Brand Safety Guidelines: Write, Enforce and Audit in 2026

A marketing team can have an AI system draft a campaign, a media platform choose placements, and an automated journey send follow-up messages before anyone has reviewed the whole chain. If a risky placement or misleading asset slips through, the people responsible may not know which rule applied, who approved the exception, or where the record lives. Brand safety guidelines give people and automated systems a shared way to make those decisions while protecting both marketing budgets and customer trust.

For an AI-enabled marketing operation, a blocklist alone isn't enough. The working system needs clear owners, risk thresholds, controls across inventory and creative, and an audit trail that shows what happened and why.

Table of Contents

• The Six Parts of Brand Safety Guidelines
  • Connect the parts before campaigns launch
• Safety Floors and Suitability Tiers Explained
  • Assign decisions at the right level
• Why Brand Safety Guidelines Protect Budgets as Well as Reputation
• Writing the Policy, Taxonomy and Template
  • Write the rule in plain language
  • Make topics machine-readable
• Inventory and Partner Controls That Enforce the Rules
  • Choose the control for the job
  • Make audits consequential
• Governing AI-Generated Creative Without Blanket Labels
• Metrics That Show Your Guidelines Work
  • Measure protection and opportunity together
• Roll Out Your Governance Workflow This Quarter

The Six Parts of Brand Safety Guidelines

Brand safety guidelines are a written rulebook that tells every person, system, and partner which content and placements a brand won't fund, and how to decide the grey areas in between. Think of the rulebook like a building code: the fire code applies to every tenant, while the choice of paint belongs to each occupant. A marketing team needs the same distinction, with universal boundaries and configurable choices.

The table connects each part of the rulebook to a practical question, an accountable function, and an artifact that shows the work exists.

Components of brand safety guidelines

Connect the parts before campaigns launch

These components only work as a chain. A taxonomy nobody enforces through inventory settings is just a list of labels. Measurement without a written policy has no standard to measure against, and a policy without named owners can't guide decisions when a platform flags an asset or an agency asks for an exception.

Start by checking whether each part has both an owner and a usable artifact. The question isn't whether a document exists somewhere, but whether a campaign operator can find the applicable rule and act on it before money is spent.

Before moving on: Mark each component as owned, documented, and operational. Any part missing one of those three marks needs an owner and a next action.

Safety Floors and Suitability Tiers Explained

A seatbelt is required; the seat choice is personal. A brand safety floor is the boundary every campaign must respect, with no exceptions. Brand suitability lets a brand decide how much risk to accept in content that falls outside that floor.

The Global Alliance for Responsible Media (GARM) was launched by the World Federation of Advertisers in 2019 after repeated incidents of ads appearing beside harmful content. Its first framework, published in September 2020, gave advertisers, agencies, platforms, and verification providers shared definitions for the safety floor and suitability framework. The IAB's brand safety and suitability recommendations describe how a shared baseline can sit alongside configurable decisions based on a brand's risk tolerance.

The tiers below make that distinction operational. The floor is fixed; the other actions guide how teams review sensitive but potentially acceptable contexts.

Risk tiers in brand safety guidelines

Assign decisions at the right level

Floor rules aren't campaign preferences. A campaign manager can ask for a review, but can't override a universal exclusion to meet a delivery target. That separation prevents a short-term performance pressure from weakening a boundary that applies to every brand and market.

High-risk content requires a deliberate opt-in from the brand safety lead. Medium-risk material can be evaluated in context by the campaign owner with brand safety sign-off, while low-risk material can proceed under the default rule. A taxonomy such as the IAB Tech Lab Content Taxonomy 2.2 implementation guide gives teams shared topic labels and risk attributes to apply consistently.

The working rule is simple: the floor is shared, the tiers are configured, and every exception is logged with a reason.

Why Brand Safety Guidelines Protect Budgets as Well as Reputation

A study referenced by Stanford analyzed more than 9 million advertisements from 42,595 advertisers across 5,400 websites between 2019 and 2021. It found that 67% of advertisers unknowingly placed ads on misinformation websites, while 74.5% of sites identified as misinformation sources received financial support from advertising, according to the NewsGuard account of the study.

