AI Wrote the Ad. ASIC Still Holds You to It., practitioner guidance from TheAICommand
← GRC
Regulatory analysis

AI Wrote the Ad. ASIC Still Holds You to It.

ASIC refreshed its advertising guide for the first time since 2012, and it now reaches AI-generated advertising and the capability claims firms make about their AI-enabled tools. The medium is no defence. Here is what AI-washing looks like, what RG 234 now expects, and the marketing controls to put in place before the next campaign ships.

·monthly

GRC content. Written for compliance, risk, and audit professionals in Australian financial services. General information. Not legal or compliance advice.

Quick answer

On 9 June 2026 ASIC updated Regulatory Guide 234, and it now expressly applies to AI-generated advertising and to disclosing the capability and limitations of AI-enabled customer tools. AI-generated advertising is subject to the same misleading-conduct rules as human-written advertising, so the compliance work is to substantiate every AI-capability claim, put AI-generated marketing through the same approval and human sign-off, disclose limitations not just benefits, and hold an accountable person rather than the model.

The medium is no defence.

For a decade, the rules on advertising financial products in Australia sat in a guide written before generative AI existed. On 9 June 2026, ASIC updated Regulatory Guide 234, its guidance on advertising financial products and services including credit, for the first time since 2012. Tucked inside a refresh that mostly consolidates a decade of enforcement is a short but consequential move. RG 234 now speaks directly to artificial intelligence.

As Bright Law summarises the update, the guidance makes clear that "the law and ASIC's guidance also apply to AI-generated advertising", and it adds "discussion about disclosing the features, benefits and risks or limitations of using customer tools and tool capability, including AI-enabled tools." Read plainly, that closes two doors at once. You cannot treat an ad as lower-risk because a model wrote it. And you cannot describe an AI-enabled tool by its best-case capability without also disclosing its limits.

For compliance and marketing functions, this is the moment AI stopped being a technology question and became an advertising conduct question.

An abstract machine hand assembling a glowing advertisement panel above a dark harbour, one focal point, sky-blue light on deep navy
AI-generated advertising is subject to the same rules as human-written advertising.

The rule has not changed. The surface has.

RG 234 does not create new law. It is guidance on how to meet law that already binds every issuer and promoter of a financial product or service in Australia. The core prohibitions are familiar. Section 12DB of the ASIC Act bans false or misleading representations about financial services. Section 1041H of the Corporations Act bans misleading or deceptive conduct in relation to financial products. Neither provision cares who wrote the words. A claim that is misleading is misleading whether a copywriter, a compliance officer or a language model produced it.

What the update does is remove any doubt that AI-generated advertising is inside that framework, and it names the specific way AI creates new exposure. It is not only that AI can write an ad. It is that AI is increasingly the thing being advertised. When a firm markets an AI-enabled calculator, coach or advice tool, the claims about what that tool does are themselves representations that have to be accurate. RG 234's new language about disclosing capability and limitations is aimed straight at that.

Two failure modes RG 234 now catches

The update lands on two distinct AI risks, and it helps to keep them separate because they call for different controls.

The first is AI-generated content that no one verified. Generative tools are fluent and confident, and they produce material that reads like finished marketing copy. They also invent figures, quote superseded rates, overstate benefits and drop the qualifications that make a claim true. If that copy ships without a human checking it against reality, the firm has published a potentially misleading representation, and the fact that a model drafted it is not a defence. ASIC has already shown it is watching AI in advertising from the other side of the fence. In 26-063MR, it described scammers using AI to make fake investment ads look polished and convincing, part of the $2.18 billion Australians lost to scams in 2025. A regulator alert to AI-generated deception in the market is unlikely to accept AI-generated carelessness from a licensee.

The second is AI-washing. This is the marketing habit of dressing a product in more artificial intelligence than it actually contains. The tool that is described as AI-powered but runs on a handful of if-then rules. The service promoted as delivering tailored AI advice that in truth weighs only a data point or two. RG 234's new focus on disclosing the real capability and limitations of AI-enabled tools is the antidote. If you advertise the intelligence, you have to be able to substantiate it, and you have to be straight about what it does not do.

A screen split into two contrasting halves divided by a thin sky line, the left half a bright inflated claim labelled claimed, the right half a smaller honest capability labelled delivered
AI-washing is the gap between what your tool is advertised to do and what it does.

What this means for GRC practitioners

The instinct in some firms will be to treat this as a marketing team problem. It is not. It is a governance problem that shows up in marketing, and the AI angle makes the old advertising review process insufficient in two ways.

First, volume and speed. AI lets a marketing team produce ten times the copy in a tenth of the time, which means the human review that used to sit comfortably in the workflow can quietly fall away under the pace. A process designed for a handful of campaigns a quarter does not survive contact with a tool that drafts fifty variations before lunch. The control has to be built for the new throughput, not bolted on after.

