Promotional & marketing compliance review (MLR, financial promotions, green claims)

In regulated industries every piece of marketing (a detail aid for doctors, a fund factsheet, a social post about a "climate-neutral" product) has to pass a review against law, industry codes, approved claims and brand rules before it can be published. The reviewers are scarce lawyers, physicians and compliance officers, and much of what they correct is routine: a missing risk warning, a superlative without a study behind it, an outdated disclaimer. An AI pre-reviewer reads the draft, links every claim to an approved reference or flags it, checks for mandatory elements and prohibited wording, cites the rule and proposes a rewrite. Humans still sign off, but the drafts they see are cleaner, so they spend their time on judgement calls.

Problem & value

• Today: pharma uses a formal Medical-Legal-Regulatory (MLR) or PRC review, usually run in Veeva Vault PromoMats. Banks, insurers and asset managers have compliance sign-off of financial promotions. Consumer brands rely on legal review and agency checks. Content volume has exploded with omnichannel, modular and now generative content. Review capacity has not grown with it, so queues of days to weeks are common, and the same comments come back round after round.
• Regulatory pressure is rising: the UK FCA requires every financial promotion to be "clear, fair and not misleading" in any medium, including social media, and has introduced a gateway for firms that approve promotions for others [5]. In the EU, Directive (EU) 2024/825 ("Empowering consumers for the green transition") has applied since 27 September 2026. It amends the UCPD and tightens the rules on greenwashing claims [6]. Generative AI also brings a new check: disclosure duties for AI-generated content under AI Act Art. 50, which have applied since 2 August 2026 [7].
• AI value (vendor-reported, not independently verified): Saifr says its review model detects "up to 90%" of what a human reviewer would flag and gets content to market "up to 10x faster" [2]. Veeva reports a +50% average gain in speed to market for PromoMats overall (not attributed to AI alone). For its agentic Falcon MLR it states a target of a 70% cut in manual labour within five years [1]. Measure your own baseline before relying on these figures.

Variants

• Pharma / medtech MLR: promotion of medicines to healthcare professionals (EFPIA Code, national codes such as FSA/AKG in Germany, ABPI in the UK) and the German Heilmittelwerbegesetz: misleading advertising (§3), mandatory information (§4 Pflichtangaben), restrictions on lay advertising (§11) [3][4]. Core step: claim-to-reference substantiation against SmPC and studies, plus off-label detection. MDR Art. 7 adds rules for medical-device claims.
• Financial promotions: MiFID II Art. 24(3) (fair, clear, not misleading; balanced risk/benefit), PRIIPs, UK FCA COBS 4 and Consumer Duty, US FINRA Rule 2210. Typical checks: past-performance warnings, risk prominence, guaranteed-return wording, ESG fund naming.
• Insurance & consumer credit: IDD marketing rules, Consumer Credit Directive (representative APR example).
• Green claims across consumer goods, energy, food and retail: under Directive 2024/825, generic environmental claims, sustainability labels not based on certification schemes, and offsetting-based "climate neutral" product claims are among the newly blacklisted practices. The tool checks each claim against certificates, LCA data or approved evidence. The marketing-side greenwashing part of the merged ESG candidate is covered here. Investor-side controversy screening is in LANG-018/LANG-037.
• Food, cosmetics, alcohol, gambling: nutrition and health claims (Reg. 1924/2006 and the EU Register of authorised claims), cosmetic claims criteria (Reg. 655/2013), gambling ad codes.
• Brand-guideline and AI-label checks for any company: tone, forbidden words, logo use (with a VLM), and whether AI-generated images or video need an Art. 50 disclosure.
• SMB: a shop owner or agency checks product pages and ads for UWG/HWG pitfalls and "climate-neutral"-type wording before publishing. A lightweight version of the same pipeline.

