Content Governance When AI Writes the First Draft

Content governance is the set of controls that decide what a company is allowed to say and who verifies it before it ships. Content operations decides who does what, when. Most tools sold as governance are operations wearing a governance label — and the difference stopped being academic the moment AI started writing the first draft.

We build these controls for clients. Here's what it looks like when you actually run one.

What we found when we audited one client's numbers against their own research

A client of ours publishes an annual research report — real first-party analysis, hundreds of millions of transactions, the kind of asset most B2B companies would trade a quarter of pipeline for. Their sales and marketing teams cite it constantly. By any reasonable standard, this is a company with good proof.

We built their canon and started with something unglamorous: taking every number appearing in their live outreach and tracing it back to the report.

Almost all of it traced. Almost.

One recurring stat used two different denominators depending on which asset it appeared in — the same headline percentage, computed once against new customers and once against active ones. Two genuinely different populations. Both figures were correct. They were not the same claim, and they were being used interchangeably.

A second line described a customer outcome as a doubling. The sourced record supported a real, meaningful lift — just not a doubling. Somebody had done arithmetic at write time, rounded in the flattering direction, and the number had been in market ever since.

A third borrowed a two-part figure from a well-known consultancy. Half of it appeared in the report. The other half didn't appear anywhere. It had been riding along on the credibility of its better-sourced twin.

And in the other direction — the part nobody expects — one of their best-performing lines understated their own result. Someone had described a gap in percentage points when the underlying data supported a multiple. The governed number was stronger than the one they'd been shipping.

Nobody was careless. Nobody lied. This is what happens to numbers that live in four places at once, get restated by different people for different audiences, and have no row anywhere saying what they are.

What is content governance, and what does the market usually mean by it?

Search the term and you'll find a well-built body of work about roles, permissions, taxonomy, review routing, and publishing cadence. Bynder, Contentful, Mailchimp, and Highspot all have solid pages on it. That work is real and worth doing.

It is also, almost entirely, about who touches the content. Very little of it is about whether what shipped is true.

The distinction is easiest to see side by side:

The workflow column was a fair place to concentrate when a marketing team published four things a month and a human wrote every word. Verification rode along inside the writing. The person who typed the number had usually met the number.

What changed: one wrong claim is no longer one wrong claim

Volume broke the old definition, but not in the way people usually mean.

Content Marketing Institute's 2026 B2B research — 1,015 marketers — found 95% now use AI somewhere in their workflow, while only about 39% of those using it for content creation say their content's performance has improved. Read those together and the story isn't that AI failed. It's that throughput went up an order of magnitude and verification capacity didn't move. The bottleneck that used to double as quality control disappeared, and nothing replaced it.

The scale of that shift is measurable. Ahrefs ran 900,000 newly created web pages from April 2025 through their own detector and found 74.2% contained AI-generated content. The breakdown matters more than the headline: only 2.5% were pure AI with no human involvement. Nearly 72% were human-AI blends.

That blend number is the whole problem. Pure machine output is a governance question everyone already understands. A human-AI blend is a person who reviewed the prose — checked that it flowed, that it sounded like the brand, that the argument held — and did not re-derive the number, because the number arrived pre-formatted inside a paragraph that read like it had already been checked.

And the count of assets isn't really the change either. The change is that assets stopped being independent.

A flagship report becomes the mother asset for a derivative tree: outreach sequences, follow-up templates, sales slides, one-pagers, social posts, landing sections, an FAQ block, a chatbot's knowledge base. In the pre-AI version of that tree, each branch cost someone an afternoon, and somewhere in that afternoon a human looked at the number. In the current version, the tree grows in a morning, and the number is copied rather than considered.

So a single unruled claim doesn't produce one error. It seeds a generation. By the time anyone notices, the wrong denominator is in eleven places, three of which are now the source somebody else is copying from — including, increasingly, your own AI, which will happily cite your landing page back to you as evidence.

We saw a mild version at the client above: four different multiples circulating for related-but-distinct measures, each traceable to something real, none wrong on its own, collectively incoherent. Nobody introduced an error. The system simply had no mechanism for holding a number still while it was copied.

That's the compounding cost, and it's why the old governance model — which assumed a human bottleneck that no longer exists — governs the wrong thing.

Who enforces content governance now? Not a regulator — the engines deciding whether to cite you

Here's where most people expect a compliance argument. It isn't one.

