Most boards review vendor risk in procurement, cybersecurity, and financial services. Very few review it in marketing.
That gap matters more than it used to. If you operate in financial services, healthcare, insurance, gaming, or any other licensed sector, the firm producing your content and running your campaigns is making representations on your behalf. When a regulator takes issue with those representations, the enforcement action does not land on the agency. It lands on you.
Why this belongs on the risk register
The distinction executives tend to miss is that marketing vendors in regulated sectors are not service providers in the way a design studio or a web developer is. They are producing regulated communications. Every claim, every performance figure, every testimonial, every disclosure that is present or absent, becomes a firm communication the moment it goes live under your brand.
This is the practical argument for working with a digital agency for regulated industries rather than a generalist with a strong portfolio. The difference is not creative quality. It is whether compliance review is built into the production process or bolted on afterward, whether the people writing your content understand what claims your license permits, and whether the firm has worked inside your regulatory environment before rather than learning it on your budget.
A generalist agency will produce work that performs well and occasionally produce work that creates exposure. They will not always know which is which, and neither will your marketing team until someone outside the business points it out.
What regulators actually hold you responsible for
The FTC’s position on third-party content is unambiguous. Its Endorsement Guides guidance for advertisers makes clear that advertisers are responsible for claims made on their behalf, including by creators, affiliates, and agencies, and that practices inconsistent with the Guides can result in enforcement alleging Section 5 violations. The maximum civil penalty under Section 5(m)(1)(A) now stands at $53,088 per violation. Per violation, not per campaign.
In financial services the picture is similar and the enforcement cadence is faster. FINRA brought more than 1,400 disciplinary actions and imposed roughly $95 million in fines in 2026. Its first major enforcement over a finfluencer program, an $850,000 action against a broker-dealer, rested principally on failures to review, supervise, and retain third-party content rather than on the content itself.
That detail is the one worth carrying into a board conversation. The firm was not penalized because a creator said something false. It was penalized because it had no system for checking.
More recently, the FTC settled with a media company over an AI-driven advertising product alongside the marketing firms that resold it. The buyer of the service wore the larger penalty. Outsourcing the execution did not outsource the liability.
The AI layer has widened the surface area
A newer exposure is accumulating with less attention. AI systems now summarize and describe companies to prospective customers directly, drawing on whatever they find across the web. Search Engine Land’s analysis of regulated industries in AI search reports that up to 72% of B2B buyers now encounter AI-generated summaries in search, and sets out the requirement that content in regulated categories pass human and compliance review before publication precisely because machines will repeat it.
Two problems follow. The first is that an AI assistant describing your product inaccurately is a representation your customers may act on, and your control over it is indirect at best. The second is that AI-generated marketing content, produced at volume by an agency optimizing for output, can introduce claims nobody at your firm ever approved.
Neither risk is theoretical, and neither is currently covered by most marketing service agreements.
Questions worth asking before the next renewal
A short diligence exercise surfaces most of what matters. Does the agency have documented compliance review in its production workflow, or does it rely on your team to catch problems? Can it name the specific regulations governing your category without looking them up? Has it worked with firms under the same licensing regime, and can it produce references from them?
Then the contractual questions. Who holds liability for claims made in content the agency produced? What indemnification exists, and is it capped below the level of a realistic penalty exposure? Are AI-generated assets disclosed as such, and who reviews them? What is the retention policy for marketing communications, given that FINRA requires three years for retail communications and the SEC Marketing Rule requires five?
Most agencies answer the first set reasonably well and the second set poorly. That asymmetry is informative.
The underlying point
Marketing in a regulated industry is a controlled function that happens to be creative, not a creative function that happens to be regulated. Firms that organize it the second way eventually discover the difference, usually through a letter rather than a strategy session.
The cost of a specialist agency over a generalist is typically a modest premium on fees. The cost of the alternative is measured in penalties, remediation, and the management time consumed by an enforcement process. Priced that way, it is not really a marketing decision at all.
