The checklist
- Inventory. List every AI tool and feature in the funnel — copy drafting, image generation, personalization, lead scoring, reply routing, chatbots — including AI features switched on inside tools you already pay for.
- Owner. Name one accountable person per use case.
- Data limits. Write down what customer data each use may see, and confirm it matches your privacy notice and consent records.
- Human review. Decide which outputs need a person to review them before they reach a customer. (Ours: anything AI drafts or scores.)
- Disclosure. Decide when AI involvement is disclosed to customers — for example, when they're talking to a chatbot.
- Logging. Keep a record of AI-assisted steps so you can explain an output later.
- Regulatory mapping. Map each use to the rules it touches: state privacy laws (such as the CCPA and the Texas Data Privacy and Security Act), GDPR where EU residents are involved, and the EU AI Act where applicable.
- Review cadence. Re-check the inventory on a schedule and whenever a tool, use or rule changes.
The questions boards and clients ask
- Where are we using AI with customer data today?
- Who reviewed the output before it went out?
- Could we explain why a given lead was scored or a message was chosen?
- Is this use covered by what we told customers?
- What would we show a regulator or an enterprise client's security review?
Where the EU AI Act stands (November 2026)
The EU AI Act entered into force on August 1, 2024. Its prohibited-practice rules and AI literacy obligations applied from February 2, 2025, and general-purpose AI model obligations from August 2, 2025. The Digital Omnibus on AI, published in July 2026, pushed back the high-risk system obligations: stand-alone (Annex III) high-risk systems now apply from December 2, 2027, and high-risk AI embedded in regulated products (Annex I) from August 2, 2028.
Most marketing uses aren't high-risk under the Act, but transparency duties around chatbots and AI-generated content, and the obligations that were never delayed, still matter for teams that reach EU audiences.
Start small
You don't need a framework document to begin. A one-page inventory with owners, data limits and review rules covers most of the risk. Zielit's AI governance work starts there, and every AI touchpoint we set up through AI enablement ships with that record.
This article is general information about marketing operations, not legal advice. Laws and agency rules change; confirm how they apply to your business with qualified counsel.
Frequently asked questions
What should an AI governance checklist for marketing include?
An inventory of AI uses, a named owner for each, data limits, human-review rules, disclosure rules, logging, a mapping to applicable regulations, and a review schedule.
When do EU AI Act high-risk obligations apply?
After the Digital Omnibus on AI published in July 2026, obligations for stand-alone (Annex III) high-risk systems apply from December 2, 2027, and for high-risk AI in regulated products (Annex I) from August 2, 2028. Prohibited practices and AI literacy rules have applied since February 2, 2025.
Is marketing AI high-risk under the EU AI Act?
Usually not, but each use should be assessed, and transparency duties can still apply to chatbots and AI-generated content.