Chapter 5. Brand Review Workflow

Learning objectives

• Translate brand guidelines into instructions, rationales, examples, and structures that AI can follow.
• Determine review stages and responsible parties according to AI content risk types, and design approval flows.
• Establish procedures to verify rights (copyright, identifying marks, terms of service) for AI-generated images, videos, and voices.
• Select control methods for cases where Prior approval is difficult, such as real-time or automated content.
• Establish post-publishing monitoring plans, and execute procedures to recall problematic content and prevent recurrence.

Introduction

What marketing teams experience three months after introducing generative AI is usually similar. In the first month, production volume multiplies several times over, and everyone is delighted. In the second month, the review queue piles up, creating pressure to "publish what AI made quickly." In the third month, an accident occurs. An unsupported metric is hung on a banner, Withdrawn Recommendation copy is revived through automated combinations, or an AI face resembling a celebrity goes out in an advertisement.

Most of the time, the cause of the accident lies not in the AI, but in the workflow. Who checks what was not defined, risky assets and ordinary assets stood in the same line, and no one knew what to watch after publishing. If the preceding four chapters addressed "what is correct," this chapter addresses "how to make that judgment consistently across hundreds of cases every day and across multiple people."

A good workflow does not increase the number of reviewers, but pulls judgments forward. When you specify in advance what may be used in the brief, who verifies what in the risk tier, and what to do if a problem arises in the recall procedure, the quality of review does not collapse even when production volume grows.

This chapter organizes a single flow starting from how to convey brand guidelines to AI, through tiered reviews by risk level and role division, rights verification, control of real-time content, to post-publishing monitoring and recall.

Key concepts

Why a workflow is necessary

Responsibility for AI content rests with the company. Under the Act on Fair Labeling and Advertising, responsibility for advertising lies with the business entity that conducted the advertising (Chapter 1), the duty to disclose Recommendations also applies to advertisers (Chapter 2), and the company also bears responsibility for sending advertising and customer data (Chapter 3). A business entity that causes damage to consumers through unfair advertising cannot avoid liability on the grounds that there was no willful misconduct or negligence (Article 10, Paragraph 2 of the Act on Fair Labeling and Advertising). The explanation that "the AI wrote it that way" does not reduce liability.

The NIST AI Risk Management Framework (AI RMF) directs organizations to translate this responsibility into organizational structure. GOVERN 2.1 specifies that roles, responsibilities, and communication channels related to identifying, measuring, and managing AI risks must be documented. Translated into a marketing workflow, this means writing down "which assets, by whom, under what criteria, are reviewed when, and if a problem arises, who is notified."

Writing brand guidelines so AI can follow them

"Write in line with our brand tone" is an ambiguous instruction even for a human. Prompt best practices in the official Claude documentation suggest treating AI like a capable new employee who lacks context, and recommend testing whether a colleague could follow along with minimal context. There are five principles you can use when translating brand guidelines into instructions.

1. Be clear and specific: State the desired output format and constraints (length, honorifics, prohibited expressions, mandatory disclosures).
2. Provide the rationale: According to the documentation, when you share the context and motivation behind instructions, the model better understands the goal and generalizes. Instead of "Do not use the word 'Complete cure'," write "Because our product is not a pharmaceutical product, promising therapeutic effects could mislead consumers, so explain it using feel and ingredient information."
3. Choose examples carefully: Examples are among the most reliable ways to guide format, tone, and structure. The documentation recommends providing 3 to 5 examples that resemble real use cases (relevance), are sufficiently distinct from one another to avoid learning unintended patterns (diversity), and are separated by tags (structure).
4. Divide into structures: Dividing instructions, context, examples, and input using tags such as <instructions>, <context>, and <examples> reduces the likelihood that the model mixes up content. This is especially important when managing multiple brands with a single set of instructions.
5. State what to do rather than what not to do: The documentation explains that it is more effective to tell the model "what to do instead" rather than "what not to do."

Below is an example of translating brand guidelines into instructions.

