When to check sales enablement advertising rules before you publish

What to take away

The Digital Markets, Competition and Consumers Act 2024 consumer-protection regime took effect on 6 April 2025. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025; its charitable soft opt-in change took effect on 5 February 2026. Email, text and marketing-call checks still start with PECR.
Enforcement follows the claim, not the channel. A benchmark in a sales deck or promotional LinkedIn post is a marketing communication under the CAP Code.
Check at campaign planning, before final content approval and before prospect lists are used or messages are sent. Recheck if the claim, audience, channel or automation changes.
AI-assisted outreach counts as a regulated communication. Forrester's AEGIS framework treats agentic tools as systems needing identity, permissions, audit trails and human escalation.
Evidence beats assertion. Every published figure needs a source, a date and a named owner.
The ICO's direct marketing guidance and the ASA's advice for businesses are the two pages to bookmark.

The claim and consent checks that matter

Build the review into the campaign calendar: check during planning, before approving final sales decks, one-pagers, case studies or comparison pages, and before using a prospect list or sending outreach. Recheck whenever a claim, offer, audience, channel or automation changes, leaving time to gather evidence and secure approval before the scheduled launch.

Before a claim is published

Start with the CAP Code. Rule 3.1 prohibits materially misleading marketing; rule 3.7 requires documentary evidence for objective claims before publication; and rule 3.33 covers comparisons with identifiable competitors. Rule 2.1 requires marketing communications to be obviously identifiable as such. In sales enablement the live risks are benchmark figures, customer logos and productivity claims. The ASA's advice for businesses sets out the evidence an advertiser needs when a claim is challenged.

Claim and consent checks

Claim has a source, date and owner
Comparison is like-for-like
Consent wording covers marketing
Event lists checked for opt-in
Evidence file built per claim

Build a one-line evidence file for each claim, naming the source, the date and the owner. If a deck claims a tool saves six hours a week, someone must show the calculation. For example, a team paying £400 a month for enablement software should be able to show baseline hours before and after, not a vendor's headline number.

Before you contact a prospect

For email and text marketing, check the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), alongside the UK GDPR and Data Protection Act 2018. PECR generally requires consent for unsolicited electronic marketing to individual subscribers, subject to the soft opt-in conditions; rules differ for corporate subscribers. Live marketing calls are also subject to PECR, including checks against the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS), as applicable. The ICO's direct marketing guidance explains consent, the soft opt-in and these distinctions.

Sales enablement teams often inherit lists from events or webinars. Before use, check the collection wording, the subscriber type and the lawful basis under the UK GDPR; a notice that did not mention marketing does not by itself establish that an email or text can be sent under PECR. Our guide to sales enablement data protection in England covers lawful basis and retention.

Where AI and automation change the position

AI does not remove the checks on the content or the contact method. Review AI-generated sales decks, case studies and outreach before approval or release, and repeat the check if a prompt, workflow or audience change affects the claims or messages.

Guardrails for AI-assisted outreach

Agentic tools now draft sequences, score leads and send follow-ups without a human in the loop. Forrester's AEGIS framework treats these agents as systems needing enterprise guardrails: identity, permissions, audit trails and human escalation.

AI outreach guardrails

Agent drafts sequence
Log model and prompt
Human approver reviews
Audit trail stored
Disclose paid partnerships

In practice, log which model drafted a message, which prompt was used and who approved it. If a regulator or customer asks why a claim was made, that record is your answer. The same applies to AI-written case studies and comparison pages.

Disclosure and review points

Disclose paid partnerships, affiliate arrangements and any material connection between your brand and a reviewer. CAP Code rule 2.1 requires marketing communications to be identifiable as such. A sponsored case study that reads like editorial is a problem.

Set review gates. No new claim, list import or AI workflow goes live without a named approver, recorded against the date. The wider UK rules and compliance guide for 2027 applies the same discipline across tools, data and content.

A pre-publication checklist

At campaign planning, assign an owner and identify the claims, content formats, audience and channels to be reviewed.
Before content approval, record each claim's source, date and named owner; hold evidence for objective claims before publication.
Check comparisons are like-for-like and not misleading by omission, and customer logos and quotes are covered by written permission.
Before using an email or text list, check PECR, subscriber type, consent or the conditions for the soft opt-in, and provide an opt-out where required.
Before live marketing calls, check applicable TPS or CTPS screening and objections.
Check the lawful basis, privacy information and retention arrangements for lead data under the UK GDPR and Data Protection Act 2018. Pay the ICO data protection fee unless exempt.
Before release, ensure AI-drafted content has an audit trail and a human approver, and sponsored or paid content is labelled as advertising.
Recheck after material changes and review retention periods for lead data quarterly.
A qualified adviser has reviewed anything touching regulated sectors.

This is general guidance only. Individual cases need a qualified adviser.

Common questions

Do these rules apply across the UK?

Yes. The CAP Code and UK data protection rules apply across England, Scotland, Wales and Northern Ireland, though sector rules can differ. See our UK regulations guide for England for England-specific context.

Can I email existing customers without fresh consent?

Under PECR, the soft opt-in can apply where you collected the details during a sale or negotiations for a sale and the messages concern similar products or services. You must have offered an opt-out when collecting the details and in every message. The charitable soft opt-in introduced by the Data (Use and Access) Act 2025 is a separate provision; it does not replace the conditions for commercial sales outreach.

Do I need to disclose that AI wrote a sales email?

There is no blanket duty to label every AI-assisted message. The duty is honesty and not misleading the reader, so disclose anything a reader would not expect.

Who signs off a new benchmark claim?

Name one accountable owner, usually the sales enablement lead or marketing compliance lead. Record the source and date beside the claim. If nobody will sign, do not publish it.