AI policy for the marketing department: rules, GDPR and template

Why does the marketing department need an AI policy?

The marketing department needs an AI policy because it works with customer data, numbers and campaigns that aren't public yet. The Danish Data Protection Agency recommends that workplaces set a framework for whether and how employees may use generative AI. The agency says so in its security tip on AI tools and mentions guidelines, awareness and fixed procedures.

The EU AI Act also sets a requirement. Businesses that use AI systems must take steps to strengthen their employees' AI skills. They don't have to guarantee a specific level for each individual. The Danish Agency for Digital Government describes the requirement, as it stands after the latest changes, on its page about AI Omnibus.

The third reason is the brand. AI without rules writes like the average. A policy that gives the tools your tone and your examples makes the copy sound like you.

What can you put into an AI tool?

Only put in what you're comfortable sharing with the tool's provider. The Danish Data Protection Agency recommends avoiding confidential and sensitive personal data and anything else you don't want shared with the provider or others. That's in a news item from the Danish Data Protection Agency on AI tools.

A simple way to write this into the policy is three colours:

• Green: public and anonymous. Your published copy, product data, keywords and customer statements without names or contact details.
• Yellow: internal, approved tools only. Campaign plans, briefs and numbers that aren't public. Only in the version of the tool the business has approved.
• Red: not in prompts. Names, emails, phone numbers, customer lists and CRM exports. Health information and CPR numbers. Passwords and keys. Other people's confidential material, e.g. contracts.

If you still need to work with personal data in an AI tool, that's a decision for the business, not for the individual employee. It requires you to have the agreement with the provider in order.

Can you use ChatGPT under GDPR?

GDPR doesn't mention any specific tools. The rules apply when you process personal data, and you also do that when you type it into a prompt. So the question is what you put in, and what agreement you have with the provider.

The Danish Data Protection Agency points to three things in its news item on AI tools:

• The tools often use the data for the provider's own purposes, e.g. to develop the tool.
• The data can become part of the tool's dataset and in some cases turn up in answers to others.
• Many providers let you opt out of the data being used for training. In some cases, the provider may still collect data, so read the privacy policy and the terms.

If a tool is to process personal data for you, first clarify who is the data controller and who is the data processor. The Danish Data Protection Agency explains the difference between the two roles and says it is very important to clarify the roles before the processing begins.

Does AI-generated content need to be labelled?

AI-generated content must be labelled in some cases. The EU AI Act has transparency rules that apply from 2 August 2026. The Danish Agency for Digital Government goes through them on its page about transparency obligations.

For marketing, three rules are worth knowing:

• Deepfakes. If you use AI for images, audio or video that resemble real people, places or events and could falsely appear genuine, you must disclose that the content has been artificially generated or manipulated.
• Text on matters of public interest. If you publish AI-generated text to inform the public about such matters, you must disclose it. This doesn't apply if a person has reviewed the text and someone holds editorial responsibility.
• Machine-readable labelling. The providers of the tools must label AI content in a machine-readable format. For tools that were on the market before 2 August 2026, this applies from 2 December 2026.

The ad platforms also have their own rules for AI content in certain types of ads. Read the platform's terms before you use AI images or AI voices.

What do copyright and the Marketing Practices Act mean for AI content?

Rights and claims are your responsibility, whether or not AI has helped. The Danish Marketing Practices Act requires you to be able to document your factual claims. That's in section 13 of the Act. A number an AI has made up is not documentation.

Write three rules on rights into the policy:

• Only put in images, logos and copy that you hold the rights to.
• Never ask the tool to imitate a named artist, photographer or competitor.
• Check the tool's terms for commercial use before you use the output in a campaign.

Who should approve copy written with AI?

A named person who knows the subject must approve everything that goes out. It's that person who stands behind the copy, not the tool. Approval is more than proofreading. The person checks numbers and quotes against the source, corrects what doesn't hold up, and can answer for the copy afterwards.

