CMO playbook & advanced tactics: AI & ML in marketing

The AI decision that reaches your board is rarely which vendor to buy. It is who signed off on the asset. A propensity model that underperforms wastes a quarter of media budget and gets fixed quietly. A generated image carrying someone else's character, a chatbot that invents a refund policy, a launch asset nobody in that market approved: those bring legal fees, a regulator's letter, and a team that no longer knows who has authority to publish. Once generative output touches customers at volume, AI stops being an analytics programme and becomes a risk portfolio with your name on it.

This lesson assumes the model types the foundations lesson sets out and the selection method the frameworks lesson gives you. What follows is what a leader arbitrates after the pilot works: exposure, headcount, agency terms, and the controls nobody else in the company will build for you.

Brand and legal exposure from generated output

Three exposures behave differently and need different owners.

The first is ownership of what you make. The US Copyright Office has held that material produced without human authorship is not registrable, a position the courts backed in Thaler v Perlmutter. A key visual generated end to end by a model may not be protectable, so a competitor can reuse it and you have thin grounds to object. If an asset is meant to become brand property (a character, a pack visual, a recurring campaign device), the human contribution has to be real and documented at the time, not reconstructed later.

The second is provenance of the training data. Getty Images sued Stability AI in both the US and the UK in 2023, and whether scraped training data infringes is still unresolved. The consequence for you is contractual: enterprise tiers from Adobe, Microsoft, Google and OpenAI carry copyright indemnities, usually conditional on you leaving their content filters switched on. The cheap generic endpoint carries none. That price gap is an insurance premium, and you decide which asset classes are worth insuring.

The third is disclosure. The EU AI Act has been in force since August 2024 with obligations phasing in, and it requires synthetic content, including deepfake-style imagery, to be labelled. Where that label appears (in the creative, in the caption, or in a statement after a journalist finds out) is a marketing call made under legal constraint.

CocaCocaCustomer Acquisition Cost: total sales and marketing spend divided by the number of new customers acquired over the same period.View full definition →-Cola shows both edges of the same choice. Create Real Magic in 2023, built with OpenAI and Bain, let consumers generate artwork from a constrained library of brand assets, contour bottle and Santa included, with moderation in front of it: a controlled way to hand the brand to strangers. Its AI-produced remake of "Holidays are coming" in 2024 drew loud criticism about craft and uncanny detail, and Coca-Cola ran an AI version again the following year anyway. Read that as a deliberate trade: production speed and volume, accepted against some share of the audience deciding the brand got cheap. The arbitration you owe your team is which assets may make that trade and which carry the craft signal you are not willing to spend.

One edge case to put in front of your customer care lead: in February 2024 the British Columbia Civil Resolution Tribunal held Air Canada liable for a bereavement fare its chatbot had described incorrectly. The sum was trivial, the principle is not. A generative surface that answers policy questions publishes policy, so it needs the review cycle your terms page gets.

The headcount arbitration, and its reversal

Klarna ran the most public version. In February 2024 it said its OpenAI-built assistant was handling two-thirds of customer service chats in its first month, equivalent to the work of about 700 full-time agents, with a projected profit improvement near $40m for the year. On the marketing side it reported roughly $10m in annualised savings, a large share of it in image production, cut external agency spend by around a quarter, and compressed asset turnaround from weeks to days. Total headcount fell from about 5,000 towards 3,800, mostly through a hiring freeze and attrition.

In 2025 the CEO said quality had suffered and Klarna began recruiting human agents again, on a more flexible staffing model.

The savings were booked in one year and the rebuild landed in the next, which is the shape most of these decisions take. What you cannot re-buy at the original price is tacit knowledge and a production bench that knows your brand. Apply the same split to marketing output: assets where variance is tolerable (resizes, feed ads, product copy, always-on social) and assets where it is not (brand film, launch positioningpositioningThe mental space you want your brand to occupy in your target customer's mind relative to alternatives.View full definition →, anything regulated). Automate the first, protect the bench for the second, and before you cut, put a number on what rehiring to today's standard costs and how many months it takes.

The agency arbitration

WPP and Publicis have each announced AI investment programmes in the hundreds of millions. When your agency's own cost base falls, an FTE or hours-based fee holds your price flat while their margin moves. Reopen the terms before renewal, and put four things in writing:

• disclosure of where generative tools are used in work delivered to you
• a warranty on training data provenancedata provenanceData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition →, with the vendor indemnity flowing through to your entity
• ownership of prompts, fine-tunes and anything trained on your brand or customer data
• pricing on delivered outputs and usage rights instead of hours

The clause people skip is the third one. If your performance data and brand assets can train a shared model the agency sells onward, you have funded a competitor's starting position.

Insourcing has a volume threshold. A modular asset library plus a small in-house studio beats agency production only at sustained volume, well into the hundreds of assets a quarter; below that you are paying for idle capacity and inheriting a hiring problem.

Governance you own and cannot delegate

Consent state and field-level permissions belong upstream in the data layer the server-side tracking foundations lesson describes, not in a suppression rule inside a campaign tool, because that rule dies in the next reorg. Twilio's Segment, a customer data platformcustomer data platformSoftware that unifies customer data from every source into one persistent profile that marketing, sales and service teams can act on.View full definition → that sells exactly this plumbing, is a common enforcement point; what matters is that the model never receives the fields you promised not to use, whoever provides it.

Four controls, and they are yours because no other function will build them:

• a register of every model and generative surface in production: owner, data source, last retrain, and the customer-facing decision it touches. The test is whether you can answer "what does this system know about this named customer and what did it send her" inside a day
• published sign-off tiers. Named human approval for synthetic content in paid mediapaid mediaVisitors arriving via paid ads or sponsored placements, where you pay a platform to display your message rather than earning visits organically.View full definition → and anything touching health, finance or minors; no approval needed for internal drafts. One page ends most of the arguments
• a kill switch with an owner who can disable a generative surface within an hour on a Sunday, and a marketing name on the on-call rota
• a retraining cadence with a person accountable for drift, reviewed in the same meeting as media performance

Numbers that set the downside

EU AI Act penalties reach up to 35m euros or 7% of global turnover for prohibited practices, and up to 15m euros or 3% for breaches of other obligations. GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → already exposes you to 4% of global turnover on the consent side. In September 2024 the FTC ran a set of enforcement actions against companies making deceptive AI claims, which cuts both ways: the AI language in your own marketing is regulated too, so "AI-powered" in a headline needs the same substantiation as any other performance claim.

CMO action items

• Inventory every customer-facing generative surface within 30 days, put a named owner on each, and switch off the orphans. Most organisations find more than they expected, usually in customer service and paid social.
• Classify your asset library into variance-tolerated and craft-protected, then publish the sign-off tier for each class.
• Reopen the agency contract on disclosure, provenance, model ownership and output pricing before the renewal window closes.
• Fund the register and the retraining cadence out of the first year of savings, and quantify the rehire cost before you cut a production team.

Common mistakes that kill results

• Treating disclosure as a legal formality. The label is part of the creative and belongs in the brief, not in a post-crisis statement.
• Booking AI savings as a permanent headcount reduction. Klarna's reversal is the reference case: plan for the possibility that you buy some of it back.
• Accepting vendor defaults. Disabling a content filter to get a better image usually voids the indemnity you are paying for.
• Owning the model and not the data contractdata contractA formal agreement between the team that produces data and the teams that use it, defining structure, meaning, quality and who is accountable when it breaks.View full definition →, so your brand and performance data end up improving a supplier's shared product.
• Leaving decay unowned. A model trained on last year's behaviour degrades quietly, and the first symptom is a pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → number nobody can explain.