Roughly 60% of companies using AI will face unexpected charges or budget overruns because they lack human oversight, according to a Gartner survey conducted in April. The same survey found 56% of companies that use AI tools deployed them without clear policies in place.

Those numbers set the stage for a Programmatic IO panel in New York City on Monday, where legal and agency executives described a compliance environment growing faster than most advertisers can manage. New laws include the EU's 2024 AI Act and statutes passed in New York and India that mandate disclosure of certain AI use cases.

"The laws are developing pretty quickly, [and they're] still relatively fragmented," said Betty Louie, partner and general counsel at martech company The Brandtech Group.

Louie flagged a less obvious source of pressure: insurance. Underwriters, she said, are quickly becoming "a new player in the AI discussion." Advertisers should expect insurers to start including AI in policy coverage, which adds protection but also a new layer of fragmentation.

"Insurance companies will have their own points of view [about] policies and processes in place," Louie said, including how active the human in the loop actually needs to be.

Louie shared the stage with Nicholas Godlove, legal director of AI and global privacy data at Yum! Brands, and Alan Parker, chief innovation officer at BBDO North America. Godlove called it "extremely difficult" to implement company-level policies given the range of AI now touching advertising, from AI-generated creative and workplace tools to agentic media buying.

That difficulty is pushing brands and agencies to build their own guardrails.

"One of the biggest things you can do when rolling out AI tools is make sure people understand what's there and how to use it," said BBDO's Parker. The agency runs a "delivery and maintenance team" with specialists assigned to particular products and use cases, and it conducts regular performance tracking for agentic workflows.

Yum! Brands, which owns Taco Bell and Pizza Hut, takes a parallel approach. A dedicated AI team oversees the legal and security aspects of deploying AI tools and connects the company's brand portfolios to a single AI use policy, plus consistent contractual agreements with AI companies such as OpenAI.

"The rules we've built over the last two to three years have been increasingly restrictive," Godlove said. The company has adopted a more conservative posture lately, "setting clear guidelines and standards early on," making it easier for employees to toggle AI functions on and off and disclosing to customers when AI is used.

Restrictive rules help prevent mistakes. When mistakes still happen, Louie argued, auditability determines whether companies can recover. AI products and workflows must be fully "auditable," she said, both for training and for diagnosing failures.

If an ad campaign misfires impressions or misses revenue targets, an agency or tech company should be able to trace exactly what happened: which large-language model was activated when the mistake occurred, what data was generated and whether a human or the machine caused the error.

"Whether you're on the agency side or the company side," Louie said, "that level of auditability is really important to [instill] confidence in the tools you're using."

As insurers enter the AI discussion, advertisers that cannot document how their AI systems work — and who was supervising them — will find both regulators and underwriters asking the same uncomfortable questions.