There is a legal floor — the FTC requires an advertiser to hold a reasonable basis for any objective claim before it's disseminated — but nobody is going to enforce it against your Series B SaaS company's retention stat. No agency counts your misattributions. Nobody publishes a letter when a number drifts. If you're waiting for external pressure to justify this work, it isn't coming.

What replaced it is stranger and, for a marketer, more consequential.

Your claims are now read by machines before they're read by buyers. A buyer asks an engine about your category; the engine assembles an answer from your site, your PDFs, third-party coverage, and whatever your competitors published. That process is synthesis, and synthesis is unforgiving of inconsistency in a way a human reader never was. A person browsing three of your pages will not notice that one says 35% and another implies 40%. A system reading all of them at once has nothing but the comparison.

This is a documented problem, not a marketing theory. Google researchers published a taxonomy of knowledge-conflict types in retrieval-augmented generation — the architecture behind AI search — along with an expert-annotated benchmark, and found that models often struggle to resolve conflicting information across retrieved sources appropriately (DRAGged into Conflicts, 2025). The category the models handled worst was conflicting opinions and research outcomes, where responses tended toward a single viewpoint rather than a balanced account of the disagreement.

Sit with what that means when the conflicting sources are all yours. The engine isn't adjudicating between you and a competitor. It's adjudicating between your landing page and your PDF, and it will resolve that conflict without asking you, in a way you can't see, in front of a buyer.

The positive case is documented too. The Princeton-led study that named generative engine optimization tested content modifications across roughly 10,000 queries and found that adding statistics, citations, and quotations were among the highest-performing methods, with visibility gains the authors describe as reaching up to 40% (Aggarwal et al., KDD 2024). The mechanism is intuitive: a synthesizer reaching for something to attribute prefers a discrete, checkable unit over qualitative prose.

Worth saying plainly, since this article is about not overstating things — that 40% is an upper bound, not an average. The paper itself reports the lift varying substantially by domain, and follow-up work already treats those token-level tactics as weak baselines to beat rather than reliable levers (Liu & Xu, 2026). Treat the effect size as unsettled. The argument here doesn't depend on it: whatever the lift from adding a statistic, the cost of adding four versions of one is not in dispute.

That's the barometer now. Not a fine. Citability — whether an engine can pick your claim up and stand behind it, and whether a buyer who checks finds the same number twice.

Where do these controls come from? Regulated marketing has run them for decades

None of this is new. It's just never been available to companies without a compliance department.

Regulated marketing has run this discipline for decades. In pharma it's MLR review — medical, legal, regulatory — and at its center sits a claims library: approved claims stored with their substantiation, each traceable to a specific source, indexed so content teams draw from a validated base rather than writing fresh assertions. Review is performed by people who are explicitly not the author. Financial services and consumer packaged goods run structurally similar systems under different names.

The apparatus around those systems is regulatory — submission forms, specialist reviewers, audit trails built to survive an inspection — and none of it transfers. Ignore it.

The philosophy underneath does transfer, and it was always doing two jobs at once. It kept regulators satisfied. It also kept a large organization saying one coherent thing across thousands of assets and hundreds of people. That second job was invisible while the first paid the bills. It's the one you now need, and for the same structural reason pharma did: too much output, too many hands, no way for any individual to hold the whole picture.

The difference is that you're implementing it for visibility rather than for compliance. Same controls. Different scoreboard.

Which five controls are worth stealing?

Strip the regulatory apparatus and what remains is small enough to run in a repo: one approved source per claim, arithmetic treated as a new claim, populations treated as separate claims, a translated form for every number, and a separate reviewer at the ship gate. We use these on every canon we build.

1. One approved source per claim. Every number and every substantive claim gets exactly one entry, with one status and one usage rule. Duplicated numbers are where drift starts. The stats registry is the smallest useful version and the first thing we stand up.

2. Arithmetic is a new claim. A multiple, a difference, a percentage-point gap, a per-customer restatement — each is a distinct claim even when every input is approved. Writers don't compute at write time; they request that the registry gain the derived form as its own row. This control catches the flattering error and the one that undersells you, and in our experience it catches the second more often than anyone expects.

3. Two numbers about different populations are two claims. Different windows, different entry conditions, different denominators. "That's the same arithmetic" is itself an assertion and needs a ruling before it's true. A row that doesn't say which population it describes isn't finished.

