- Is it worth using AI in ad campaigns if your company operates in a regulated sector?
- What really happens when you activate a campaign with the default settings?
- Who does what: how is responsibility divided between the platform, agency, and company?
- Three concrete scenarios: how much can a wrong setting cost?
- What legal rules do you need to know before setting up campaigns?
- Targeting and data: where do the less visible risks hide?
- Why are we talking about it now: is the market really ready to manage these risks?
- How to start concretely: the steps to secure ad campaigns?
- What are the most common mistakes of those managing campaigns in regulated sectors?
- How to understand if your campaigns are truly safe from a regulatory point of view?
- So, is it worth it for your company to correctly set up AI in campaigns?
- How we see it at SHM
- Frequently Asked Questions
- Google Ads and Meta default AI settings can modify approved texts and creatives without notice, violating compliance rules.
- Sectors like finance, healthcare, and legal have additional constraints on targeting, retargeting, and data use that platforms do not handle automatically.
- Starting from August 2026, the EU AI Act makes it mandatory to declare AI-generated content in ads: those who don't comply risk fines.
- An audit of ad settings before launch is the easiest step to avoid costly regulatory problems.
70% of marketers have already experienced at least one AI-related incident in their advertising campaigns. Yet most platforms automatically enable features that, in sectors like finance, healthcare, and legal, can result in very heavy fines.
Is it worth using AI in ad campaigns if your company operates in a regulated sector?
Yes, but only with the right settings: the default AI features of platforms are not designed for regulatory compliance and must be configured on a case-by-case basis.
Advertising platforms like Google Ads and Meta activate many AI-based features by default. For most companies, this is an advantage: time savings, automatic optimization, more conversions. For those operating in regulated sectors — finance, healthcare, legal services — those same features can become a serious problem.
The critical issue is that AI can modify texts, images, and ad destinations without anyone having approved the final version. In an industry where every word must go through the legal or compliance department, this is a real risk.
| Your situation | Is it worth using AI ads? | why |
|---|---|---|
| Unregulated company (e-commerce, retail) | Yes | Default AI functions optimize without relevant regulatory risks |
| Regulated sector, flexible internal compliance | Yes | You can use AI by disabling the riskiest features (automatic text, URL expansion) |
| Finance, healthcare, legal with strict compliance | Partially | Use only internally approved features; disable everything else |
| Sector with an explicit ban on AI in communication | No, for now | Legal risk outweighs any operational benefit |
What really happens when you activate a campaign with the default settings?
Platforms automatically change texts, images, and targets: without a prior audit, you might publish ads you never approved.
When you launch a campaign on Google Ads or Meta without touching the settings, the platforms automatically activate a series of AI functions. Some are visible, many are not. The result is that the ad you see in preview can be very different from the one actually published.
On Google, the function AI Max — launched in May 2025 — generates dozens of ad variants per day without prior human review. Ads can only be removed after publication, not blocked in advance. On Meta, the Advantage+ creative enhancements (automatic creative improvements) change colors, fonts, layouts, and can add unintended text or links.
For a financial services company or a private clinic, an ad with unapproved wording—even something as simple as 'award-winning product' without citing the source—can lead to regulatory violations.
| platform | Default AI function | Risk for regulated sectors | How to disable it |
|---|---|---|---|
| Google Ads | AI Max – text customization | Generate non-compliance approved texts | Disable ‘text customization’ in campaign settings |
| Google Ads | AI Max – final URL expansion | Link to unauthorized pages on the site | Disable ‘final URL expansion’ in campaign settings |
| Google Ads | Performance Max – Asset Optimization | Publish non-compliant copy or creatives | Disable at campaign level: text, image, video |
| Google Ads | Demand Gen – video generation | Generate videos with own assets without disclaimer | Disable automatic video generation in ads |
| Meta | Advantage+ creative enhancements | Alters layout, colors, adds texts and links | Search for ‘Creative setup’ and deactivate the toggles one by one |
| Meta | Advantage+ targeting | Expands the audience beyond the expected limits | Disable automatic audience expansion |
Who does what: how is responsibility divided between the platform, agency, and company?