At least 46% of brands in every industry studied had ads appear on misinformation sites, reaching 82% in some industries. Among the 100 most active advertisers, 55% had such placements. Earlier research cited in the same account estimated that brands unintentionally directed more than $2.6 billion in advertising revenue to misinformation publishers each year.

A broad-targeting campaign can run for a week on placements nobody on the marketing team approved. The team may learn about it only after a customer complains, even though the budget has already flowed through automated buying and an opaque supply chain. That outcome doesn't require anyone to deliberately choose a harmful publisher; it can emerge from the way targeting, inventory selection, and multiple intermediaries operate together.

Guidelines make the budget easier to govern when they become enforceable settings: category exclusions, publisher rules, approval thresholds, continuous placement checks, suppression logic, and records of decisions and spend. That's how teams can investigate a complaint, identify the control that failed, and decide whether the next step is a policy change or a partner correction.

The protection is practical, not abstract: fewer dollars go to placements the team never intended to fund, customers see fewer damaging associations, and AI-generated output has checks that keep pace with automated execution. For a related checklist on operational controls, see The AI CMO's marketing compliance checklist.

Writing the Policy, Taxonomy and Template

A useful policy has to work for people and machines. Start with a one-page document that states the purpose, the channels in scope, the universal floor, the suitability rules, and the escalation path. Include paid media, email, landing pages, SMS, WhatsApp, push notifications, and support replies so that automated marketing doesn't fall outside the rules just because it runs through a different channel.

Write the rule in plain language

A clause should name the condition, the required action, and who can approve an exception. For example:

Any placement rated floor in any market is excluded from every campaign; high-risk placements need brand safety lead approval, logged with a reason.

The floor should remain the same across markets. Suitability rules can account for the campaign's audience, objective, geography, channel, and brand values. That makes the policy firm where it must be and adaptable where context matters.

Make topics machine-readable

The IAB Tech Lab Content Taxonomy 2.2 offers shared topic categories for adult and explicit content; arms and ammunition; crime and harmful acts; death, injury, or military conflict; online piracy; hate speech and aggression; obscenity and profanity; illegal drugs, tobacco, e-cigarettes, vaping, and alcohol; spam or harmful content; terrorism; and sensitive social issues. Teams can use those topic labels as the vocabulary behind their rules instead of inventing inconsistent categories for each platform.

For every rule, store five fields: topic, risk level, market, channel, and approval status. A readable policy page helps a marketer understand the decision; structured fields let an automated platform apply the same rule during inventory selection, creative generation, and journey sends.

Starter template

Keep the policy readable and the rule fields precise. The template becomes useful when a team can look at a live campaign and determine which rule applies without guessing or searching through chat history.

Inventory and Partner Controls That Enforce the Rules

A media team's inventory setting is a real choice between reach and sensitivity. Google's YouTube controls describe three levels: expanded, standard, and limited inventory. Expanded maximizes reach across monetized videos, including some comedy or documentary content with strong profanity and video-game content with excessive violence; standard is intended for most brands; limited applies heightened restrictions and can exclude popular music videos and other pop-culture content. The Google Ads inventory suitability reference illustrates why one universal setting won't fit every campaign.

Use expanded inventory when scale is important and the brand accepts more contextual exposure. Standard is a reasonable starting point for many campaigns. Limited may suit children's, health, or highly sensitive categories, though the team should check the reach cost rather than assuming tighter controls have no performance impact.

Choose the control for the job

Inclusion lists are useful when a campaign must run only in a selected set of premium environments. Exclusion lists can remove known unsuitable publishers from a broader buy, but shouldn't replace contextual review. Advertiser-level suitability settings provide another layer: in systems that support them, a setting can apply across the advertiser's associated line items rather than requiring the media team to configure each one separately.

Partner vetting should ask direct operational questions:

• Policy: Does the partner publish its brand safety policy?
• Verification: Which verification vendor does it use?
• Coverage: Does it support both pre-bid and post-bid checks?
• Supply path: How does it document supply-path transparency?
• Incident response: How quickly does it report a placement incident?

