Who Owns AI Content Compliance..? Spoiler: It’s You!

AI-generated content moves across Creative, Marketing, Legal, IT and external agencies. The risk appears when each team assumes somebody else is responsible.

From 2 August 2026, Article 50 of the EU AI Act introduces transparency obligations for providers and deployers of certain AI systems. These include requirements relating to machine-readable marking of AI-generated or manipulated content and disclosure of deepfakes and certain public-interest content.

Relevant breaches can attract administrative fines of up to €15 million or 3% of total worldwide annual turnover, depending on the organisation and circumstances.

That level of financial exposure will attract executive attention. But for most enterprise content teams, the immediate risk is more practical.

• Who knows whether AI was used?
• Who records that information?
• Who decides what review is required?
• Who confirms that the correct version was approved?
• Who applies the disclosure?
• Who prevents an incomplete asset from being distributed?

In many organisations, there is no single answer.

The responsibility is fragmented across several functions, suppliers and systems. Each may perform part of the process, but nobody owns the complete chain from creation to publication.

That is where AI content compliance breaks down.

Key takeaways

• Article 50 creates regulatory, operational and reputational risk for organisations using certain AI-generated or manipulated content.
• AI content compliance cannot sit entirely with Legal, Creative, Marketing or IT.
• Each function owns a different part of the process, but the controls must remain connected around the asset.
• The greatest exposure appears during handoffs between teams, agencies, systems and markets.
• Content Operations is well placed to coordinate the workflow, preserve evidence and control whether content is ready for activation.
• The desired outcome is not more manual review. It is clearer ownership, rules-based workflows and management by exception.

The fine is only the most visible risk

The potential penalty makes AI content transparency difficult to ignore. However, a compliance failure can create costs long before a regulator becomes involved.

A campaign may need to be paused while teams investigate whether an asset contains synthetic material. Published versions may have to be withdrawn from several markets. Agencies may need to reconstruct how content was produced. Legal teams may have to review dozens of derivatives to establish whether the original approval still applies.

These problems become significantly more expensive once content has been distributed across social platforms, retail media networks, websites, connected television and regional campaigns.

One missing record can affect an entire family of assets.

There is also a reputational issue. A brand that cannot explain how synthetic content was produced, reviewed and disclosed may appear either careless or deliberately opaque. Neither interpretation supports audience trust.

The financial risk drives attention. The operational and reputational exposure makes this a wider business issue.

Why no single department can own the entire process

AI content compliance contains several different responsibilities.

Legal teams interpret regulation and define policy. Creative teams know how content was made. IT controls systems and data. Marketing decides how content will be used. Agencies may produce the original asset. Content Operations manages how it moves through the organisation.

No individual function has all the information or authority required to govern the complete lifecycle.

The problem is not that responsibility is shared. It has to be shared.

The problem is that shared responsibility is often undefined.

When roles are unclear, organisations rely on assumptions:

• The agency assumes the brand will apply the disclosure.
• Marketing assumes Creative recorded where AI was used.
• Creative assumes Legal approved every derivative.
• Legal assumes the approved version is the one being distributed.
• IT assumes the creative platform preserved the relevant metadata.
• Regional teams assume global approval applies to local adaptations.

Each assumption creates another opportunity for information, accountability or control to disappear.

What Legal and Compliance own

Legal and Compliance should define the organisation’s interpretation of the relevant requirements and translate that interpretation into usable policy.

This includes determining which uses of AI require specialist review, when disclosure may be necessary, what evidence should be retained and which types of content present greater regulatory or reputational risk.

But policy alone does not create compliance.

Legal cannot manually follow every asset through editing, localisation and distribution. It needs its decisions to become operational rules that other teams and systems can apply consistently.

The outcome Legal needs is not a larger approval queue. It is confidence that the right assets are being escalated, the correct version is being reviewed and the final decision is retained as part of the content record.

What Creative teams and agencies own

Creative teams and external production partners are closest to how the content was produced.

They should be able to record whether AI was used, which elements were generated or manipulated, which tools were involved and whether synthetic content remains in the final version.

This information needs to be captured during production and handover, not reconstructed immediately before publication.

Agency agreements and creative briefs should also establish clear expectations around AI use. These may include requirements to declare generative AI, preserve relevant source information, identify synthetic talent or voices and provide enough production history for the client to govern the finished asset.

The outcome is not to restrict responsible creative experimentation. It is to ensure that the organisation receiving the content also receives the information needed to use it safely.

What Marketing and Brand teams own

Marketing and Brand teams own the intended use of the content.

They determine where an asset will appear, which audience will see it, which markets and channels are involved and how closely the content is associated with the organisation’s public identity.

That context matters because the same asset may present different risks depending on how and where it is used.

A generated image used in an internal workshop is not operationally equivalent to a synthetic spokesperson appearing in a public advertising campaign. A master asset approved for one territory may require a different decision when adapted for another market.

Marketing therefore needs visibility into approval status, usage restrictions and disclosure instructions before activation. It should not have to search through email chains or rely on the memory of the production team.

The outcome is faster activation with greater confidence that the content is appropriate, approved and ready for its intended destination.

What IT and Security own

IT and Security own the infrastructure through which the evidence must travel.

Relevant content information may begin in a generation platform, move into an editing environment, pass through a review system, enter a DAM or MAM and eventually reach a publishing or advertising platform.

If those systems do not preserve or exchange the required information, the governance process breaks even when the policy is sound.

IT teams need to understand whether current systems can:

• capture AI-use information at ingest
• preserve asset relationships and version history
• retain relevant metadata during transformation
• integrate approval and distribution records
• provide appropriate access controls and auditability

The outcome is an infrastructure layer that supports governance rather than forcing every team to maintain separate manual records.

