An AI ethics policy that lives on a wiki page is not an ethics policy — it is a screensaver. The frameworks that hold up are project-level decisions about what to disclose, what to govern, and what to refuse, made before a brief is accepted rather than after a piece of work has gone live. The interesting work is in the second category: governance is where ethics either becomes operational or quietly evaporates.
Why most AI ethics statements do not survive contact with a brief
Most agency and brand-team AI ethics statements share a structure. They open with a paragraph about transparency, list three or four principles — honesty, accountability, human oversight — and close with a line about responsible innovation. The document is signed off by leadership, posted to the careers page, and never consulted again. When a brief lands that involves AI-generated imagery, a synthetic voiceover, or an LLM-drafted campaign, the team makes the decision on instinct and the statement plays no role in it.
The reason is structural. A principles document tells a team what it believes; it does not tell the team what to do on Tuesday at three when the client asks whether the headline image is a real photograph. A useful AI ethics framework reverses the polarity. It is built from the decision points a brand team actually encounters in a project, and for each one it specifies three things: what to disclose, what to govern, and what to refuse.
The three operational questions
Disclosure is the easiest of the three. It asks whether the audience needs to know AI was involved in producing the work. Governance is harder. It asks who is responsible for the output, how it was reviewed, what the team would say if asked to defend it under scrutiny, and what the audit trail looks like. Refusal is the hardest. It asks under what conditions the team should decline the brief or the technique outright, even when both are commercially attractive.
A serviceable framework treats these three questions as a sequence and works through them at the point of brief acceptance, not the point of delivery. The questions need to be answered specifically — for this brief, this audience, this output, this regulatory context — not in the abstract. A principle that "we disclose AI use where appropriate" is not a policy. A rule that "for this client, in this campaign, the AI-generated hero image must carry a credit line in the social caption and a footnote in any earned-media use" is.
What to disclose, and to whom
Disclosure has at least three audiences and the answers can be different for each. The end audience — the customer or reader who encounters the work — needs disclosure when AI involvement materially changes what they think they are seeing. A photorealistic image of a product that does not yet exist needs disclosure. A stock photograph that was lightly retouched in Photoshop does not. The line sits roughly where audience expectation about realism breaks.
The client needs a different and broader disclosure. Anything that affects copyright, indemnity, training-data provenance, or future regulatory exposure should be on the table during brief acceptance — not in the small print at delivery. Clients often discover halfway through a campaign that the agency has been using a generative tool whose terms preclude commercial use, or whose training data includes copyrighted material with active litigation. The disclosure conversation belongs at the front of the engagement.
The internal team needs a third kind of disclosure: an honest record of where AI sat in the production process, what was prompted versus authored, and what was kept versus discarded. This is the audit trail that lets the team defend the work in twelve months when someone asks how it was made. Without it, defending the work becomes an exercise in collective memory.
What to govern: the audit trail nobody wants to build
Governance is the work most teams skip because it has no visible output. The brief gets done; the asset ships; nobody notices that there is no record of which model produced the image, what prompt was used, what guardrails were applied, or who signed it off. Six months later, when a question arrives about whether a figure in the campaign is a real person or a synthetic likeness, nobody on the team can answer with confidence.
A modest governance layer covers four things: model and version, prompt and parameters, human reviewer and approval timestamp, and the rights basis for any source material referenced in the prompt. None of this needs to be elaborate. A row in a spreadsheet per AI-assisted asset, kept alongside the campaign archive, is enough for most teams. The point is not to satisfy a future auditor. The point is to make sure the team itself can answer the question "who decided this, on what basis, and against what guardrail" without resorting to guesswork.
Governance also covers the inverse case: the decisions to
not use AI. When a campaign deliberately commissions human-made work in a category where AI generation would have been cheaper and faster, that decision is also a brand decision and worth recording. It is part of the ethics framework whether or not the tool was used.
What to refuse: the line that is almost never written
Refusal is the part of the framework that gets treated as commercially awkward and therefore left out. It is also the part that matters most. The framework that is silent on refusal is not really a framework — it is a permission slip with a conscience attached.
Refusal lines tend to cluster around a handful of categories. Synthetic likenesses of real people without informed consent is the clearest. Generated images of children, regardless of how lawful the dataset, is another. AI-authored content that the work makes a sincerity claim around — a founder's letter, a CEO's editorial, a thought-leadership piece — is a third. Any deployment where the audience is asked to make a high-stakes decision (medical, financial, legal, civic) on the basis of AI-generated reassurance is a fourth.
The refusal list will be shorter than the disclosure list, and it should be written down. The act of writing it down is the act of committing the team to it. Refusal lines that exist only in the principal's head get crossed when the principal is on holiday and the deadline is Friday.
How the framework should be sized to the team
A common failure mode is over-engineering. A four-person studio does not need a twelve-page ethics document. A multinational with brand work across regulated industries does. The framework should be sized to two things: the volume of AI-assisted work the team produces, and the regulatory exposure of the client base.
For a small team working across non-regulated B2B brands, a one-page framework with three columns (disclose / govern / refuse) and a quarterly review is usually sufficient. For a team working in financial services, healthcare, or any client base subject to consumer-protection or advertising standards regulation, the framework needs to be longer and the governance layer needs to be more rigorous. The point is not to make the document impressive. The point is to make it usable on a Tuesday at three.
Working with clients who do not have a framework
Many brand engagements begin with the client having no AI policy of their own. This is itself a brand decision that needs surfacing. If the client's policy is silent and the agency's is firm, the client effectively inherits the agency's policy through the engagement. That should be made explicit at brief acceptance, not assumed.
For clients without a framework, the most useful initial move is a short joint document — not a policy in the legal sense, but a working agreement that covers what will be disclosed, what will be governed, and what is off the table. This document gets revisited at each project phase. It is the smallest viable ethics artefact and it puts both sides in possession of the same set of rules.
What This Looks Like in Practice
In the work with
Antidote Africa, the question of synthetic imagery was live from the first brief. The campaign needed photography of communities the team could not visit at scale, and generative tools could plausibly have closed the gap. The framework decision — recorded before any image was made — was to refuse synthetic likenesses of any community member, commission local photographers in each region, and disclose the production model in the campaign credits. The cost was higher and the timeline longer. The downstream effect was that the campaign withstood close scrutiny from partner NGOs whose own ethics standards forbade synthetic depiction of beneficiaries. The framework did not produce the campaign; it kept the campaign defensible. That is what a working framework does.
Closing
The AI ethics framework that holds up is the one that lives where the work is made — at brief acceptance, in the production governance, and in the refusal conversations that never reach a brief. Disclose, govern, refuse: three operational questions, answered for each project specifically, with a record kept of how they were answered. The principles statement on the website is the smallest part of the policy. The decisions made on Tuesday at three are the policy.
If you are building or revisiting an AI policy for your brand work and want a second pair of eyes on it,
we are happy to talk through what an operational framework would look like for your team.