The platform optimizes for conversions, not for your compliance: the final responsibility always lies with the advertiser.
A common mistake is thinking the platform also handles regulatory compliance. It doesn't. Google and Meta comply with their own advertising policies, which are different from industry regulations (GDPR, AI Act, IVASS rules for insurance, Bank of Italy regulations for credit, and so on).
If an AI-generated ad violates a rule in your industry, the penalty goes to the advertiser company, not the platform.
- 1 · Legal / compliance department Defines the rules Establishes which texts, claims, and images are approvable and which are not. Must be involved before launch.
- 2 · Marketing / ads manager Configure the campaign Disable risky AI features, upload only approved creatives, set targeting limits.
- 3 · Media agency (if applicable) Executes and monitors Apply the customer's instructions, report any automatic platform changes, do not activate unauthorized features.
- 4 · Platform (Google / Meta) Optimize for conversions It does not verify sector regulatory compliance: it only follows its own advertising policies.
- 5 · Advertiser company Responsible for violations It is the legally responsible entity for every published ad, even if generated by AI.
Three concrete scenarios: how much can a wrong setting cost?
Even a single AI feature left active by mistake can generate non-compliant ads and significant fines.
The three scenarios below are illustrative: the numbers serve to show the order of magnitude of the risk, they are not real customer data.
| Scenario | sector | Active AI function for error | Possible consequence |
|---|---|---|---|
| Law firm with Google Search campaign | Legal | AI Max – text customization | Ad with unapproved claim ('guaranteed results'): violation of legal ethical rules |
| Private clinic with Meta campaign | Healthcare | Advantage+ creative enhancements | Medical disclaimer covered by Reels layout: violation of the Advertising Self-Regulatory Code |
| Consumer credit company | finance | Advantage+ targeting (Meta) | Targeting age groups that are not allowed: risk of violating anti-discrimination laws (fair lending) |
A concrete reference: in December 2025 the Italian Privacy Guarantor fined a company in the security sector 400,000 euros for unlawful data processing for marketing purposes, including consent collection bundled with quote requests. It wasn't an AI case, but the principle is the same: the advertiser is always responsible for data processing in campaigns.
What legal rules do you need to know before setting up campaigns?
Starting from August 2026, the EU AI Act requires the disclosure of AI-generated content in ads: it's no longer a choice, it's a legal obligation.
The AI Act (the European regulation on artificial intelligence) made its Article 50 operational on August 2, 2026. From that date, European advertisers must explicitly declare when advertising content has been generated by AI. Most platforms have already added a checkbox in the ad settings: it should be used whenever AI has contributed to the creative.
As we explored in the article on AI Act and generative content for European retail , the implications go far beyond advertising: they concern any content produced with AI tools and aimed at European consumers.
On the privacy front, GDPR remains the main reference for data use in campaigns. Uploading customer lists to Meta or Google without an adequate legal basis is a violation. For healthcare, in the United States, HIPAA is added; in Italy, the guidelines of the Privacy Guarantor.
It is also worth reading the article on the topic of AI watermark in texts and implications for Italian companies : transparency on AI use concerns not only ads but all company communication.
| Regulations | Scope | Main requirement for ads campaigns |
|---|---|---|
| EU AI Act – Art. 50 (August 2026) | AI-generated content | Declare the use of AI in ad creatives |
| GDPR | Personal data | Legal basis for using customer lists and tracking pixels |
| Consumer Code (IT) | Misleading advertising | Verifiable claims, mandatory disclaimers for financial and healthcare products |
| IVASS / Bank of Italy regulation | Finance and insurance | Advertising messages compliant with sector circulars |
| Forensic Code of Ethics | Legal | Prohibition of advertising with promises of results |
A useful update on how platforms are adapting to new European rules: the article on Meta and the EU fine for the DSA shows that platforms are under growing regulatory pressure, but operational compliance remains the responsibility of the advertisers.
