Compliance can see the problem and still lack the power to change it

A reviewer receives a complete file, identifies a problem and records a concern. The campaign still launches because the commercial decision has already been made, the deadline is fixed and no one has defined what happens when compliance disagrees. The process contains a review. It does not necessarily contain effective challenge.

That distinction is central to the FCA’s blog on corporate finance compliance, published on 8 October 2026. Jamie Whitehorn describes a survey of 411 firms, with 382 responses, and emphasises the importance of compliance having enough presence, authority and access to influence the business. The article concerns corporate finance firms, rather than a survey of marketing approvals or AI systems.

Its wider lesson is organisational. Better information can help a compliance function identify issues. The business still has to give it a credible route to change what happens next. Automation cannot supply that authority merely by placing a warning on the screen.

Independence has to work inside the decision

The FCA reported that 63% of respondents had a compliance function with other business responsibilities. It recognised that arrangements vary with the nature, scale and complexity of a firm, while highlighting the potential for conflicts where compliance also participates in revenue generation. Most responding firms were small, which makes the findings especially relevant to proportionate arrangements rather than a single large-firm blueprint.

Those observations should not be turned into a claim that every combined role is unacceptable. The issue is whether the arrangement permits meaningful challenge when interests diverge. A person can hold several responsibilities and still have a clear escalation route. A formally separate department can lack practical influence if its concerns are routinely dismissed.

In an illustrative marketing workflow, a reviewer might be asked to assess a promotion for a product whose launch they also sponsor. The organisation needs to understand how the conflict will be handled, which questions need independent input and who can resolve a disagreement. Naming a reviewer is only the beginning of that arrangement.

The same applies when an AI system produces the initial assessment. If the system is optimised to minimise rejected campaigns, its warnings may be treated as friction to overcome. If the owner can change the checking instructions without oversight, the business may weaken a control while retaining the appearance of automated assurance. Those are possible design risks, not findings measured by the FCA survey.

Early compliance involvement changes the available choices

Compliance is often described as a final checkpoint because final approval is easy to identify. But the choices that determine a campaign’s risk can happen much earlier: the product proposition, the target audience, the claim being made and the route from interest to purchase. By the time copy reaches a reviewer, correcting one of those decisions can mean rebuilding the work.

Earlier involvement gives the business more options. A specialist can explain why a proposed claim needs evidence before creative development begins, or identify an audience restriction while the media plan is still flexible. This does not mean every idea requires a full legal review. It means material questions should reach the people able to answer them while the answer can still shape the design.

The Midnite case involving an omitted age constraint illustrates the value of making a known rule available before generation. The output still requires assessment, but the workflow can avoid creating work around an assumption that was never acceptable. That is a more productive use of compliance expertise than repeatedly correcting an avoidable error at the end.

AI could support that earlier involvement by surfacing likely questions in a brief and identifying the required evidence. Its usefulness depends on the organisation’s response. A warning that nobody owns becomes another notification; a question routed to a specialist before production can become a decision that improves the work.

A challenge needs an observable consequence

One test of authority is whether a reviewer can pause the relevant action while an issue is resolved. Another is whether disagreement can reach someone with the authority to decide. The organisation should be able to explain those routes without relying on personal relationships or informal intervention.

A record should preserve the substance of the challenge and what changed as a result. If a campaign proceeds unchanged, the rationale and authorised decision matter. If a product fact is corrected, the record should connect that correction to the assets affected. Counting completed reviews cannot reveal whether any of them altered a consequential decision.

This develops the argument about human oversight in financial services. Oversight requires more than an individual looking at an output. They need relevant evidence and a practical opportunity to intervene. Authority is the condition that turns their attention into control.

External support does not remove that need. The FCA’s article stresses that firms must understand the advice they receive and maintain oversight of third-party compliance support. A similar operating principle applies when the support comes through software: the organisation needs to know what the assessment covers and who is accountable for acting on it. The provider’s expertise is an input to governance, rather than a replacement for it.

Technology should strengthen a function that can act

There is a legitimate efficiency problem. Specialist teams cannot participate equally in every routine decision, and asking for involvement everywhere can make their contribution less effective. Good workflow design distinguishes settled questions from material uncertainty and preserves attention for the latter.

But efficiency should not be confused with reducing the number of challenges. A useful system could increase visible disagreement initially because it reveals issues that the previous process missed. The business should examine the quality and consequence of those interventions instead of treating a lower rejection rate as an inherent improvement.

The FCA blog is a supervisory account of a particular sector, not a new rule for AI-assisted marketing. Its organisational insight remains applicable as an inference: compliance capability depends on whether expertise can influence commercial decisions. Better tools can help evidence travel and questions arrive earlier. They cannot decide that the business will listen.

The ultimate test of a review function is not whether it has seen the work. It is whether its judgement can change the work when the circumstances require it. AI should make that influence easier to exercise and easier to understand, with the authority already present to give the result meaning.