AI Hallucinations Have a Different Cost in Regulated Marketing

An invented fact can mislead a customer in any setting. In regulated marketing, it can also breach rules about substantiation, disclosure and supervision. Generative marketing tools need controls that address both the accuracy of the words and the impression the finished advertisement creates.

A Different Cost Curve

A customer-service error can become a legal dispute. In Moffatt v. Air Canada, 2024 BCCRT 149, a passenger challenged the airline's refusal of a retroactive bereavement-fare request after relying on contrary advice from its chatbot. The dispute illustrates why customer-facing information matters. It does not supply the enforcement test for securities or drug advertising.

For a FINRA member firm, a Meta ad citing a fabricated annualised return raises a different set of obligations. Rule 2210 requires fair and balanced communications and prohibits false or misleading claims. Using AI does not remove those duties. The applicable rules and consequences depend on the firm, communication and facts; an examination letter or particular settlement outcome is not automatic.

In prescription-drug advertising, an unsupported efficacy claim can put patients at risk and attract FDA scrutiny. The FDA uses warning and untitled letters to address promotional violations. The response may involve stopping or correcting promotion, depending on the issue. A faulty advertisement does not automatically trigger a product recall across every channel.

What the Regulator Actually Said This Cycle

FINRA's 2026 Annual Regulatory Oversight Report, released in December 2025, separates regulatory obligations from practices firms may consider. Existing supervision, communications and recordkeeping rules continue to apply. Suggested monitoring measures include retaining prompts and outputs, recording model versions and involving human reviewers. The report does not make each measure a universal standalone requirement; firms must determine how applicable duties govern their use.

The FTC announced Operation AI Comply on September 25, 2024, with five enforcement actions involving allegedly deceptive or unfair AI-related practices. DoNotPay was among them. The FTC alleged that it had not tested whether its chatbot performed at the level of a human lawyer. The Commission finalized a consent order in January 2025 restricting unsupported claims about substituting for professional services.

Workado was a later case. In its April 2025 complaint, the FTC alleged that a detector advertised as 98 percent accurate achieved only 53 percent on independent testing of general-purpose content. The final consent order, issued August 21, 2025, requires non-misleading efficacy claims backed by competent and reliable evidence. Workado neither admitted nor denied the substantive allegations. These are cases about substantiating claims made about AI products; they should not be presented as adjudicated examples of a model inventing a financial return.

In Canada, the CSA and CIRO issued Joint Staff Notice 31-369 on December 11, 2025. For registrants working with finfluencers, it addresses due diligence, agreements and ongoing checks that statements are substantiated and not misleading. That is a useful governance analogy for outsourced content production. More directly, the notice explains that someone who creates or uses AI for activity governed by securities laws may be responsible as if acting personally. It does not classify a generative model as a finfluencer or itself establish an AI-specific legal test.

RAG Helps, and Then It Stops Helping

Retrieval-augmented generation can supply a model with passages from the firm's compliance corpus and a pre-approved claim library. That gives the drafting process an identifiable evidence base. It does not force the model to quote accurately or prevent it from generating information outside the retrieved material. NIST's Generative AI Profile treats confabulation as an ongoing risk and recommends verifying sources and reassessing risks after RAG implementation.

Consider a hypothetical approved disclosure: "returns averaged 7.2 percent annualised over the trailing ten years, gross of fees." A draft that says "averaged over 7 percent" still needs its period and fee basis checked. Rounding alone is not necessarily misleading, but dropping material qualifications can be. "Delivered consistent returns above market" adds claims about consistency and a benchmark that the supplied sentence does not establish.

The review question is whether the whole advertisement remains supported and properly qualified. A citation can help the reviewer find the evidence; it does not validate every inference or rewrite attached to it.

Deterministic Post-Processors and Their Blind Spots

A second layer can scan every generated variant before publication: match numeric values to approved claims, flag uncleared names and stop phrases selected by the firm's policy. A firm might flag "guaranteed," "risk-free" or "FDA-approved" for review. These are examples of control settings, not a claim that every use of those words is legally prohibited.

Simple checks have limits. An approved number can be attached to the wrong product or time period. A phrase filter can miss an unsupported comparison such as "outpaced peers." Clearing those checks does not establish that the finished advertisement is fair, balanced or adequately substantiated. The claim, evidence, qualifications and audience still need to be considered together.

The Real Fix Is Workflow, Not Model

When we started building Leadlord for wealth advisors, hallucinated performance numbers and made-up disclaimers were not a thought experiment. They were the failure mode we kept hitting in early demos. Our response was to constrain drafting with the firm's pre-approved claim library, check numeric outputs and place the compliance officer's redline tool alongside the draft. That design makes supporting evidence available while the text is being shaped. Product details at /projects/leadlord.

RAG can improve grounding, and post-processors can catch specific errors. Human review adds judgment about context and meaning, but it also needs adequate evidence, time and authority to stop publication. None of these layers guarantees compliance. Early review should complement any approval required before use, with changes after approval assessed under the applicable process.

A useful workflow presents exceptions and their source passages together while keeping the complete advertisement available. Reviewers need to see what the checks missed as well as what they flagged. A clean exception list should not be treated as proof that every variant is ready to publish.

What to Watch in the Back Half of 2026

One useful signal will be what sector-specific enforcement records reveal about AI-generated marketing: the unsupported claim, the applicable obligation and the supervision that failed. Moffatt should not be used as a shortcut for that analysis. The practical lesson will depend on the evidence and rules in each case.

A second signal will be whether approved-claim libraries become easier to transfer between platforms without losing their supporting evidence, scope limits and approval history. That is a design objective worth testing. The operational question is whether a firm can trace a published claim to its evidence, identify who approved it and correct it wherever it was used.