Second, substantiation moves upstream. When the product itself is AI, the accuracy of the advertising depends on facts about the model that marketing does not hold. Whether a tool genuinely personalises, what data it considers, how often it is wrong, what it cannot do, all of that lives with the people who built or bought the model, not the people writing the ad. Accurate AI advertising now requires a line between the product team and the marketing team that did not have to exist when the product was a term deposit.

This is the governance gap ASIC has been describing for two years. In REP 798, its review of 624 AI use cases across 23 licensees, ASIC found that the maturity of AI governance "does not always align with the nature and scale" of licensees' AI use. Advertising is one of the most public places that gap becomes a misleading representation.

Five controls to put around AI-touched marketing

A left-to-right flow of five sky pill nodes reading draft, substantiate, review, approve and log, connected by one flowing line
Run AI-generated marketing through the same governed path as any claim.
  1. Put AI-generated content through the same sign-off as human content. The medium does not change the standard, so it should not change the process. Every AI-drafted claim gets the same substantiation and the same accountable human approval before it publishes. If your approval workflow has an AI shortcut, close it.
  2. Substantiate every AI-capability claim before it runs. For any advertisement that says a product is AI-powered, personalised or intelligent, hold a file that states what the tool actually does, on what data, and how that supports the words used. If you cannot substantiate the claim, change the claim.
  3. Disclose limitations, not just benefits. RG 234's update explicitly reaches the limitations of AI-enabled tools. An ad that lists what the AI can do and stays silent on what it cannot is the kind of half-picture that misleads. Build the limitation into the disclosure, not the fine print no one reads.
  4. Inventory where AI touches marketing. You cannot govern a process you have not mapped. List where AI drafts copy, generates images, personalises messages or is itself the advertised feature. That inventory is the scope of your new control.
  5. Name the accountable person. The model is not accountable and cannot be. For every AI-touched campaign, a named person owns whether the final claim is true and not misleading. "The AI wrote it" is a description of a failure, not an answer to a regulator.

A worked example: the campaign that overstated the tool

Here is how the exposure appears in practice, at a de-identified retail lender, call it [ORGANISATION].

[ORGANISATION] launches a budgeting feature and asks marketing to promote it. Using an AI writing tool, the team drafts a campaign in an afternoon, and the strongest line is "AI that understands your goals and tailors advice in minutes." It tests well. It also is not quite true: the feature sorts spending into categories and applies fixed thresholds, and it does not consider the customer's objectives or full situation at all.

Under the old process, that copy might have shipped. Under a process built for RG 234's update, three things happen. The claim is routed to substantiation, where the product owner confirms the feature does not weigh goals, so the word tailors and the word advice both fail. The claim is rewritten to what the tool does, "sorts your spending and flags where the budget is tight", which is honest and still sells. And the whole exchange is logged, so if a regulator ever asks how the firm satisfied itself the ad was accurate, the answer is a record, not a shrug.

The AI did the drafting, which is fine. A human owned the claim, which is the point.

Do this Monday

  1. Pull your live AI-powered claims. List every current advertisement, web page and app screen that describes a product or tool as AI-powered, intelligent or personalised. That list is your first substantiation queue.
  2. Test one claim to destruction. Take the boldest AI-capability claim you run and ask the product owner to prove it. If they cannot, it is a remediation item today, not a debate.
  3. Close the AI shortcut in approval. Confirm that AI-generated marketing content cannot bypass the human sign-off that human-written content goes through. If it can, that is the control to fix this week.
  4. Draft the limitation line. For your most-advertised AI-enabled tool, write one honest sentence on what it does not do, and get it into the disclosure.

The evidence file to build

When ASIC, internal audit or your own board asks how you keep AI-generated advertising accurate, this is the file that answers:

  • An inventory of every marketing surface where AI drafts content or is the advertised feature, with a named owner
  • A substantiation record for each live AI-capability claim, stating what the tool does and the evidence for the words used
  • Proof that AI-generated marketing goes through the same approval and human sign-off as human-written content
  • A disclosure standard that requires limitations to be stated, not only benefits
  • An approval log showing a named person accountable for each AI-touched campaign

RG 234 did not change what counts as misleading. It confirmed that AI does not get a pass. The firms that come through the next review well will be the ones that treated an AI-written ad exactly like any other claim: something a person has to be able to stand behind.

Content disclaimer: This article is for general educational and informational purposes only. It does not constitute legal advice, regulatory guidance, or a substitute for professional compliance judgement. Regulatory obligations vary by entity type, licence, and circumstance. Always refer to primary source guidance from ASIC or the relevant regulatory authority.