Targeting and data: where do the less visible risks hide?
Automatic targeting can push you beyond the limits allowed by industry regulations, even if the platform technically allows it.
Platforms expand your audience to maximize conversions. For an e-commerce business, this is often a win. For a financial company or healthcare provider, it might mean reaching demographic segments that regulations don't allow.
Meta, for example, classifies most financial services ads in the category Special Ad Category (special ad category), which automatically removes targeting by age, zip code, and behaviors. But Advantage+ targeting can still expand your audience in unexpected ways. Meta's restrictions for financial services they are detailed, but require active configuration to be respected.
Retargeting is another critical point. Many platforms already prohibit pixel-based retargeting for healthcare. But some organizations have even more restrictive internal policies: even where the platform allows it, the company might not be able to use it.
Why are we talking about it now: is the market really ready to manage these risks?
No: most companies use AI in campaigns without formal governance, and new European regulations make this gap increasingly risky.
The adoption of AI in advertising has grown rapidly. But the ability to govern it has lagged behind. According to IAB , only a third of companies have adopted formal AI governance tools in campaigns. The rest improvise.
In Italy, the situation is even more critical. According to the Digital Innovation Observatory in SMEs of Politecnico di Milano , 76% of Italian SMEs haven't invested and don't plan to invest in AI, and only 7% have kicked off structured training programs. Those who use AI in their campaigns often do so without a clear internal policy.
How to start concretely: the steps to secure ad campaigns?
A few systematic steps are enough to reduce risk: the important thing is to do them before launch, not after.
Auditing your settings doesn't require advanced technical skills. It takes method and a bit of time before launch. Here's how to do it.
- 1 · Step 1 Map active AI functions Open every active campaign and document which AI features are enabled: AI Max, Asset Optimization, Advantage+ creative, automatic targeting.
- 2 · Step 2 Compare with internal policies Take the list to the legal or compliance department. Ask which features are approvable and which are not for your industry.
- 3 · Step 3 Disable risky features For Google: turn off text customization and URL expansion in AI Max; disable Asset Optimization in Performance Max. For Meta: flip off the toggles in Advantage+ creative enhancements.
- 4 · Step 4 Check previews on all placements Check how each ad looks in different formats (feed, Reels, Stories). A disclaimer visible in the feed might be covered in the vertical format.
- 5 · Step 5 Add AI disclosure where required If you used AI at any stage of the creative process, check the disclosure box provided by the platform. Starting August 2, 2026, it is mandatory for European advertisers.
- 6 · Step 6 Set up periodic monitoring Platforms update their settings frequently. Schedule a monthly check of active AI features, especially after any platform update.
What are the most common mistakes of those managing campaigns in regulated sectors?
The most common issue isn't bad faith, but the lack of a process: AI features are left running because no one ever checked them.
When managing ad campaigns in regulated sectors, mistakes tend to repeat. Knowing them in advance is the fastest way to avoid them.
| Common mistake | Why it happens | How to avoid it |
|---|---|---|
| Leave AI Max active without review | It's the default Google configuration | Disable text customization and URL expansion at setup |
| Do not check previews on all Meta placements | Only the feed is checked, not Reels or Stories | Use the preview function for each placement before publishing |
| Upload customer lists without legal basis | The platform is thought to handle privacy | Check the GDPR legal basis before every audience upload |
| Do not declare the use of AI in creativity | The disclosure box is optional in the settings | From August 2, 2026, it is mandatory for EU advertisers: always tick it |
| Do not involve compliance before launch | Marketing works autonomously for speed | Involve the legal department in the campaign approval process |
| Do not update the audit after platform updates | Settings change without explicit notification | Schedule a monthly check of active AI features |
How to understand if your campaigns are truly safe from a regulatory point of view?
There are precise indicators that signal whether the compliance process is under control or if there are gaps to be filled.
