We spent hours doing a marketing audit for a client. Conversations. Listening. Asking questions. Then diving into data, systems, martech, campaigns, channels.
We used AI for some of it. Not all of it.
Some data was too sensitive to drop into an AI tool. Some of it lived in places AI can’t reach. And some of it AI would happily analyze, except it’s made things up enough times that the trust isn’t there for everything.
For a blog post, a made-up number is annoying. For a decision about where a regulated institution puts its marketing budget for the next year, it’s a different kind of problem.
The obligations you already have around member and organizational data didn’t get suspended because the AI tool has a text box. If you wouldn’t email a member list to somebody outside the organization, don’t paste it into a model that lives outside the organization. Same information, same exposure, different interface.
And this matters more for small and mid-sized institutions specifically. The big shops can afford enterprise agreements with model providers, legal review, controls on where data lands. Most credit unions under $500M don’t. Which means the tools your team is actually using are the free consumer ones, where you have no agreement, no guarantees, and no way to know where anything went.
That’s not an argument against AI. It’s an argument for knowing which tool you’re in.
I’m not your compliance officer. But the question is almost never “is this allowed with AI.” It’s “would this be allowed with any other outside tool.” Your compliance team can answer that in about a minute.
Most of the confusion clears up once you sort the work into three buckets.
The value isn’t in picking a side on AI. It’s in knowing which bucket a given task belongs in, every time.
This is the part that gets underestimated.
AI does not flag when it’s guessing. It gives you a number in a tidy paragraph, and the part it actually knew and the part it filled in look exactly the same. There’s no tone shift, no hedge, no asterisk.
If you know the subject, you catch it. If you don’t, you don’t.
Which means the risk isn’t distributed evenly. The more junior the person using the tool, the more likely a fabricated answer sails straight through into a report, a board deck, or a campaign.
That’s an argument for oversight, not for banning the tool.
You don’t need a forty page document. You need a few things everyone actually knows.
Name the tools that are approved and the ones that aren’t, and be specific. “Use AI responsibly” is not a policy.
Say plainly what categories of information never go into any AI tool, in language a marketing coordinator can apply without calling legal.
Require a human check on anything factual before it goes out, and name who that is.
And decide who’s accountable when something’s wrong. That’s usually the gap. Everyone assumes someone else verified it.
We use AI constantly. It drafts, it organizes, it eats the repeatable work. What it doesn’t do is decide what matters, and it has no idea which number is load-bearing.
Everybody uses AI now. That’s not the question anymore.
The question is whether the person running your marketing can tell you where they stopped using it. And why.
If you’re trying to figure out where AI fits in a regulated marketing function, that’s a leadership conversation before it’s a tooling one. Let’s talk.
Not a dedicated one. The obligations come from rules that already apply, including GLBA Section 501(b), the Interagency Guidelines Establishing Information Security Standards, and FFIEC examination guidance. AI does not get an exemption from any of them.
Anything identifying an individual member or customer, anything covered by your data agreements, and anything you would have to account for to an examiner. A reviewed enterprise tool under a vendor agreement is a different question from a free chatbot. Confirm specifics with your compliance team.
A human who knows the subject reviews anything factual before it goes out. The risk rises when the reviewer knows less than the tool appears to.
It is simpler, not safer. Blanket bans tend to push usage underground where there is no oversight at all, and they cost you the legitimate value. A clear policy with named tools and named boundaries works better.
Founder, Tara Lilly & Co. · Fractional Marketing Leader
Tara Lilly is the founder of Tara Lilly & Co. and a fractional CMO for B2B companies. She leads strategy and brings a senior team of specialists who use AI to execute. Before starting the company, she spent 15+ years leading marketing teams across credit unions, agencies, and startups, including work on Volvo Trucks North America.