<context>
Brand: 'Breathing Wall' eco-friendly paint. Reader: People in their 30s and 40s decorating their homes themselves.
Tone: Polite language, within 40 characters per sentence, one or fewer exclamation marks per paragraph.
</context>
<instructions>
1. Use only ingredients, certifications, and test results found in <facts> below. Do not invent non-existent figures.
   Rationale: Factual claims in advertising must be proven by the company with documentation.
2. Instead of absolute expressions such as 'Non-toxic' or '100% safe', write certification names and test items verbatim.
3. Output the result as 1 headline and 3 body sentences.
</instructions>
<facts>
(List of certifications and test results verified by the substantiation documentation lead)
</facts>
<examples>
<example>(Approved copy 1: Living room wall, short sentence style)</example>
<example>(Approved copy 2: Children's room, opens with a question)</example>
<example>(Approved copy 3: Entrance hall, includes application tips)</example>
</examples>
<input>
(Product information to use this time)
</input>

The brief: What to decide before generation

Good results come from good briefs. Before delegating work to AI, finalize the following in the campaign brief.

Tiered review by risk level

Reviewing all assets with the same intensity creates a bottleneck, and bottlenecks ultimately lead to "it is urgent, so let's just post it." Conversely, treating everything lightly allows risky assets to slip through. The solution is to categorize by risk.

Using AI for primary classification is a good approach. Having it flag numbers, rankings, superlatives, and the appearance of persons enables you to gather high-tier candidates quickly. However, assets excluded from that classification must still undergo human review at the low tier, because detection tools can miss things.

Roles and responsibilities

Define who does what at each review stage. In a small team, one person may take on multiple roles, but for the same asset, it is best to separate the creator and the approver.

Review checklist

The checklist gathers the determinations from the previous chapters onto a single page.

1. Factual claims: Is substantiating documentation attached to every claim regarding numbers, rankings, superlatives, comparisons, efficacy, certifications, and AI technology? Do the subject, conditions, and period of the documentation match the copy (Chapter 1)?
2. Price and discounts: Is the Regular price the recent actual selling price? Are the discount rate, covered items, and disclosures of period and quantity truthful (Chapter 1)?
3. Recommendation and reviews: Are the wording, placement, format, and language of the disclosure of material connections correct? Are disclosures for Virtual personas present, and are experiential lines absent? Have reviews not been altered or merged (Chapter 2)?
4. Transmission: The recipient's consent, nighttime consent, and opt-out status; specified items under Attached Table 6 ('(Ad)', sender information, free opt-out method) (Chapter 3).
5. Data: Legal basis for data used in personalization and processing environment (Chapter 3).
6. Rights: Rights to persons, voices, and images, and terms of service (this chapter).
7. Records: Are the decisions, rationales, and discarded alternatives preserved?

Rights verification 1: Copyright and human contribution

Article 2, Subparagraph 1 of the Copyright Act defines a work as "a creative production that expresses human thoughts or emotions." Therefore, outputs generated by AI without human creative contribution can hardly be protected as copyrighted works. In marketing, this definition becomes important in two situations.

First, when a company wants to protect an AI-generated character or illustration as its own asset. Even if a competitor uses a similar image, parts that AI generated virtually as-is are difficult to block using copyright. Retaining parts that a human redrew, selected, arranged, and modified in work records (drafts, revision history, workers) provides evidence when determining the scope over which protection can be claimed. If you are considering copyright registration, you must distinguish between the parts created by AI and the parts created by a human. To protect brand identity, review other regimes such as trademarks as well.

Second, when an AI output is similar to another person's copyrighted work. If an output that is very similar to a specific artist's painting or a famous character is generated, the problem does not disappear merely because an AI created it. Do not use outputs that bring real existing works to mind, or submit them to a rights review.

Rights verification 2: Face, voice, and name

Article 2, Subparagraph 1 (p) of the Unfair Competition Prevention and Trade Secret Protection Act defines as an act of unfair competition the act of infringing on another person's economic interests by unauthorized use for one's own business, in a manner contrary to fair commercial practices or competitive order, of identifying marks of another person that are widely recognized in Korea and possess economic value, such as a name, portrait, voice, or signature.

The classic scenario where this provision becomes an issue in AI advertising is inserting a celebrity's name into a prompt to create "a voice like [Name]" or "a face resembling [Name]." If the output brings that person to mind, you must remove it or obtain permission from the person directly. Adding an 'AI-generated' label does not resolve the issue of infringing upon that person's interests. When using real persons in advertisements, also check portrait usage permission as well as the celebrity provisions in the Guidelines for Review of Recommendations and Endorsements (Chapter 2).