Ad compliance isn't a one-time thing: you need to keep an eye on it over time, especially since platforms update their settings without warning. Here are the red flags to watch out for.
| Indicator | Positive signal | Risk signal |
|---|---|---|
| Active AI functions documented | List updated and approved by compliance | No documentation of active functions |
| Previews verified on all placements | Systematic check before each launch | Verify only on the main format |
| AI disclosure in ads | Checkbox ticked every time AI has contributed | Box never used or only used sometimes |
| Audience upload | GDPR legal basis documented for each list | Lists uploaded without verification of legal basis |
| Involvement of compliance | Formal approval before launch | Marketing decides autonomously |
| Frequency of settings audit | Monthly check or after each platform update | No periodic checks planned |
So, is it worth it for your company to correctly set up AI in campaigns?
It is worth it if you work in a regulated industry (finance, healthcare, legal) and want to keep using ad platforms without risking penalties: an audit of your AI settings is a must, not an option.
A middle ground your company isn't in a high-risk industry but has a distinct brand identity: it's worth turning off features that automatically tweak creative and copy to keep control over your messaging.
Not yet if you're a small e-commerce store with no special regulatory restrictions and the default AI features are bringing you results: in this case you can leave them on, but keep an eye on your previews.
How we see it at SHM
We believe AI in ad campaigns is a powerful tool, but it should be integrated to free companies from routine — not to take away their control over what they communicate. When a platform modifies approved text without anyone noticing, it's not helping: it's creating a problem.
We work with companies operating in complex contexts, where every word of an ad must be verified before going online. Our approach is always the same: first, we understand what the platform does automatically, then we decide what to keep and what to turn off. Not the other way around.
If you manage campaigns in regulated sectors and want an audit of AI settings, you can start from our service of strategic AI integration . If, on the other hand, the topic is organic visibility alongside paid campaigns, our work of SEO for AI can help you monitor even the results generated by AI engines. For those who want to explore the topic internally, we also organize AI training courses for companies .
You can find more insights on these topics in the area Project management and technology of our blog, where we follow regulatory and technological evolution with an eye always turned towards practical decisions.
A useful last reference: the article on California law on streaming ads shows how regulatory pressure on digital advertising is growing even outside of Europe. Those who get ready today will have fewer problems tomorrow.
Frequently Asked Questions
For most unregulated businesses, default AI features are a plus: they optimize campaigns without major regulatory risks. The problem comes up in industries with strict legal constraints — finance, healthcare, legal — where every single text and image must be approved before publication. In these cases, AI features that automatically tweak creatives and copy are a real risk.
From August 2, 2026, Article 50 of the EU AI Act will require European advertisers to disclose when an ad content has been generated by AI. In practice, this means ticking the disclosure box provided by Google Ads and Meta whenever AI has contributed to the ad's creative. The platforms have already added this option in their ad settings.
It depends on the platform and the applicable regulations. Many platforms already prohibit pixel-based retargeting for healthcare. In Italy, the guidelines of the Privacy Guarantor are added to the platforms' policies. Before activating any form of retargeting in the healthcare sector, it is necessary to verify both the platform's policies and the current regulations and your organization's internal policies.
No. The legal responsibility for published ads always lies with the advertiser, i.e., the company. The agency executes the client's instructions and should report risks, but cannot replace the internal approval process. It is crucial that compliance instructions are communicated to the agency in writing and documented before launch.
The most reliable way is to check the previews on all active placements before and during the campaign. Meta frequently changes the position of the Advantage+ creative enhancements settings in the interface: look for the 'Creative setup' and 'Advantage+ creative enhancements' sections and turn off the toggles one by one. Also check vertical formats like Reels, where graphic elements might cover mandatory disclaimers.
At least once a month, and always after every significant platform update. Google and Meta change default settings without explicit notification: a feature you disabled might be re-enabled or replaced by a new one. Documented periodic checks are also a form of protection in case of regulatory disputes.
The real risk isn't AI: it's launching a campaign without knowing what the platform is doing for you.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
