How can I enforce IT governance over marketing tool decisions without being seen as a blocker?

01Why does IT get seen as a blocker on marketing tools?

Marketing and IT work to different clocks. A campaign has a launch date that will not move, and a new AI tool can be trialled with a credit card in an afternoon. A security and procurement review built for core systems can take weeks. When the review is slower than the campaign, marketing either waits and resents it, or goes ahead without telling anyone, and IT only finds out when the invoice or the incident arrives.

Going around IT is now the normal pattern rather than the exception. In a 2023 prediction, Gartner said that by 2027, 75% of employees will acquire, modify or create technology outside IT’s visibility, up from 41% in 2022. Marketing is one of the heaviest buyers of software outside IT, and generative AI has made it easier still. A governance model that depends on every tool coming through the front door is already being bypassed, which is the main reason it gets labelled as a blocker.

02What should IT actually control in marketing technology?

IT does not need to control which tool marketing prefers. It needs to control the risks that land on the whole business when a tool goes wrong. That is a short list, and keeping it short is what makes it enforceable.

• Data: what customer or personal data the tool can access, where it is stored and who it is shared with
• Access: single sign-on, joiner and leaver controls, and who holds admin rights
• Integration: what the tool connects to, and with what permissions
• AI use: whether the vendor trains models on your content or data, and what the tool can generate and publish
• Contract: renewal terms, data deletion on exit, and who owns the content the tool creates

Everything else, from the interface to the feature set to which of two similar tools a team likes better, is marketing’s decision. Saying so out loud is one of the quickest ways to change how IT is seen, because it makes clear that the review is about risk rather than taste.

03How do I set up martech governance without slowing marketing down?

This method works without buying anything new. Budget two to four weeks for the first inventory and policy, then a few hours a month to run it.

1. Build an honest inventory. Pull every marketing tool from three sources: your single sign-on logs, finance and expense data (card payments to software vendors are the giveaway), and a short survey of marketing and agency leads. Expect to find more than you thought, and do not penalise anyone for what turns up, or the next inventory will be less honest.
2. Tier tools by risk, not by cost. A cheap tool with access to the customer database is high risk. An expensive one that only edits video locally is low risk. Three tiers are enough: low (no personal data, no integrations), medium (integrations or company content) and high (customer data, publishing rights or AI trained on your data).
3. Publish a fast lane. Low-risk tools that meet the non-negotiables are pre-approved, and marketing can buy them without asking. Set a public turnaround for the other tiers, for example five working days for medium and fifteen for high, and keep to it. A predictable answer matters more to marketing than a fast one.
4. Keep an approved catalogue. List the tools already cleared for each job, so a team that needs an AI image tool can pick one that has already passed review instead of starting a new one.
5. Set up a joint review group. Meet monthly with marketing operations, IT, security, legal and procurement. Decisions are made together, and marketing owns the business case while IT owns the risk assessment.
6. Write a one-page AI use policy. Cover what data can go into AI tools, which tools may generate content that gets published, how AI-generated content is labelled, and who signs off. One page gets read. Twenty pages do not.
7. Review usage before renewals. Each quarter, check which tools are used, which overlap and which are up for renewal. Retiring tools nobody uses is the part of governance marketing tends to welcome, because it frees budget.

Measure the time from request to decision and share it. If the number goes down while the inventory gets more complete, the model is working.

04How should IT handle AI tools in marketing?

AI tools change the risk in two ways that a standard software review does not catch. The first is data going in: prompts and uploads can include customer data, unreleased campaigns or licensed material, and some vendors use what is uploaded to improve their models. The second is content coming out: an AI tool can produce images, voices and copy that go straight into market, and the brand is responsible for them as if a person had made them.

The second risk now has regulation attached. Under the EU AI Act, realistic AI-generated or manipulated content shown to EU audiences needs to be labelled from August 2026, and other jurisdictions, including New York and California, have their own rules for AI in advertising. That means the governance question is not only whether a tool is safe to buy, but whether what it produces is handled correctly once it is live. For the detail, see do we actually have to label our AI-generated ads?

