DisclosureGuardRegulatory dossier

Blog · ← All posts

Agency AI-Disclosure Workflows: Who Labels What

Last updated: October 13, 2026 · 8 min read

By the Ingenious AI team

Disclosure fails at agencies the same way everything fails at agencies: nobody owned it. The strategist assumed the designer labeled it. The designer assumed the media buyer checked the ad-platform toggle. The media buyer assumed the client knew. Nobody did anything, and the client found out from a Reddit thread.

The fix isn't more awareness. It's a workflow with names attached. Here's a RACI-style model that works for a 12-person agency and scales to a 60-person one.

The principle: disclosure is a production stage, not a thought

Treat disclosure like color grading or QA, a stage in the pipeline with an owner, a checklist, and a sign-off. Not a value the company holds. A thing someone does, at a specific time, with a specific deliverable.

Why does this framing matter? Because "we take disclosure seriously" is what every agency says right up until the moment it costs ten minutes on a Friday afternoon. Stages survive Fridays. Values don't. If disclosure lives in the schedule, it happens. If it lives in the culture deck, it happens until the first deadline crunch, and then it doesn't.

A worked example: the 20-asset product launch

To make this concrete, here's a hypothetical walkthrough. A mid-size agency is running a product launch: 20 assets, mix of social video, display ads, and YouTube pre-roll. The creative lead is using AI for backgrounds, the copywriter is drafting in an LLM, the video editor is upscaling and cleaning audio with AI tools. The client is a consumer brand selling in the EU and the US.

Without a workflow, here's what happens: the backgrounds get generated and nobody writes it down. The YouTube pre-roll goes up and whoever uploads it skips the "AI use" toggle because nobody told them it was AI-assisted. The display ads go to Google Ads and the disclosure copy field sits empty. Three weeks later the client's legal team asks for the AI-use documentation, and the account manager has to reconstruct it from Slack threads. Sound familiar?

With the workflow below, each of those failure points has an owner who catches it. Walk through the five stages with this campaign in mind.

Stage 1 (Brief): Account manager declares AI intent

At the brief stage, the account manager (or whoever owns the client relationship) records one thing: will AI tools be used in production, and if so, where?

This takes five minutes and prevents the single most common disaster: the client discovering AI use after delivery. Get the sign-off in the brief, and the "but we didn't know" conversation never happens.

In our 20-asset example, this is where the account manager writes: "AI-assisted production approved for: background generation (social + display), copy drafting, audio cleanup and upscaling. Final creative direction human." The client replies "approved." That email is now the foundation everything else stands on.

Stage 2 (Production): Creators label as they go

The person touching the tools records what they used, per asset. Not at the end of the project, as they go, when the memory is fresh.

Practical tip: make this a column in whatever tracker you already use, Asana, Notion, a spreadsheet. Don't build a new system. The record we recommend has five fields, and a creator fills it in thirty seconds per asset. The agency that waits until delivery day to reconstruct this from memory is the agency that gets it wrong.

For the launch example: the designer logs each background ("Midjourney v7, background plate; product shot human-photographed"), the editor logs the upscales, the copywriter logs the drafted variants. Thirty seconds per asset, twenty assets, ten minutes total. That's the entire cost of stage 2.

Stage 3 (Pre-flight): Media/traffic checks platform requirements

Before anything goes live, the person who publishes verifies the destination's specific requirements. This stage exists because disclosure rules differ by platform, and the creator can't be expected to know all of them.

This is the stage where automated help pays for itself. When we built DisclosureGuard's ad-platform pre-flight, the idea was simple: simulate what Google's "How this ad was made" and Meta's AI panel will show before launch, because the media buyer shouldn't have to guess. Whether you use our tool or a manual checklist, someone has to play this role.

In the launch example, pre-flight catches the two misses from the bad timeline: the YouTube uploader gets a one-line instruction ("set AI use to Yes, backgrounds are AI-generated"), and the Google Ads disclosure copy gets written before launch instead of after the first disapproval.

Stage 4 (QA): A second pair of eyes

One person who didn't make the asset verifies the disclosure record against the asset itself. This is the stage most agencies skip, and it's the one that catches the embarrassing misses.

