A named person, never the tool. At a bank, credit union or insurer, AI can draft, but every piece goes through two approvals before it's published: marketing checks the brand and compliance checks rates, terms and disclosures. What AI changes is where the draft lives: private, inside the enterprise account, until someone approves it and the approval is on record.
The problem isn't that AI writes badly. It's that it writes fast, sounds confident, and doesn't know today's rate.
Why does AI-generated content need its own workflow?
Volume, first. In the ABA's survey of bank marketers, AI use in marketing went from 16.9% in 2024 to 50.4% in 2026. More drafts, same compliance team.
Then the kind of mistakes. The usual errors in an AI draft for a financial product:
- Invented or stale rates and fees. The tool uses what it found, not what your institution charges today.
- Promises the product doesn't keep. "Instant approval," "no fees," "the best rate in Texas."
- Missing terms. The ad states a payment amount but not the APR or the repayment terms.
- Testimonials or numbers nobody gave. A happy customer who doesn't exist, or a statistic with no source.
Which US rules does AI marketing copy trip over?
None of these rules care whether a person or a tool wrote the ad. The institution is responsible either way.
| Rule | What it says | What to check in the draft |
|---|---|---|
| Regulation DD, 12 CFR 1030.8 (credit unions follow the NCUA's Part 707) | Ads can't be misleading or inaccurate. An account can't be called free if a maintenance or activity fee may be imposed. A stated rate of return must be the annual percentage yield | No "free" unless no fee can apply; rates stated as APY |
| Regulation Z, 12 CFR 1026.24(d) | Trigger terms (downpayment, number of payments or repayment period, payment amount, finance charge) require the downpayment, repayment terms and APR | A payment amount or term in the copy pulls in the full disclosures |
| 28 Tex. Admin. Code 21.122 | Insurers must keep a system of control over the content, form and dissemination of their ads, and no insurer may avoid responsibility by having someone else prepare or approve them | AI is just another "someone else." The insurer still owns the ad |
| HIPAA, 45 CFR 164.508 | Using protected health information for marketing generally requires the patient's written authorization | No patient story, photo or detail without a signed authorization |
| FTC rule on fake reviews (in effect since October 2024) | Bans reviews and testimonials that misrepresent who wrote them, including AI-generated ones | No invented testimonials, ever |
Who approves what?
A simple workflow with clear roles:
| Step | Who | What they check |
|---|---|---|
| 1. Draft | Marketing, using the institution's enterprise AI account | The draft, following the brand guide and current rates |
| 2. Brand review | Brand or marketing lead | Voice, logo, colors, theme, and that it looks like the institution |
| 3. Compliance review | Compliance | Rates, fees, trigger terms, disclosures, promises |
| 4. Legal or privacy review, when needed | Legal or privacy officer | Comparisons, testimonials, sweepstakes, anything with patient information |
| 5. Publish | A person with publishing rights | That the published version is the approved one |
Two rules that aren't up for debate. AI works only inside an enterprise account your organization manages, such as Claude Enterprise or Gemini in Google Workspace, never in personal accounts. And AI doesn't publish: publishing is always a person's action.
Where does the draft live while it waits for approval?
This is the risk almost nobody looks at. An AI draft can go live by accident: a test page that gets indexed, a link someone shares too early, an old file reused with last quarter's rate.
The draft should live somewhere that:
- Starts private, so nobody outside the team can see it.
- Records every version, with who asked for it and who changed it.
- Treats publishing as a separate, deliberate step, approved by someone other than the drafter.
In linkable.id, our brand governance platform, that's how pages built through the Claude connector work: they stay private until a person publishes them, publishing requires a separate permission on the consent screen, Claude can't delete anything, and every action is logged under the requester's name. Who approves publication is set by your own workflow.
An honest caveat: changes Claude makes to themes, Brand Vault values or widgets on pages that are already live apply immediately to everything that uses them, the same as if someone made them in the dashboard. If you want strict control, give the people who use Claude a role without permission to edit themes or the Brand Vault.
How do you keep compliance from becoming the bottleneck?
If AI multiplies the drafts, compliance can't review every comma from scratch. The way out is to approve the fixed pieces once and review only what changes:
- Approved disclosures in one place. Legal text, account terms and required statements are stored approved and reused as-is.
- Current rates in a single source. When a rate changes, it changes in one place, not in 40 files.
- A voice guide with banned phrases, loaded into the AI tool: "guaranteed," "free" when a fee may apply, superlatives with no support.
- Focused review. Compliance reviews the variable part: the offer, the rate, the promise.
Another honest caveat: as volume grows, approval can turn into a rubber stamp. If your compliance team never sends a draft back, the workflow isn't reviewing anything.
How do we handle it at Andes?
We build the whole workflow: the enterprise AI account and its rules, the brand guide the AI follows, and the platform where drafts wait for approval. If you don't yet know which AI tools your team uses, start with how to control shadow AI. And to bring AI to the rest of the institution, see our AI for regulated institutions service.
Is your team already publishing AI-made content?
If it is and nobody can say exactly who approved each piece, that's the first fix. See how linkable.id works and let's talk about your workflow.
Sources
- CFPB, 12 CFR 1030.8, Advertising (Regulation DD): https://www.consumerfinance.gov/rules-policy/regulations/1030/8/
- CFPB, 12 CFR 1026.24, Advertising (Regulation Z): https://www.consumerfinance.gov/rules-policy/regulations/1026/24/
- 28 Tex. Admin. Code 21.122, Advertising by insurers (Cornell LII): https://www.law.cornell.edu/regulations/texas/28-Tex-Admin-Code-SS-21-122
- FTC, Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials (August 2024): https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials
- eCFR, 45 CFR 164.508, Uses and disclosures for which an authorization is required: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
- ABA Banking Journal, Bank marketers are all in on AI (June 2026): https://bankingjournal.aba.com/2026/06/bank-marketers-are-all-in-on-ai/