AI content review: who approved this version?

Consider a recruitment group with several brands and local agencies producing campaigns across different markets. A central team approves what goes out. Group policy says that if AI played a meaningful part in making the content, the audience should know.

An agency submits version three of a recruitment campaign for two EU markets: a photographic-looking image of three people in a warehouse, all generated, with copy drafted in an AI tool and edited by the brand team. The copy includes a first-person claim about being hired within two weeks of applying. Nobody gave that testimonial.

Before it goes out, someone asks: does this need a disclosure?

A label is only part of the answer. The reviewer also needs to know what changed, what the image is intended to represent, what supports the hiring claim and which version they are being asked to approve. That is the practical job of AI content review: connecting the content a company wants to publish with the reasons a responsible person is willing to approve it.

The decision is harder than the label

Companies are already trying to make these calls. In its April 2026 member research, the World Federation of Advertisers reported that 78 percent were using AI-generated or AI-enhanced content in consumer-facing marketing. Sixty-one percent reported difficulty with unclear or fragmented regulatory obligations, while 67 percent had internal rules. These are findings from WFA member research, not estimates for every company. WFA's research summary describes the gap between adoption and consistent disclosure practice.

The recruitment group's policy gives its teams a starting point. It does not establish whether the agency had permission to use its source material, whether a claim is supported or whether the final export matches what legal reviewed.

Without that information attached to the asset, the work repeats. A marketing manager asks the agency for history it has already supplied. Legal reviews a version that is no longer current. A local team cannot tell which changes would require another review.

Start with the asset's history

For this campaign, the submission should identify the exact image and copy, the generation tool, available prompt and input history, relevant licence terms, the AI draft and the brand team's edits. It should also state the intended audience, the two markets and the publishing channel. The question "Was AI used?" is too coarse to support the decision.

The agency says no reference photograph of a real person was used. Its prompt notes, however, refer to an earlier campaign that photographed real staff. Did those photographs go into the tool, or was the reference only a written description? If source photographs were used, what permissions cover that use? A declaration and the evidence supporting it need to remain distinguishable.

The hiring line raises a separate question. It reads as someone's experience, but nobody said it and no evidence supports the two-week outcome. An AI label would not substantiate that claim. The reviewer asks what informed the image and requires the team to remove the invented testimonial and substantiate any replacement claim.

Content Credentials can help with the history. The Content Authenticity Initiative's technical introduction explains how signed provenance and content bindings can make changes detectable. Valid credentials do not prove that everything depicted is true, or that every assertion is complete. They are evidence for the review, not a publication decision.

Keep the three rulebooks separate

For an EU-facing campaign, a reviewer may need to assess the law, the publishing platform's requirements and the company's own policy. They can lead to the same action for different reasons.

Article 50 of the EU AI Act distinguishes providers' duties to make certain AI outputs machine-readable as AI-generated or manipulated from deployers' disclosure duties. Those duties should not be collapsed into a single statement that every use of AI needs a visible label.

For deployers, Article 50 covers disclosure of deepfakes and AI-generated or manipulated text published to inform the public on matters of public interest. The text provision includes an exception where there is human review or editorial control and a natural or legal person holds editorial responsibility. That text exception does not extend to deepfake images, audio or video.

The European Commission's guidance makes the operational point clear: superficial checks, such as correcting grammar, are not substantive human review. Context also matters when assessing whether an image is a deepfake. Inventing a person or scene does not, by itself, settle that assessment.

For the warehouse image, the reviewer must consider what job seekers are likely to believe it depicts. The text needs its own assessment of purpose, content and editorial responsibility. The applicable platform rules must be checked for the actual channel and use, rather than assumed from another platform's policy.

The group's own policy already calls for disclosure in this example. Record that basis alongside the legal and platform assessment. If another rule also requires disclosure, identify it. If a particular duty does not apply, retain the reasoning. This is an operational control, not a claim that the law prescribes one universal approval template.

Approve the corrected version, not the promise to correct it

Version three goes back with the two evidence requests. The brand team removes the invented testimonial and the unsupported timing claim. The agency supplies a written account of the reference material and the available input history. The reviewer assesses that response against the supporting material; the agency's confirmation is not treated as independent proof. If a material question remains unresolved, publication stays on hold.

Once the reviewer is satisfied with the evidence and the corrections, the revised image-and-copy package becomes version four. The approval identifies that version, the reviewer, the two-market scope, the required disclosure and the reasons for the decision. It records the legal and platform conclusions separately from the group-policy basis for the label. Any remaining conditions must be checked before publication.

The final export is checked against version four, including its disclosure, and the published asset is recorded against the approval that covered it. That closes the gap between agreeing what should change and checking what actually went out.

When a local adaptation undoes the decision

Two weeks later, the second market translates the campaign and puts the first-person hiring line back in its own language. That is version five. It changes a claim the reviewer required the team to remove.

The record shows that version four was approved and version five was not. The adaptation goes back for review rather than inheriting an approval it never had. The local team can see why the line was removed, what evidence was missing and which decision its edit affects.

This is where the record earns its place. The team does not have to find the original officer and ask what they remember. The same principle underlies an audit-ready evidence pack: another person should be able to reconstruct the decision from the material retained.

What the next reviewer needs

Keep the record specific enough to answer:

• Which file and version did the reviewer see?
• What was generated or changed, and what evidence supports that account?
• Which market, audience and channel did the review cover?
• Which legal, platform or company rules drove the decision?
• What was missing, and how was it resolved?
• Who decided, for what reasons and on what conditions?
• Which version was actually published?

Recording a gap does not make it acceptable. The accountable person must decide whether it prevents publication. A later edit should be assessed against the basis of the approval, not waved through because an earlier version passed.

Where cmpliance fits

cmpliance's AI content review approach is organised around this publication decision. Its initial focus is text and still images in EU-facing marketing, using the asset's declared and evidenced history.

The operating model gives agents the preparation work: assemble the available history, compare it with approved rules, identify missing evidence and prepare a sourced assessment. Legal requirements, platform rules and company policy stay distinguishable. A responsible reviewer decides whether to approve, reject or ask for more information.

The intended record connects that decision to the asset version, supporting evidence and any disclosure required. This is the same division of responsibility that makes four-eyes review useful: the system prepares the work; the reviewer remains accountable for the call.

For a company evaluating its process, start with one piece of AI-assisted content already published. Give the file to a colleague who did not handle the campaign. Can they find the history, understand which requirements applied and identify who approved that version?

If the answer depends on finding the right person and asking what happened, the next useful step is to make the decision reviewable. Bring us that approval path.

Agents do the work. Humans make the call.

Talk to cmpliance