How it works

1. draft asset (DOCX/PDF/HTML/image/video)
2. parse & normalise (OCR/layout; ASR for voice-over; VLM for images, small print, logos)
3. claim segmentation (split into atomic claims, statements, visuals, footnotes)
4. retrieval: rules for product × market × channel × audience (HCP vs. lay, retail vs. professional) + approved claims library + references
5. per-claim reasoning: substantiated? prohibited wording? missing balance/risk info?
6. completeness checks: mandatory elements, disclaimers, AI-content disclosure, brand rules
7. findings with rule citation, evidence link, severity, suggested rewrite
8. routing: low-risk
9. fast-track reviewer | high-risk
10. full MLR/compliance committee
11. reviewer accepts/rejects each finding
12. audit log
13. feedback into rules & prompts

• Rules as data: encode rulebooks as versioned, retrievable check items (ID, scope, text, examples of violations and of compliant wording) instead of one giant prompt. This makes each finding traceable to a rule, which auditors and reviewers need.
• Claim substantiation is retrieval plus entailment: does the referenced passage actually support the claim as worded (population, endpoint, magnitude)? Reasoning models do this far better than similarity search alone.
• Human-in-the-loop: the AI never approves. It pre-reviews, and the accountable signatory (pharma: Informationsbeauftragter/medical signatory; finance: compliance function) decides. Reviewer overrides are the main learning signal.

Data preparation

The review is only as good as the rulebook and claims library behind it. Data: statutes and codes (HWG, UWG, MiFID II/PRIIPs, Directive 2024/825), regulator guidance, approved claims with references (studies, SmPC, certificates), mandatory disclaimers, brand guidelines, and past review comments. In an SMB these live in PDFs, Word files, e-mail threads with the legal adviser and a marketing share drive.

Typical gaps: claims without a traceable reference, outdated disclaimers, review feedback only in e-mail or comments, scanned certificates, and no category scheme for claim types.

Steps: - Build an authoritative claims and disclaimer library with references and validity dates (PREP-013, PREP-016). - Define claim categories and severity levels (PREP-019). - Harvest past review decisions as labels (PREP-020). - Build a test set with the compliance team (PREP-018). - OCR scanned evidence (DOC-014).

Tools: a DMS or SharePoint with metadata, a vector database, a simple spreadsheet for the claims library to start. Expect around 40 percent of effort in claims library and test set; the library also serves related use cases such as LANG-021.

Implementation paths

Which path for whom

• SMB: B, because MLR suites are priced for large companies and the value comes from your own rulebook, claims library and brand rules, which a cloud-API pipeline can use directly.
• Enterprise: A, because mature MLR and compliance suites (for example Veeva PromoMats) integrate with existing content and approval workflows.
• Developer: B, because LLM APIs with retrieval over rulebooks and claims allow fast prototyping and evaluation.

Path A — Buy (recommended for large regulated companies)

• Pharma/life sciences: Veeva Vault PromoMats with Vault AI agents (e.g. the Quick Check Agent used at Moderna, claims-library agents) and the agentic Veeva Falcon MLR, built on Veeva's acquisition of Copli [1]. Veeva hosts in EU data centres.
• Financial services: Saifr (SaifrReview, a Fidelity/FMR company) for marketing review in banking, insurance and wealth [2]. Red Marker (IntelligenceBank) covers financial services, insurance, automotive, telco, food and pharma, with rule libraries for FCA and FINRA [8].
• Workflow hosts: proofing and approval platforms (e.g. Filestage (DE), Ziflow, Adobe Workfront) and DAMs, where a pre-review step can be plugged in via API.
• Choose A when you already run a review workflow in one of these systems and your rulebooks are the standard ones those vendors maintain. Check that EU-specific rules (HWG, 2024/825, German UWG) are covered and not only US/UK ones.

Path B — Build on cloud APIs

• Models: a reasoning-capable frontier model for per-claim judgement (Claude, GPT, Gemini via EU-region endpoints on Bedrock/Azure/Vertex, or Mistral Large/Medium from Mistral AI (FR) as an EU provider). A VLM call for images, small print and logos, and an ASR API for video voice-over.
• Retrieval: embed rulebooks, code articles and the claims library (e.g. Mistral or Cohere embeddings, pgvector/OpenSearch) and rerank. Use structured outputs for findings (JSON schema: claim, rule_id, severity, evidence, rewrite).
• Integration: a plugin/API step in the DAM or proofing tool, or an add-in for Word, Figma or the CMS. Use n8n or Power Automate for routing. Run an evaluation harness on past reviewed assets.
• Choose B when your rulebook is specific (EU national law, own brand rules, niche sector) or no vendor covers your markets.