Rights verification 3: Terms of service of generation services

Whether AI outputs can be used in advertising is not determined across the board by law, but by the terms of service of each service and pricing plan. Whether commercial use is permitted, the attribution of rights to outputs, prohibited uses, and indemnification conditions may vary by service, and even within the same service, between individual or free plans and enterprise plans.

There are three practical principles. Designate services used under corporate accounts and contracts, and restrict the use of personal accounts. Record commercial use terms and verification dates for each approved service. If terms change, re-verify the conditions of use for existing assets.

Where disclosure obligations overlap

Multiple disclosure obligations can overlap in AI content.

Article 31 of the AI Basic Act imposes different obligations on AI business operators by paragraph. Paragraph 1 covers Prior notice when providing products or services that utilize high-impact AI or generative AI; Paragraph 2 covers labeling that the outputs of generative AI were generated by generative AI; Paragraph 3 covers notice and labeling when providing virtual audio, images, videos, etc., that are Difficult to distinguish from reality. The obligation to label outputs under Paragraph 2 does not arise solely because an AI is high-impact. The Enforcement Decree provides exceptions for cases such as use exclusively for an operator's internal business purposes. If a company provides AI features to customers (e.g., AI styling Recommendation, AI consultation), this article must be reviewed. How using AI as a tool to create advertising assets is treated depends on the factual circumstances; check the original text of the statute and government guidelines, and obtain expert review if necessary. The exam for this course focuses on disclosures under advertising laws, the Guidelines for Review of Recommendations and Endorsements, and transmission rules.

Control of real-time and automated content

There are types of content that cannot receive Prior approval on a case-by-case basis, such as AI chat responses during live broadcasts, banners automatically generated based on customer behavior, or automated dispatches by an AI agent. In such cases, shift the object of approval from individual outputs to generation conditions.

1. Scope limitation: Ensure generation occurs only within pre-approved response scopes, templates, and fact lists (prices and inventory connected to real-time data).
2. Real-time monitoring: Have a designated lead watch, and put kill switches in place to stop operations immediately if signs of anomalies appear (incorrect pricing, prohibited expressions, sudden surge in complaints).
3. Logging: Retain all generated results to serve as evidence for post-hoc inspections and corrections.

NIST AI RMF MANAGE 4.1 directs post-deployment monitoring plans to include mechanisms to receive and evaluate input from users and stakeholders, appeal and human override, operational stoppage, incident response, recovery, and change management. Real-time content control translates this requirement into marketing.

Post-publishing monitoring

Publishing is not the end of review, but the beginning of management. A monitoring plan includes the following:

On sponsored posts, it is common for disclosures to be deleted or moved inside 'See more' after publishing. Because advertisers are also subjects of disclosure obligations, check regularly and request corrections.

Recall and preventing recurrence

Problematic AI assets are handled in the following order:

1. Suspension: Take down the asset across all channels, and halt scheduled publishing and dispatches that use the same asset.
2. Scope assessment and documentation: Record the exposure period, channels, impressions, and affected customers. NIST AI RMF MANAGE 4.3 directs that incidents and errors be communicated to stakeholders (including impacted individuals), that tracking, response, and recovery procedures be followed, and that they be documented.
3. Correction: Provide corrective notices if necessary, and address customer harm if present. Voluntary correction made by a company is distinct from an administrative disposition by the Fair Trade Commission. For reference, corrective measures that the Fair Trade Commission may order against unfair advertising include discontinuation of the violating act, publication of the fact that a corrective order was received, and corrective advertising (Article 7 of the Act on Fair Labeling and Advertising).
4. Root cause analysis: Identify at which stage the issue failed to be filtered out. Was a checklist item missing, was the tier classification incorrect, or was it published without approval?
5. Remediation: Update procedures, checklists, instructions, and asset repositories. MANAGE 2.3 directs following procedures to respond to and recover from newly identified risks.
6. Find identical patterns: Re-inspect other assets to ensure none were created due to the same cause.