Primary sources

  • ASIC, Regulatory Guide 234 Advertising financial products and services (including credit), updated 9 June 2026. https://www.asic.gov.au/about-asic/news-centre/news-items/asic-updates-guidance-on-advertising-financial-products-and-services/
  • ASIC, REP 798 Beware the gap: Governance arrangements in the face of AI innovation, 29 October 2024. https://www.asic.gov.au/regulatory-resources/find-a-document/reports/rep-798-beware-the-gap-governance-arrangements-in-the-face-of-ai-innovation/
  • ASIC, 26-063MR ASIC ramps-up action to protect consumers from AI-powered online investment scams. https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-063mr-asic-ramps-up-action-to-protect-consumers-from-ai-powered-online-investment-scams/
  • ASIC Act 2001 (Cth) s 12DB; Corporations Act 2001 (Cth) s 1041H (misleading-conduct prohibitions RG 234 sits under).

TheAICommand. Intelligence, At Your Command.

Frequently asked questions

Does ASIC's RG 234 apply to AI-generated advertising?
Yes. ASIC's updated RG 234, published on 9 June 2026, makes clear that the law and ASIC's guidance apply to AI-generated advertising in the same way they apply to human-written advertising. Using an AI tool to generate a claim does not lower the standard or shift responsibility. The financial services misleading-conduct prohibitions in the ASIC Act and Corporations Act apply regardless of who or what produced the words.
What is AI-washing?
AI-washing is overstating the role, sophistication or benefit of artificial intelligence in a product or service. In financial services it looks like marketing that calls a tool AI-powered when it applies simple rules, or that promises tailored AI advice when the tool considers only a couple of data points. It is a species of misleading conduct, and RG 234's update flags disclosing the real capability and limitations of AI-enabled customer tools as part of advertising them accurately.
Do we need a human to review AI-generated marketing content?
In practice, yes. Because AI-generated advertising is held to the same standard as human-written advertising, and because generative tools can produce inaccurate, outdated or biased claims, a defensible process puts AI-generated marketing through the same substantiation and sign-off you already apply to human content. The person who approves it, not the model, is accountable for whether the final claim is true and not misleading.
What law sits behind RG 234?
RG 234 is guidance on how to comply with the misleading-conduct prohibitions, principally section 12DB of the ASIC Act, which prohibits false or misleading representations about financial services, and section 1041H of the Corporations Act, which prohibits misleading or deceptive conduct in relation to financial products. RG 234 does not create new law. It sets ASIC's expectations for how advertising, now including AI-generated advertising, meets that existing law.

Context

RG 234 was written in 2012, before generative AI existed. ASIC's decision to refresh it and name AI directly is technology-neutral consumer protection catching up to practice. It mirrors moves overseas, where the UK and US regulators have both warned that describing a product as AI-powered does not exempt the claim from the ordinary rules against misleading advertising.

AI angle

This is the first time ASIC's advertising guide expressly addresses AI. It puts two AI-specific risks inside the advertising framework at once: content generated by AI that no one verified, and claims about AI capability that the product cannot support. Both are governed as advertising conduct, and both need a human accountable for the final claim.

Primary sources

ASICRG 234AdvertisingAI-washingMisleading ConductFinancial ServicesAI GovernanceMarketing Compliance
← Back to GRC

Read next

Rome Tiber St Peters Dusk
GRCRegulatory analysis·

Governing AI Agents Before the Consumer Data Right Lets Them Act

The Consumer Data Right is gaining write access. Once actions are designated, an accredited provider, or an AI agent behind it, could initiate payments and switch products on a consumer's instruction. The controls for agent-initiated actions are far cheaper to build now, before any money can move.

Read article
Ottawa Parliament Hill Dusk
GRCRegulatory analysis·

AI in Complaints Handling: What RG 271 Reserves for a Person

Financial firms are putting AI into the exact process ASIC made enforceable in RG 271. AI can triage, summarise and draft a complaint response, but the 30 day clock, the reasons, the systemic issue call and the fairness of the outcome stay with a person. Here is the obligation map, a worked example and the prompts to build your own.

Read article
Singapore
GRCRegulatory analysis·

ASIC's AI Supervisory Posture, Decoded

ASIC's posture on AI in financial services is now visible across REP 798, the 2026 Key Issues Outlook, and recent statements from the Chair. Five themes shape supervisory expectation, and three create immediate work for compliance teams.

Read article

Content disclaimer: This article is for general educational and informational purposes only. It does not constitute legal advice, regulatory guidance, or a substitute for professional compliance judgement. Regulatory obligations vary by entity type, licence, and circumstance. Always refer to primary source guidance from APRA, ASIC, or the relevant regulatory authority.