make one distinction simple:

What information is safe to use, and what information should not be entered into an external AI tool?

The aim was not to turn every team member into a data-protection specialist. The aim was to give people enough clarity to pause before sharing something that should stay internal.

Tool approval matters more than I expected

Another issue was tool sprawl.

A team starts with one AI platform. Then another person tries a second one. Someone finds an automation tool. Another team experiments with something else. Before long, AI adoption becomes fragmented.

That makes governance harder and can also make knowledge sharing harder.

A simple tool-introduction process helped:

1. What problem does the tool solve?
2. What data does it process?
3. Who needs access?
4. Is there already an approved tool doing the same job?
5. Are there privacy or security concerns?
6. Who owns the decision to approve it?

Good governance should improve productivity

This was the biggest shift in my thinking.

At the beginning, governance looked mainly like risk reduction. By the end, I saw that good governance can actually make AI easier to use.

If people know which tools are approved, what information is safe, where human review is required and who owns the process, they spend less time wondering whether they are doing something wrong.

That creates confidence.

The best framework was not the one that said “no” most often. It was the one that created a safer way to say “yes”.

The practical framework I would use

What I would do differently next time

If I were building the framework again, I would involve users even earlier.

The best governance rules come from seeing how people actually use AI, not from assuming how they use it.

I would also connect governance more closely to day-to-day workflows: approved prompt libraries, reusable templates, review checklists, tool ownership and ways for teams to share what is working.

That is where governance becomes part of the operating system of the agency instead of another document.

The main takeaway

The biggest lesson for me is that AI governance is not really about controlling technology.

It is about helping people use technology with better judgement.

For marketing agencies, the challenge is finding the middle ground between speed and control. Too little governance creates unnecessary risk. Too much governance creates friction.

The useful middle ground is a framework that gives people enough clarity to move quickly while still protecting clients, data and the quality of the work.

This way of thinking also aligns with broader AI risk-management approaches : governance works best when it focuses on accountability, risk and practical controls, rather than becoming a checklist for its own sake.

About the author

Shiva Sai Saran works across digital marketing, commercial growth, analytics and applied AI. Based in Glasgow, he focuses on practical ways businesses can use marketing technology and AI more effectively.