Managing the asset repository

If an AI automatically creates banners by combining photos and copy from an asset repository, the repository itself is an object of control. Attach the following information as metadata to each asset:

• Source and rights status (self-shot, purchased, AI-generated + service name, scope of license and expiration date)
• For Recommendation and review assets, the endorser, timing of Recommendation, product version, and Withdrawn status
• If there are factual claims, substantiation documentation and expiration date
• Eligible channels and prohibited combinations

The Guidelines for Review of Recommendations and Endorsements stipulate that if an endorser modifies or withdraws a Recommendation, the original Recommendation may no longer be used; if circumstances arise regarding the product or environment that could alter the content of the Recommendation, the endorser must be notified and the Recommendation may not continue to be used until re-obtained. If the repository lacks 'Withdrawn' and 'Product modification' statuses, AI will combine Withdrawn Recommendations again without hesitation.

Going deeper

Is it safest for humans to review everything?

The rule that "the legal team reviews all AI assets" may seem safe, but in practice, it is dangerous for two reasons. First, review requests exceeding throughput capacity create a backlog, and backlogs invite exception approvals and workarounds. Second, a person reviewing hundreds of assets with the same intensity becomes exhausted, and fatigued reviews turn into a perfunctory Pass. The quality of review comes not from the headcount, but from allocation tailored to risk. A structure that concentrates expert reviews on high-risk assets, handles low-risk assets through checklists and brand reviews, and verifies whether the tier classification is correct through sample checks is safer.

When delegating review to generative models

AI review tools are fast and never tire. However, three limitations must be kept in mind. First, whether factual claims are correct can only be determined using internal company documents, but the model does not know these documents or lacks authorization to view them. Second, when the model that generated the copy reviews its own output within the same context, it is prone to repeating the same misconceptions. Third, the reliability of the review model must also be verified using the methods from Chapter 4 (rubrics, checking agreement with human judgment, and regular re-verification). A division of labor where AI review handles 'Detection and classification' and a human equipped with supporting evidence handles 'Judgment and approval' is realistic.

The difference between brand safety and legal safety

Content that complies with the law can still harm the brand, and content that follows brand guidelines can still violate the law. 'The best day' is legally unobjectionable rhetoric, but if the brand dislikes Exaggeration, it is a guideline violation. Conversely, a testimonial that perfectly matches the brand's tone of voice can become unfair advertising if spoken by a Virtual persona. Therefore, it is advisable for checklists to establish two separate axes—brand standards and legal standards—and divide responsibility for each axis. If one person examines both at once, they will only notice the side they are familiar with.

At work

Breathing Wall: Redrawing the approval workflow

The eco-friendly paint brand 'Breathing Wall' began producing 600 ad creative assets per month using AI. Initially, the marketing team lead personally approved all assets, but within two months, the backlog exceeded 300 items, and during a week when the team lead went on vacation, copy containing the phrase '100% non-toxic' slipped through among assets published without approval. All the company possessed was a certification that it met emission standards for specific harmful substances.

The newly designed workflow was as follows. First, at the brief stage, the person in charge of supporting documentation finalized the list of 'Approved facts', and instructions were included in the prompt—along with the rationale—not to use figures outside that list or absolute expressions such as 'Non-toxic' and '100% safe'. For generated assets, an AI classifier flagged factual claims, prices, and whether human figures appeared; high-tier assets were approved by the team lead after passing through the person in charge of supporting documentation and the person in charge of rights and labeling. The low tier (emotional copy) was approved by the brand manager, and the team lead reviewed a sample of 30 low-tier items each week to confirm whether the classification was correct.

Discarded options were also documented. A comprehensive review of all items by the legal team was rejected due to throughput constraints, and a proposal to publish solely on the AI classifier's 'Safe' judgment was dismissed due to the risk of detection Omission. The '100% non-toxic' asset was taken down across all channels, its exposure duration was recorded, and 11 other assets containing the same expression were identified and corrected together. The root causes were identified as the absence of an 'Approved facts' list in the brief and the failure to designate an approval proxy.

Grow Well: AI model incident in babywear advertising

Infant clothing brand 'Grow Well' generated photos of child models using an AI image generation service and ran social media ads. Three days after the advertisement ran, a parenting influencer posted: "The child in the ad looks identical to my child." Upon investigation, records showed that the designer had input the influencer's public photos as reference images and prompted: "With a vibe similar to this child."