Make audits consequential

Each month, compare delivered placements against the written policy. Record the placement, rule, campaign, decision, and corrective action so the team can distinguish a misclassification from a missing platform setting. If a partner fails the audit twice, suspend it until the gap is fixed and verified; otherwise, the same defect can keep consuming budget while the team treats it as a paperwork issue.

Governing AI-Generated Creative Without Blanket Labels

Not every AI-generated asset needs the same disclosure treatment. The useful test isn't whether AI touched the work; it's whether the content could materially mislead people about what they're seeing, hearing, or interacting with. Research reported by the World Federation of Advertisers on AI labelling found that global brands cited fragmented regulatory obligations (61%), uncertainty about consumer expectations (46%), and lack of industry best practice (39%). In the same research, 96% of respondents supported disclosure for an AI-generated voice audiences might mistake for a human, and 91% supported labelling a synthetic human playing a central role in an advertisement.

A risk-based process can check policy before generation, filter prohibited concepts during generation, classify outputs after generation, and route high-risk or low-confidence cases to a human reviewer. The NIST AI Risk Management Framework supports a layered approach to harmful or inappropriate outputs, with traceable decisions and escalation rather than blanket suppression.

A marketer using a tool such as ShortGenius AI ad creative tool, which supports AI video and ad generation, still needs the same approval record as a marketer using any other creative workflow. A generation platform can create assets quickly; the brand's rules determine when those assets can run.

The evidence column makes an audit possible months later, when nobody remembers why an asset was approved. An enterprise-wide operating model also needs clear owners and consistent controls across teams, a subject covered in The AI CMO's guide to enterprise governance.

Metrics That Show Your Guidelines Work

A blocked-item count works like a smoke alarm tally: it proves the system reacted, but it cannot say whether it stopped a real hazard or cleared a safe room. Treat raw blocks as activity, then pair them with measures for misses and over-blocking before anyone changes a threshold.

Give each row an owner, a configurable threshold, and a place where the evidence is stored. When a threshold is crossed, the named owner should be able to see which rule fired, which classifier version produced the flag, who reviewed it, and what decision followed. That turns a dashboard into a governance control rather than a scoreboard.

Measure protection and opportunity together

Exclusions reduce exposure, but they can also remove credible editorial environments. Track the reach and revenue lost to blocking alongside the placements caught, so a team can see whether stricter settings protect a sensitive campaign or unnecessarily limit a campaign built around broad reach.

Use ad verification vendors for post-bid checks and DSP or ad-platform suitability settings for controls at advertiser level. A versioned policy registry should record the rule and classifier versions, confidence score, reviewer decision, destination channel, and final send outcome; the registry preserves the history needed for later audit.

For example, if false positives rise on news placements, the team can review the affected stories and add an inclusion list for suitable publishers rather than widening the blocklist. A short monthly review can cover the seven metrics, inspect exceptions, assign corrective actions, and record each decision in the registry.

Roll Out Your Governance Workflow This Quarter

A practical rollout starts with accountable ownership and ends with evidence the team can audit. These six actions give marketing operations a manageable sequence:

1. Name one owner and publish the policy. Nothing else can be enforced until someone signs the floor, tiers, and escalation path.
2. Load structured rules. Add topic, risk level, market, channel, and approval status for each brand so people and systems can apply them.
3. Set inventory and approval thresholds. Start with paid video, where exposure settings can shape placement decisions.
4. Adopt the AI creative matrix. Retain evidence for each asset so approvals can be reconstructed later.
5. Vet partners and switch on monitoring. Find gaps before campaign budgets scale.
6. Review the metrics monthly. Log each exception with a reason and expiry date so overrides stay visible.

For teams formalizing sign-off, The AI CMO's guide to content approval workflows offers a relevant process reference.

Choose one brand, complete the first three actions this month, and schedule its first placement audit before the next campaign launches. Keep an append-only record of decisions, sends, and spending from day one.

---

The AI CMO brings marketing planning, creative production, campaign execution, customer data, and performance reporting into one operating environment, with configurable approvals and an append-only ledger. Visit The AI CMO to explore how shared workflows and recorded decisions can support practical brand safety governance across AI-driven marketing.