Also write down what AI must never create. Reviews and customer quotes must be the customers' own words. The same goes for statements from employees or partners.

How does AI copy get your tone of voice?

AI copy gets your tone when the tools get the same rules as your copywriters. Gather them in one place, and let them come with every task:

• your tone of voice written as short rules
• the words you use, and the words you never use
• three to five pieces of copy you're proud of, as examples
• customers' own words from reviews and enquiries, without names

We've written more about how to write with ChatGPT.

Template: a one-page AI policy

An AI policy doesn't need to be long. It should be readable in five minutes and usable on a busy Tuesday. This template covers what a marketing department needs:

1. Purpose and owner. Why the policy exists, and who owns it.
2. Approved tools. Which tools and versions you use. Private accounts are not used for work.
3. Data. Green, yellow and red from above, with examples from your own day-to-day work.
4. Approval. Who approves what before it goes out.
5. Sources. Every number, quote and claim is checked against the source.
6. Labelling. When you disclose that something has been made with AI, and who decides in cases of doubt.
7. The brand. Where the tone of voice and examples are kept, and that they always come along.
8. Updates and training. When the policy is reviewed, and how new colleagues learn it.

Amplify's own working rules for AI

At Amplify, AI is part of day-to-day work. Our own AI agent works in clients' ad accounts every day, and the specialists write with AI at hand. That's why we've written the rules down, and they apply to both:

1. A person approves. The agent suggests, and the specialist approves before a change is made or a piece of copy goes out.
2. No personal data in prompts. When the agent pulls customers' words from reviews, the reviewer's name is never included, and phone numbers and emails are hidden.
3. Sources are checked. Numbers, quotes and rules are checked against the primary source. The rules in this article have been looked up with the authorities themselves.
4. The client's rules come along. Each client has one file with tone, fixed rules and words to avoid, taken from the client's design manual. The specialists and the agent read it before they write.
5. Real words from real customers. We never write reviews or customer quotes ourselves, and neither does AI.
6. Corrections become rules. If a specialist rejects a suggestion, the reason becomes a rule the agent follows next time. As of 12 November 2026, the collection holds 482 written rules, and 427 of them apply to all clients.
7. Doubt is escalated. If we're unsure about labelling or legal matters, the question goes to me and from there often to the client's own adviser.

The rules are pruned too. At the latest review, 687 learnings were merged into the 482 rules. In 16 places, two rules said different things, and they were settled one by one. A collection that only grows keeps nothing in order. It's the clean-up that keeps it in use.

That's also the answer to why an AI policy isn't a document you write once. It takes shape along the way, every time someone corrects something and saves the reason.

Frequently asked questions about AI policies

What should an AI policy contain?

At a minimum, an AI policy should say which tools you may use, what you may put into them, and who approves what comes out. For marketing, it should also cover sources, labelling and tone of voice. The template above has eight points and fits on one page.

Can you put customer data into ChatGPT?

Only if the business has decided so and has the roles and the agreement with the provider in order. The Danish Data Protection Agency recommends avoiding confidential and sensitive personal data in AI tools. Until the decision has been made, the rule is simple: no customer data in prompts.

Do you have to say that a text was made with AI?

It depends on the content. From 2 August 2026, the EU AI Act requires disclosure of deepfakes and of AI text intended to inform the public on matters of public interest. The text is exempt if a person has reviewed it and someone holds editorial responsibility. The ad platforms also have their own rules.

How often should an AI policy be updated?

Review it at least once a year, and every time you start using a new tool. The rules are shifting too. According to the Danish Agency for Digital Government, the AI Act entered into force on 1 August 2024, and the rules are being phased in gradually up to 2028.

Your next step

Set aside half an hour with the marketing team next week. Write down which AI tools you use today and what you put into them. Sort it into green, yellow and red. What's in red is the first thing the policy needs to address. Use the template above, and keep it to one page.

If you're unsure where the line between yellow and red lies for you, get in touch with us.