The person in charge followed the recall procedure. They took down the advertisement from all channels and stopped scheduled posts. They recorded the exposure duration and impression counts, contacted the influencer to explain the circumstances, and apologized. Because the child was not a widely recognized person, the matter had to be addressed as the unauthorized use of a living person's portrait rather than under the provisions of the Unfair Competition Prevention and Trade Secret Protection Act regarding celebrity identifiers, and they also reviewed whether inputting photos of an actual child into an external AI service could itself constitute an issue of personal information processing. When investigating the cause, the checklist lacked the item 'Source and rights of reference images', and the designer had worked with a personal free-tier account without checking the commercial use conditions in the terms of service.

There were three measures to prevent recurrence. Inputting photos of living people as reference images was prohibited, and mandatory verification by the person in charge of rights and labeling was required for AI assets featuring human figures. Only company-contracted services and accounts were permitted for use, and the commercial use conditions and verification dates for each service were recorded. In the asset repository, the generation service, reference materials, and operator were required to be logged as metadata. The marketing team proposed displaying a prominent 'AI-generated image' label and resuming the advertisement, but this was rejected on the grounds that labeling does not resolve the issue of resembling a specific child.

Common mistakes

1. "It is enough to strongly emphasize 'In line with the brand tone'." AI can only comply when there are standards, rationales, relevant and diverse examples, and a tag structure.
2. "One best example is sufficient." If there is only one example, it is difficult to demonstrate the desired range of variation, and the model is prone to overfitting to that single structure. Official Claude documentation recommends 3 to 5 relevant and diverse examples.
3. "It is safe if one person reviews all assets." Review loads that exceed throughput capacity cause bottlenecks and perfunctory Passes. Divide them by risk tier.
4. "If an AI review tool gives a Pass, it can be published." Determining factual claims requires company materials, and detection tools can miss things.
5. "Labeling it as 'AI-generated' resolves rights issues." Labeling does not resolve issues related to copyright, identifiers, or terms of service.
6. "Images created by AI belong to us, so they can be protected by copyright." A work is an expression of human thoughts or emotions. Human creative contribution must be documented to determine the scope of protection.
7. "If a problem arises, just quietly fix it and upload it again." Full response entails recall, recording the scope, root-cause analysis, and checking for identical patterns.
8. "Because it was an error by an AI tool, it is not a Company responsibility." A business entity that causes damages through unfair advertising cannot evade liability by claiming absence of intent or negligence.

Summary at a glance

Check the official docs

• Claude Docs — Prompting best practices: Clear instructions, context and rationale, 3–5 examples, XML tags, and instructions focused on what to do.
• NIST AI RMF Core: GOVERN 2.1 (Roles and responsibilities), MANAGE 2.3 (Responding to newly identified risks), MANAGE 4.1 (Post-deployment monitoring), MANAGE 4.3 (Incident and error communication and documentation).
• Copyright Act, Article 2: Definition of works.
• Unfair Competition Prevention and Trade Secret Protection Act, Article 2: Subparagraph 1, Item (ta), unauthorized use of another person's name, portrait, voice, etc., widely known to the public.
• Review Guidelines for Labeling and Advertising Concerning Endorsements, Testimonials, etc.: Changes and Withdrawn of Recommendation, Virtual persona, and disclosure of economic interests.
• Fair Labeling and Advertising Act: Article 7 (Corrective measures), Article 10 (Liability for damages).
• Framework Act on Artificial Intelligence (AI Basic Act), Article 31: Duty of artificial intelligence business entities to ensure transparency. Also read the methods and exceptions in Article 23 of the Enforcement Decree.

Self-check

5-1. State at least four principles recommended by the official Claude documentation when converting a brand guide into AI instructions.

5-2. When including the brand guide's prohibited expression 'Complete cure' in AI instructions, rewrite it in a better way than simply stating the prohibition.

5-3. When handling hundreds of AI creative assets per month, state the criteria for dividing risk into three tiers, and specify who reviews each tier.

5-4. When seeking to protect an AI-generated mascot as a company asset, explain the records that must be kept during the workflow in connection with the definition of a work under the Copyright Act.

5-5. In a song advertisement created by including the name of a famous singer in a prompt, the voice is very similar to that singer. State which legal provisions could be at issue, and write two actions the company can take.

5-6. Write three methods for controlling real-time AI content where Prior approval is impossible, connecting them to elements of NIST AI RMF MANAGE 4.1.

5-7. (Design) Write a six-step recall procedure for a problematic AI creative asset, and specify the records that must be kept at each step.

Hands-on tasks