A demonstration, using this article's own sources. The Princeton GEO figure cited above is restated across the industry as "up to 40%," "30–40%," "22 to 41 percent," "+41% on Quotation Addition," "+31% on Statistics Addition," and "115% for position-five pages." Every one traces to the same paper. They describe different methods measured against different metrics, and they are routinely used interchangeably — including by vendors selling AI-visibility software. Separately, at least one widely-shared statistics roundup circulates a near-identical 74% figure — credited to a different company, with a different sample — interchangeably with the Ahrefs number.

No regulator is anywhere near this. It is happening in our category, in the literature we just cited, among people whose job is measuring things. That is what numbers do when nothing holds them still.

4. Every number carries a translated form — and the translated form leads. This one we learned from a client rather than from pharma. A sales leader told us flatly that a lift multiple doesn't land: a marketer can't picture it, himself included. His own translation of the same figure — expressed as what happens to a handful of individual customers — landed every time. So each proof point carries both: the governed figure and the plain-language rendering of what it proves, plus a rule for which leads depending on the reader. Ratios become supporting evidence, not the headline. A number nobody can picture doesn't persuade anyone, however well-sourced.

5. A separate reviewer at the ship gate. Never the author — the author has read past the error nine times already. Re-derive every number cold from the finished artifact and check each against the registry. Start with the restatement surfaces: headline, TL;DR, stat chip, caption, alt text, meta description. Those get written last, by someone in a hurry, and that's where a governed claim quietly becomes an ungoverned one.

Notice what isn't on this list: approval routing, permissions, publishing calendars. Those are content operations. Keep them. They just aren't what stands between your AI and a false claim.

Where should governed claims come from in the first place?

A registry only helps if what's in it is true. A perfectly change-controlled framework full of unverified assertions is a well-managed fiction.

This is where most AI content governance stops and where we think it should start. Brand-voice tooling keeps outputs sounding alike while they contradict each other on the facts. Getting the facts right is an upstream problem, and it depends entirely on where your claims originate.

Ours originate on the record. Proof gets captured through intentional interviews — customers, executives, practitioners — on video, attributed to a named person, approved through dual consent. Every quote and outcome number in the Proofbase traces to a specific human being who said it and agreed to it being said. That's what the registry rows point at.

Attribution isn't decoration, and there's evidence it does mechanical work. Researchers evaluating retrieval-augmented models on conflicting evidence found that incorporating source-credibility information into retrieval and generation significantly improved the models' ability to resolve those conflicts (CONFACT, IJCAI 2025). A claim with a named human behind it gives a synthesizer something to weigh. An unattributed assertion gives it nothing, and unattributed assertions are what most B2B marketing consists of.

Two rules fall out of that, and both took us real production mistakes to learn.

A quote is not a claim. A figure inside an approved customer quote rides that speaker's approval — it's their attributed observation, and it stays legal inside the quotation marks. Paraphrase it into house prose and it becomes your market claim, needing its own row and its own backing. We ruled this in production this summer, and it meant removing a customer's industry-general observation from three assets already in market. It was a customer's honest read of their industry. It was never our figure to assert.

Permission is read live, never cached. Whether a quote is approved for a given use is a question you answer at the moment of production, from the record itself — not from a note somebody wrote about the record last quarter. When a governing document and the source record disagree about what's approved, the record wins. We had a canon file carrying a stale restriction that graded client-approved material as unapproved for five days. The document was confidently wrong; the record wasn't.

Generic AI accelerates noise. AI grounded in on-record proof accelerates what's real.

How do you start?

You don't need a platform. You need the controls, in this order:

• Build the stats registry first. One row per number, one status, one usage rule. It takes an afternoon and it will surface at least one figure nobody can source. That figure is the point of the exercise.
• Audit your live outreach against it. Not your website — your sequences, your decks, your one-pagers. That's where drift compounds, because that's where numbers get retyped from memory.
• Put the claims where your AI can read them. Plain files, one place, loadable. Delete or redirect the copies.
• Add the review gate. A person decides before anything enters the canon, including changes your AI proposes.
• Give the ship-gate check to someone who didn't write the piece, starting at the headline and the meta description.

Run manually, this already beats what most teams have. What the manual version can't do is stay alive — interviews pile up unmined, consent answers go stale, and the registry you built in January quietly diverges from what's true in June.