What Content Operations owns

Content Operations is not a replacement for Legal, Creative, Marketing or IT.

Its role is to connect their responsibilities around the asset.

Content Operations defines how content enters the organisation, how it is structured, how versions relate to one another, which reviews are triggered and what must happen before an asset can be distributed.

It turns policy into workflow.

That may mean ensuring that AI-use information is captured during ingest, connecting a localised derivative to its approved master, routing higher-risk content to Legal or preventing an asset from moving to activation when required information is missing.

Content Operations also provides the operating evidence. It should be possible to see what happened to an asset, who approved it, which conditions applied and where it was ultimately used.

The outcome is a repeatable content governance system rather than a series of disconnected checks.

The handoffs create the greatest exposure

Most failures will not occur because every team ignored the policy.

They will happen because the information did not survive a handoff.

An agency may accurately record AI use, but that information may not enter the client’s asset system. Legal may approve the master, but the regional team may create a new derivative afterwards. Marketing may apply a visible disclosure, but the final publishing record may remain disconnected from the approved asset.

The workflow therefore needs to preserve three connected forms of evidence:

Asset evidence

What is the content, where did it come from and how was AI used?

Decision evidence

Which rules applied, who reviewed it and what was approved?

Activation evidence

Which version was published, where did it run and what disclosure or restrictions accompanied it?

When these records are connected, the organisation can demonstrate control.

When they are separated, every compliance question becomes a manual investigation.

A practical ownership model

A useful operating model is to assign one accountable owner to each stage while preserving shared visibility across the process.

Creation

Primary owner: Creative team or agency

Record how AI was used and provide the relevant source and production information.

Policy assessment

Primary owner: Legal or Compliance

Define the applicable rules, escalation criteria and disclosure expectations.

Asset governance

Primary owner: Content Operations

Capture the evidence, preserve version lineage and route the asset through the correct workflow.

Technical enablement

Primary owner: IT and Security

Ensure systems can retain, transfer and audit the relevant information.

Activation decision

Primary owner: Marketing or channel owner

Confirm that the approved asset, destination and intended use remain aligned.

Ongoing evidence

Primary owner: Content Operations, supported by IT

Retain the decision, version and distribution history for future review.

This creates clearer accountability without pretending that one team can own every element of compliance.

The objective is management by exception

You can’t just send every asset to Legal!

That approach will become less viable as generative AI increases content volume and the number of versions produced for different audiences, platforms and markets.

A scalable workflow should use structured information and rules to determine which content can move through a standard process and which requires specialist judgment.

An asset with complete production information, a familiar use case and a previously approved workflow may proceed through standard controls. Content involving synthetic people, cloned voices, manipulated real-world events, missing provenance or sensitive public-facing claims may require escalation.

Human reviewers then focus on the cases where their expertise creates the greatest value. This protects judgment without making governance the next content bottleneck.

What a successful operating model delivers

Clear ownership should create more than compliance documentation. It should help the organisation achieve four practical outcomes.

Lower regulatory and reputational risk

The organisation can demonstrate how content was created, reviewed and approved, reducing uncertainty when a decision is challenged.

Faster investigations and remediation

Affected assets and derivatives can be identified quickly rather than discovered manually across multiple tools and markets.

More consistent decision-making

Defined workflows reduce variation between teams, regions and agencies.

Faster content activation

Lower-risk content can move through standard processes without waiting for unnecessary manual review, while genuine exceptions receive the right attention.

Good governance improves speed and control at the same time.

How Overcast helps connect the responsibilities

Overcast helps organisations translate AI content policies into structured, repeatable workflows.

Relevant AI-use and source information can form part of the asset record as content enters the organisation. The relationship between source material, edited masters and subsequent derivatives can remain visible as content moves through production and localisation.

Rules can then be applied according to the content, market, channel and intended use. Missing information or higher-risk cases can be flagged and routed to Legal, Brand, Editorial or another appropriate reviewer.

The precise version, approval decision, restrictions and permitted use can be retained alongside the asset. Content that has not completed the required process can be prevented from moving towards activation, while approved assets can proceed with a clearer record of what was decided and why.

Overcast does not determine an organisation’s legal obligations or replace legal advice. It provides the content intelligence, workflow, approval and governance infrastructure required to apply those decisions consistently across teams and channels.

AI compliance needs an owner, but not a silo

Article 50 creates a clear reason for organisations to act. Relevant transparency failures can carry significant financial penalties, while weak governance can also lead to campaign disruption, remediation costs and loss of trust.

But assigning the problem entirely to one department will not solve it.

AI content compliance spans production, policy, infrastructure, approval and activation. Each function has a role, but those roles need to operate through one connected content lifecycle.

• Legal defines the rules.
• Creative records what happened.
• IT preserves the evidence.
• Marketing controls the use.
• Content Operations connects the process.

That is how shared responsibility becomes operational control.

Assess whether your responsibilities are connected

The AI Content Provenance Readiness Checklist helps Marketing, Creative, Legal, IT and Content Operations teams assess whether ownership and evidence remain connected throughout the content lifecycle.

It examines:

• where AI-generated content enters the organisation
• whether teams and agencies record AI use consistently
• who decides which governance rules apply
• whether approval relates to the exact asset version
• whether relevant information survives editing and localisation
• whether incomplete content can be prevented from distribution
• whether the organisation can identify every published derivative
• whether responsibilities are clear when an incident occurs

The result is not a legal determination. It is a practical assessment of whether the current operating model is capable of managing AI-generated and manipulated content consistently.

This article provides general information about Content Operations and AI transparency. It does not constitute legal advice. Organisations should seek appropriate legal guidance when interpreting the EU AI Act or determining their own obligations.