05The tool is not the risk. What it puts into market is.

Most martech governance concentrates all its effort at the point of purchase, and that is the wrong place to put most of it. An approved, fully reviewed tool can still publish an advert with a music track whose licence lapsed last month, a local edit that breaks brand rules, or an AI-generated image with no label in a market that requires one. None of those failures would have been caught by the software review, because none of them are about the software.

The more tools a marketing team uses, the more the risk moves from what is installed to what is published. That is good news for IT’s reputation. If the business can see and check everything that goes into market, IT can afford to say yes to tools much more quickly, because a bad output will be caught whichever tool made it. Gatekeeping every purchase is what makes IT a blocker. Governing the output is what lets it stop being one.

06When does manual martech governance stop working?

The method above holds up well for the tool layer. It starts to break down on the output layer when:

• Agencies, affiliates or markets create their own versions of creative outside your systems
• You run campaigns in more than a handful of markets, each with its own rules
• Music, talent or stock licences expire on different dates in different territories
• AI-generated content is going into market and needs labelling in some places but not others
• Nobody can say with confidence how many creatives are live right now

At that point the checking cannot be done by people with spreadsheets, however good the policy is.

07What to look for in a solution

For the tool layer, a SaaS management platform that reads single sign-on and finance data will keep the inventory current. For the output layer, these are the questions worth asking in a demo:

• Can it find creative wherever it runs, including versions made outside your own systems?
• Does it work across every tool marketing uses, or only content made in its own platform?
• Can it check live content against licences, brand rules and AI-labelling requirements by market?
• Does it connect to the systems you already have, or ask marketing to change how it works?
• What does it need access to, and is your content used to train its AI models?
• How long does deployment take, and does it involve a migration?

08How Medialake helps IT govern marketing output

Medialake governs the output layer. It connects to the DAMs, drives and channels a brand already uses and finds every creative that is actually running, including the local and agency versions that never pass through a central system. Each one is traced back to its master and checked around the clock against its music and talent licences, brand rules, claims and AI-labelling requirements, by territory and channel.

It is not a SaaS management or procurement tool, and it does not decide which software marketing can buy. It is also not a DAM, and it does not ask anyone to move files or change how they work. Because it watches what is published rather than what is installed, it works the same way whichever tools made the content, which is what lets IT approve tools faster without taking on more risk.

Scoping takes two to three days and deployment one to two weeks, with no migration. Medialake never trains AI on customer data. Details are on our security and responsible AI pages.

09Frequently asked questions

Who should own martech decisions, marketing or IT?

Both, for different parts of the decision. Marketing should own the business case and the choice between tools that meet the requirements. IT should own the risk assessment for data, access, integration and AI use. A joint review group with a published turnaround keeps either side from overruling the other.

How do I find marketing tools IT doesn’t know about?

Combine single sign-on logs, finance and expense data and a short survey of marketing and agency leads. Card payments to software vendors usually reveal most of it. Make the first inventory an amnesty, or teams will hide tools from the next one.

Should IT ban AI tools in marketing?

A ban rarely holds, because the tools are cheap and easy to reach outside company systems, so it tends to push use out of sight. A short list of approved AI tools, a one-page policy on what data can go in, and checks on what comes out give IT more control than a ban does.

Isn’t a security review on every tool enough?

No. A security review tells you a tool is safe to install. It does not tell you whether the content the tool produces is licensed, on brand or correctly labelled once it is in market, and that is where most of the cost of a marketing mistake now sits.

How fast should IT approve a marketing tool?

Low-risk tools should not need approval at all if they meet published requirements. For the rest, a public turnaround, such as five working days for medium risk and fifteen for high, matters more than raw speed, because marketing can plan around a predictable answer.

Does Medialake replace our SaaS management or procurement tools?

No. Those tools track which software is in use and what it costs. Medialake tracks the creative that marketing puts into market, whichever tool made it, and checks it against licences, brand rules and regulations. The two work side by side.

For more on why governance protects growth rather than slowing it, read governance isn’t red tape, it’s revenue insurance. To see everything your marketing has live right now, book a demo.

Last updated 11 November 2026