The export check deserves emphasis, because it's the number-one silent killer we see in our drift testing. A designer exports from Photoshop with one preset and the manifest survives; the video editor's export preset discards all metadata. Same agency, same project, different outcomes per asset, and nobody notices because nobody checks the delivered file. Stage 4 is where you notice. If you want to see how your own exports fare, run a file through our free drift check before you build the habit into QA.

Stage 5 (Archive): The record lives with the project

When the project closes, the disclosure record goes into the project archive, same folder as the final files and the invoice. Six months later, when the client's new CMO asks whether the 2026 campaign imagery was synthetic, the account manager opens the archive instead of guessing.

That client-facing summary is underrated. A one-page "AI use and disclosure summary" attached to final delivery does three things: it documents your diligence, it gives the client's team something to forward to legal without bothering you, and it differentiates you from every agency that delivers files with no provenance at all. We've heard the objection, "won't this scare clients?" In practice, clients who've been burned by undisclosed AI work read it as exactly what it is: evidence that you take their risk seriously.

The escalation path: what happens when QA finds a miss

Every workflow needs a failure mode. When the QA reviewer finds a missing label or a stripped manifest, the rule is simple: stop the publish, not the project.

The asset goes back to production for re-labeling, not to the media buyer for a "quick fix." Why? Because only the creator knows what was actually AI-generated; the media buyer can add a platform toggle but can't write an accurate provenance record. Re-labeling takes ten minutes when the production record exists. It takes a forensic exercise when it doesn't, which is exactly why stage 2 comes before stage 3.

Log the miss. One line: which asset, what was missing, who fixed it. After a month you'll see the pattern, usually it's one export preset stripping manifests, or one creator skipping the log. Fix the pattern, not the person. If the same preset keeps killing manifests, change the preset. If the same creator keeps skipping the log, the problem is the thirty-second habit, and that's a training conversation, not a blame conversation.

The subcontractor hole (and how to plug it)

The workflow above assumes the agency controls the whole pipeline. Real agencies don't: white-label work, subcontractors, and client-supplied assets all punch holes in it. The subcontractor hole is the biggest, because the person generating the asset works for someone else and your stages don't reach them.

The fix is one line in the statement of work: "Subcontractor provides a per-asset AI-use record (file name, tools used, AI-generated vs. AI-edited vs. human-made) with each delivery." That's it. No new system, you're just requiring the same five-field record you'd keep internally, delivered with the files. When the subcontractor's assets hit your stage 4 QA, your reviewer checks their record the same way they'd check an internal one. If a subcontractor can't tell you what tools touched the files, that's information too, and it belongs in the client's risk picture.

For client-supplied assets, the rule is simpler: you can't certify what you didn't make. Note "client-supplied, provenance unknown" in the record and let the client own that risk explicitly.

How to know it's working

You don't need a dashboard. Track three numbers for a month:

If misses caught at QA hits zero in week one, be suspicious, it usually means the reviewer is rubber-stamping. Rotate the role and check the delivered files yourself once. Trust the workflow, verify the workflow.

Where this breaks down

Two honest caveats. First: no internal workflow covers every jurisdiction. If a campaign runs in China, the EU, and the US simultaneously, you need the actual per-market requirement list, not a general process, China's rules demand both visible and machine-readable labels, the EU's Art. 50 requires disclosure to reach the viewer, and US state laws are a patchwork. Process gets the labels applied; expertise tells you which labels.

Second: this workflow protects you against your own mistakes, not against platform false positives. Meta's automated labeling has misfired on real, human-made photos, that's a machine's verdict you can't prevent, only contest, and contesting it is easier when your per-asset record exists.

But here's what the workflow does solve: the "nobody owned it" problem. Every stage has a name. Every handoff has a record. When something goes wrong, and with social platforms recompressing files and stripping metadata daily, something will, you know exactly where it broke and who fixes it.

Start with one client. Run the five stages on one campaign. You'll find the friction points in a week, and you'll have a disclosure story to tell every other client.

Scan your first piece of content free →

Related reading