A banner shows an illustrated entrepreneur labelled “Character created by AI”. Beside them is the quote “My revenue doubled”. No customer had achieved that result: the team invented both the person and the testimonial. The caption explained the picture's origin but left the false evidence in place.
Several questions apply separately: where the data came from, whether claims are supported, the terms for using images and voices, and the requirements for distribution. A client benefits from a process that answers each before publication and allows errors to be corrected afterwards. A new model or more detailed prompt cannot replace that process.
Describe the use and a possible error
“We use AI in marketing” is too broad to assess. In one process the system edits a public article; in another it receives a customer extract; in a third it voices a person. Each has its own sources, recipients and checks.
A working description needs input material, the vendor, connections, intended use and an owner. The team then names the error it needs to catch. For the banner, it is an unsupported testimonial; for a product image, an added component; for analysis, disclosed customer information or an incorrect calculation.
Describe risk through a scenario and control rather than an arbitrary percentage. If the model can add a customer result, the editor needs supporting evidence and authority to reject material lacking it. If generation changes the product, compare the final image with its actual contents.
An invented story can be shown as an example, but not as a customer testimonial: the audience will read it as fact. A testimonial implies that the person exists and their result is confirmed.
Examine doubled revenue using source data
The banner has no real data, so its testimonial must be removed. To see what a real case would require, take a separate calculation with illustrative figures. In the first period, 20 orders with an average value of 20,000 ₸ produced 400,000 ₸. In the second, the same 20 orders averaging 40,000 ₸ produced 800,000 ₸.
Revenue rose by 800,000 - 400,000 = 400,000 ₸, or 400,000 / 400,000 = 100%. Order count did not grow; average order value changed. These figures do not establish why: price, order composition or other conditions may be involved. One comparison cannot attribute all the growth to the advertised tool.
A verified case needs a source, period and limits beside the calculation. The model above is only an arithmetic example and provides no support for the banner's testimonial. It can explain the calculation while retaining that explicit status. Evidence from a real customer requires another set of material.
A synthetic product photo needs equally careful scrutiny. If it adds a function or changes a material, a generation label does not remove the discrepancy with the offer. Correct the content first, then address sources and disclosure separately.
Separate a legal interpretation from a launch decision
The Law of the Republic of Kazakhstan "On Artificial Intelligence" (No. 230-VIII of 17.11.2025, as amended up to 25.08.2026) allows synthetic output to be distributed only with machine-readable labelling and a visible or otherwise perceivable warning (Art. 21(2)). The duty to inform users lies with owners and holders of AI systems (Art. 21(3)); the law does not say whether it covers a business publishing an image from someone else's service. The procedure for developing, applying and distributing machine-readable forms is approved by the authorised body (Art. 22(3)). AI-assisted output is protected by copyright only where a human made a creative contribution (Art. 23(1)). This is not legal advice: a lawyer makes the call on the campaign.
A visible warning and machine-readable form require different implementations. A universal recommendation to use alt text alone leaves these questions open. Once a solution is chosen, inspect the final file and placement: export or a platform may change what the user can access.
Another country requires its own assessment of applicability. Listing laws does not establish that material was reviewed for the intended market. Retain the source, version, open questions and decision-maker in the working record.
Trace data to the final recipient
For practice, prepare synthetic enquiries without customer details. In a live workflow, define the fields needed and permitted environment before transferring an extract. Contact details may play no part in grouping reasons for refusal.
Removing names and phone numbers reduces disclosed information, but links to other data may still identify someone. Assess record contents, access and recipients separately. Replacing a contact with a code does not complete the review of the whole process.
Distinguish a vendor's training use, storage, staff access and transfers to connected services. A promise about one property does not describe the others. The data owner records permitted sources, fields and operations, along with deletion of temporary copies.
For a likeness or voice, retain its source and the agreed scope of use. Consider permission for an internal recording separately from an external advertising plan. Send the purpose, channels, duration, changes and context for review alongside the final file. If an AI service processes data abroad, uploading personal data to it, such as a photo of a face, is in our reading best treated as a cross-border transfer. The Law "On Personal Data and Their Protection" (as amended up to 14.09.2026) requires consent for it in Art. 7(6), except in the cases listed in Art. 16, and the consent must name such a transfer (Art. 8(4)(5)).
Make decisions reproducible
Every asset needs a person making the substantive decision. Retain its version, factual sources and placement. Changed promises or conditions require another review: approval of an agent action covers the exact text version and publication parameters.
| What the team assesses | Material needed for the decision |
|---|---|
| A case-study figure | Register, calculation, period and limits of the conclusion |
| A likeness or voice | Source and agreed usage conditions |
| Data transfer | Fields, environment, access and recipients |
| Disclosure and labelling | Applicable interpretation and the final-format result |
| Publication | Final version, owner and placement |
NIST AI RMF can serve as a voluntary framework for organising AI risks. It helps teams connect error scenarios, checks and responsibility. A campaign's permissibility still depends on its conditions and applicable requirements.
A false promise found after launch is first taken down from every placement. The owner finds copies and versions, retains incident information and determines who was affected. They then arrange corrections and establish necessary notifications with relevant specialists.
Changing a prompt concerns future editions only. Material already published needs separate attention. The team changes the check that missed the error: for example, an editor no longer accepts a customer figure without a source.
Exercise: prepare a corrected banner
The team believes the “created by AI” caption resolved every question. Describe what needs to change in the advertisement, what evidence is required for review and who approves the result. For your project, take one generated output and trace it from input source to publication.
First remove the invented testimonial. Replace it with an explicitly labelled explanatory example or a real case after reconciling the data. Then assess image sources, applicable labelling questions and the final format. Submit the corrected version for approval and remove the earlier version from active placements.
The doubling calculation shows why substantive review matters even when the arithmetic is correct. A larger total and a proven product effect answer different questions. Preserve that boundary in your project: what is known, what supports it and which decision remains open.