Path C — Self-host (open source)

• Models: gpt-oss-120b or Qwen3 (large MoE variants) for reasoning, Mistral Small 3.x for cheaper checks, Qwen3-VL for images and layouts, Whisper large-v3 for voice-over. Serve via vLLM with structured-output decoding.
• Stack: Docling for document parsing, Qwen3-Embedding or BGE-M3 plus bge-reranker-v2-m3 for retrieval, Postgres/pgvector or OpenSearch, Langfuse for tracing, n8n for workflow.
• Hardware: HW3 (one 80–141 GB GPU or RTX PRO 6000 class) for a ~100B-class reasoning model plus a VLM. HW2 is enough for brand/wording checks with smaller models, but substantiation quality drops.
• Choose C when unpublished product data, pre-launch claims or trial results must not leave the company (common in pharma before approval).

Path D — Custom training

Worth it only at high volume with a large archive of reviewed assets, e.g. a pharma company or bank with tens of thousands of past MLR/compliance comments. Fine-tune a small model or encoder classifier to predict the comments reviewers typically make and to triage risk. Keep the rule-grounded LLM check for explanations. Data needed: assets with the reviewers' annotations, mapped to rule IDs. Clean the labels first, because reviewer comments are inconsistent.

State of the art (2026)

• Agentic review inside the content system: vendors have moved from keyword lexicons (classic "risky word" lists) to LLM agents that read the whole asset, check claims against a library and write review comments (Veeva Vault AI and Falcon MLR, Saifr, Red Marker's RiskGPT) [1][2][8].
• Techniques that work: atomic claim decomposition, rule retrieval per market/audience, entailment checks against references, multimodal reading of rendered assets (not just source text), and calibrated severity with "uncertain → human" routing.
• New rule sets in 2026: Directive 2024/825 on green claims (applies from 27 Sept 2026) [6], AI Act Art. 50 transparency (applies from 2 Aug 2026) [7], and the EFPIA Code [3].
• Limits and failure modes: LLMs over-flag (reviewer fatigue) and under-flag implied claims built from imagery plus text. They misread nuanced code rules (HCP vs. public audience), may "approve" claims backed by a reference that does not actually support them, and lag behind rule changes unless the rulebook is maintained. There is no public benchmark for promotional-compliance review, so evaluation must use your own historical review decisions.

Shared resources & combinations

• Same rule-checking stack (llm-reasoning + retrieval over rulebooks): DOC-016 (document compliance checking), DOC-027 (packaging/label proofing, which shares the claims library and VLM), KNOW-009 (standards Q&A), AGENT-018 (continuous controls monitoring). One self-hosted HW3 server and one rule repository can serve all of them.
• Upstream generators: LANG-001 marketing copy, LANG-005 SEO content, LANG-007 social posts, GEN-001/GEN-002 imagery and video. Put LANG-024 as a gate behind them ("generate → check → human"). LANG-011 then applies brand-voice rewrites. LANG-009 handles localisation, and each market variant needs re-checking.
• Regulatory feed: LANG-020 horizon scanning keeps the rulebook current. SEC-022 tracks AI-labelling duties. LANG-032 (eComms surveillance) covers the person-to-person channel that promotion rules also reach.
• Pharma chain: HLTH-017 regulatory writing (source of approved wording) and HLTH-010 pharmacovigilance (adverse events found in social content). ESG chain: DATA-012 provides the evidence behind green claims, and LANG-018/LANG-037 cover investor-side screening.

Effort, cost & KPIs

• Path A: weeks to a few months to configure rule sets and claims libraries in an existing PromoMats or proofing workflow. Licence costs are typically enterprise-level per seat or volume.
• Path B: 2–4 months for a pilot on one product/market. Most of the effort goes into encoding rules and building an evaluation set from past reviews, not into model cost.
• Path C: 3–6 months plus GPU server and MLOps.
• Cost drivers: rulebook curation and upkeep per market, claims-library maintenance, reviewer time to calibrate, multimodal processing of video.
• KPIs: review cycle time and number of review rounds per asset, recall of the AI on issues later raised by human reviewers, false-flag rate, share of assets fast-tracked, post-publication findings (regulator letters, complaints, withdrawals), reviewer hours per asset.

People & change

Start with management and the head of marketing or communications as process owner, and bring in legal-compliance (and medical or regulatory affairs in pharma) from day one: they own the rulebook and the final sign-off. IT handles integration with the content tools; data owners maintain claims and evidence. Agencies that submit material should be told how pre-screening works.

Works council: usually no, because the tool reviews documents, not employees. It can become relevant if reviewer decisions or error rates are logged per person (§87(1) no. 6 BetrVG); inform the council in good time under §90(1) no. 3 where review work changes.

Data protection: marketing material may contain testimonials or patient or customer data; involve the DPO, check the need for a DPIA and sign an AVV (Art. 28 GDPR) with cloud providers. AI literacy: support marketers and reviewers with training on what the pre-check can and cannot catch (AI Act Art. 4; GUIDE-006). Pilot with one product line and a fast-track route for low-risk items. Typical concern: "AI approves non-compliant claims". Keep the human sign-off, log AI findings against decisions and track misses. See GUIDE-009 and GUIDE-014.

Risks, regulation & compliance

• EU AI Act: minimal risk in the typical form. An internal decision-support tool for content review is not listed in Annex III and does not decide about natural persons. The AI-literacy duty (Art. 4) applies. The tool helps deployers meet their own Art. 50(4) obligations, e.g. labelling deepfake-style imagery [7].
• Liability stays human: under HWG/EFPIA, MiFID II/FCA rules and the UCPD, the advertiser and the named signatory remain responsible. Document that AI findings are advisory, and keep an audit trail of AI findings, reviewer decisions and final approved versions (inspection- and audit-ready, e.g. for FCA or the pharma self-regulation bodies).
• GDPR: mostly non-personal content, but testimonials, HCP names, customer case studies and images of people are personal data. Use a DPA with the vendor, EU hosting, and no training on your data without consent.
• Confidentiality: pre-launch claims and unpublished study data are trade secrets (and may be insider information for listed companies). Use Path C or contractually zero-retention EU endpoints.
• Model risk: false negatives create a false sense of safety. Never let a "no findings" result skip human review for high-risk channels (HCP promotion, retail investment products, green claims).
• Mitigations: versioned rulebooks with owner and effective dates, a regression test set of past assets, periodic sampling of fast-tracked items, and a separate VLM pass on rendered output.

Getting started

1. Pick one high-volume asset type and market (e.g. German social posts for one product line) and collect 100–300 past assets with their reviewer comments as an evaluation set.
2. Turn the relevant rules (HWG/EFPIA, FCA/MiFID, 2024/825, brand guide) into a structured rulebook with IDs, scope and examples. Build or clean the approved-claims library with references.
3. Pilot a vendor (Veeva, Saifr, Red Marker) or a Path B prototype on the evaluation set. Measure recall against human findings and the false-flag rate.
4. Insert the AI as a pre-review step before formal MLR/compliance sign-off, never in place of it. Route by severity.
5. Review overrides monthly, update rules on regulatory change (LANG-020 feed), and extend to more markets and channels.

Sources

1. Veeva — Vault PromoMats (Vault AI agents, Quick Check Agent, Falcon MLR, impact figures) — https://www.veeva.com/products/vault-promomats/
2. Saifr — AI compliance for marketing review (SaifrReview, vendor-reported figures) — https://saifr.ai/
3. EFPIA — The EFPIA Code — https://www.efpia.eu/relationships-code/the-efpia-code/
4. Heilmittelwerbegesetz (HWG), German Federal Ministry of Justice — https://www.gesetze-im-internet.de/heilmwerbg/
5. UK FCA — Financial promotions and adverts — https://www.fca.org.uk/firms/financial-promotions-adverts
6. European Commission — Sustainable consumption / Empowering consumers for the green transition (Directive 2024/825, transposition 27 Mar 2026, application 27 Sep 2026) — https://commission.europa.eu/live-work-travel-eu/consumer-rights-and-complaints/sustainable-consumption_en
7. EU AI Act, Article 50 — Transparency obligations — https://artificialintelligenceact.eu/article/50/
8. Red Marker (IntelligenceBank) — automated advertising compliance review — https://www.redmarker.ai/
9. Directive (EU) 2024/825 — https://eur-lex.europa.eu/eli/dir/2024/825/oj
10. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj