Marketing smarts don't go through IT censorship. It's not a tech show, it's a lack of governance.

01 Facts & context

What did Adobe's review data reveal?

2026-9-23, Adobe published a blog article for marketing policy makers, in which Pat Toothaker systematized the five issues most frequently raised by CIO in assessing marketing intelligence (Agentic AI). Quoting Adobe ' s 2026 AI Readiness Report, the article states that only 47 of every 100 proposed AI marketing schemes are able to pass IT and security reviews; When teams tried to embed these plans into existing systems and workflows, the figure fell further to 33. This means that more than two thirds of AI marketing programmes will be phased out midway from proposal to actual deployment.

The article also cites several other sets of data of concern: the IT leader of 94% states that the disorderly expansion of AI tools is already increasing complexity and risk, but only 12% businesses have centralized management tools; Only 5% business leaders allow intelligent bodies to be self-executed in high-risk decisions without manual clearance; Only 31% organizations have a performance measurement framework for intelligent AI. In addition, a recent survey showed that half of the organizations visited had experienced failures on the client side of the AI smart body following an internal evaluation.

The common direction of the data is that there is a significant gap between the enthusiasm of marketing teams for smart bodies and the vigilance of IT teams with regard to risks. Central to the article is the need for marketing personnel to understand the concerns of the CIO well in advance and to prepare the answers prior to the submission of the programme in order to increase the probability that smart body projects will be reviewed and eventually settled. Adobe also introduced its CX Enterprise Coworker product, stating that its design concept revolved around a networked fellow governed AI team, but that the product was not independently validated.

02 GSP analysis

A real bottleneck to intelligent body landing: risk management capacity rather than functional imagination

Most marketing teams focus on efficiency and scale: faster client response, larger individualized contact and fewer manual interventions. This starting point is not per se problematic, but it implicitly implies a premise — that enterprises already have the capacity to run these smart bodies safely, controlled and retrospectively. Adobe's data show that this premise is not established in most organizations, and the CIO is the role that must be confirmed whether the premise is satisfied.

From an operational point of view, there is a fundamental difference between intelligence and traditional marketing automation tools. Traditional tools implement predefined rules and clear risk boundaries; The intelligent body, in turn, is capable of autonomous judgement, call data and trigger action during its operation, with a much greater space for behaviour than a rule engine. CIO's caution is not conservative, but rather a reasonable response to this proliferation of non-linear risks — a false content recommendation may affect exposure only once, but a wrong intelligence action may touch hundreds of thousands of users and cause brand damage in a matter of minutes.

Thus, the core strategic choice faced by the marketing team in advancing the intelligent body is not “whether or not to use”, but “what governance structure to carry”. This option determines whether the project can be reviewed, scaled up and fast-tracked in the event of problems. The acquisition of the smart body as a function and its building as a set of capabilities that need to be embedded in the governance framework will lead to completely different landing routes and outcomes.

03 GSP analysis

Data opacity is the first valve to realize smart body values.

The first question of the CIO in Adobe's article refers directly to the data base: what kind of data does intelligence rely on to train or run? Will the enterprise ' s own data be used to train the bottom model without consent? Can intelligent individuals identify and implement the established access controls, approval processes and restrictions of the enterprise? The common focus of these three issues is on data transparency and control.

In terms of value creation mechanisms, the quality of the output of the smart body depends directly on the quality and compliance of the input data. If a smart body is connected to an uncleaned customer record, an unlicensed library of materials of unknown copyright status or a lack of background label behavioural data, its output is not only unreliable, but may also expose the enterprise to compliance risks. CIO ' s focus on data sources is essentially an assessment of whether this smart body can become an auditable business asset rather than an unexplained black box.

As a hypothetical example, the marketing team of a retail enterprise wants to deploy smart bodies to automatically generate personalized recommended mail. If the smart body uses enterprise-owned purchasing history and browsing behavioral data, which have been graded by classification and with clear access rights, the focus of the CIO review will shift to whether the logic of intelligence reasoning can be traced retroactively. However, the review would be directly hampered at the level of data sovereignty if the smart body relied on the generic language of the supplier plus the customer data uploaded by the enterprise and the training agreement did not explicitly prohibit suppliers from using enterprise data for model improvement. This difference determines the very difference in the fate of the two options in the same enterprise.

04 GSP analysis

Observability and human synergy: trust building in smart body operations

The second question of the CIO focuses on visibility and control: can you see how intelligence produces an output rather than just the output itself? Can a person intervene before a smart person takes high-risk action? If there is a problem, can the entire interactive link be rebuilt to understand the cause of the failure? The essence of these three issues is to require the observability and interventionability of smart body systems.

The greater the autonomy of the smart body, the higher the commercial value of observability. Observability is not just a technical indicator; it has a direct impact on the risk tolerance of enterprises and the speed of decision-making. It is only when the marketing team knows that every step of its reasoning can be traced, that every high-risk operation has a manual approval node, and that every anomaly can be located at a specific point, that the team dares to hand over more important tasks to the intelligent person and that it can assume brand responsibility in front of the client. In this sense, observability is not a shackle that limits the ability of the intelligent body, but rather a basis for trust that releases its ability.

The Adobe article refers to the fact that only 5% business leaders allow intelligent bodies to remain uncensored in high-risk decision-making, which in turn means that enterprises still need manual involvement at key nodes in 95%. In designing intelligent body workflows, marketing teams should proactively distinguish between low-risk, fully automatic, manual identification and dual approval. Such a hierarchical authorization mechanism was designed well in advance, rather than waiting for the CIO to think, which would significantly shorten the review cycle. Example of the assumption: A marketing team in financial services can set standard FAQ responses as fully automated when designing a smart body to process customer complaints, send responses involving cost adjustments or contractual terms after manual approval, and set responses to regulatory sensitive topics as a second judicial review. This hierarchy preserves both the efficiency of the intelligent body and the compliance threshold.

05 GSP analysis

System compatibility determines whether an intelligent body is embedded in muscle or increases fat.

The third issue of the CIO is about architecture: whether the intelligent body is integrated into existing technology stores and workflows, or is it becoming another island that needs to be managed separately? According to a data source cited by Adobe, the IT leaders of 94% believe that the disorderly expansion of AI is increasing complexity and risk, while only enterprises of 12% have established centralized management. This means that the vast majority of enterprises are building up AI tools passively, rather than integrating capacities in an orderly manner.

From an organizational efficiency perspective, every new smart body tool that can be introduced without re-establishing the existing system of competencies, datasets as conduits and workflow engines would create a new wiring burden. This burden extends beyond IT costs to the learning costs of marketing teams and friction costs of cross-system collaboration. When a smart body requires a marketing agent to manually export data, configure the rules at another interface and return to the original system to verify the results, its efficiency has been exhausted by process friction.

In assessing smart body programmes, marketing teams can use two operational criteria to predetermine compatibility: first, whether the smart body can operate directly in existing marketing platforms and workflows and reduce rather than increase inter-system switching; Secondly, whether existing rules of competence and governance strategies are automatically in effect when the intelligent person is on mission or whether a separate set of parallel rules is required. If both answers are positive, the CIO ' s resistance to censorship will be significantly reduced, as the intelligent body is positioned as a capability extension for the existing system rather than a new management object. Example of the hypothesis: The marketing team of a B2B enterprise uses the existing CRM competency system to bind the client data access to the smart body, which automatically inherits the data visibility level of each salesman, thus neither requiring a new permission system nor avoiding the risk of data being over-exceeded.

06 GSP analysis

Value measurement and brand security: two questions that must be answered before an intelligent body can be scaled

The fourth and fifth questions of the CIO in Adobe's article point to effectiveness measurement and brand security, respectively. With regard to data, only the organization of 31% has established a measurement framework for the smart body AI, and most teams can only see such indicators as the number of login and daily usage and cannot link intelligent body behaviour to conversion rates, activity effects or operational efficiency. In the area of brand security, half of the organizations interviewed had experienced problems with their clients after an internal assessment of the smart body.

The common denominator between these two issues is that they are both issues of delayed exposure. In the early days of the intelligence community, teams are often immersed in the efficiency gains brought about by automation, making it difficult to detect the absence of measurement frameworks and the accumulation of brand risks. By the time the problem emerges, the workflow has been built around the intelligent body and the cost of repair is much higher than the cost of prevention. CIO pursued these two issues during the review phase, in effect requiring marketing teams to demonstrate a perception of long-term operational responsibility rather than a mere interest in short-term functional demonstration.

Computing power: The marketing team can be prepared in two directions: in terms of value measurement, the vendor is required to provide a reporting capability at the workflow level that can link the actions of the smart body to specific business outcomes, while demonstrating the consumption and operating costs of the workflow, thereby calculating the return on inputs to the output per unit; On brand security, vendors were required to provide test evidence on which groups and scenes were covered by the test, which deviations had been identified, which amendments had been made prior to being online, and whether there was a manual feedback loop to continuously monitor output quality after being online. Programmes that can provide clear answers to these questions can significantly increase the pass rate before the CIO.

07 Suggested actions

The marketing team's five self-checking steps before submitting the smart body program.

On the basis of the above analysis, the marketing team could complete five internal checks before formally communicating with the CIO. The first step is data traceability: contact the candidate supplier and request written information on the training data sources of the smart body, whether copyrights or authorizations exist, whether business data will be used for modelling training, and whether the smart body will recognize and enforce the access control rules that the enterprise has in place. If the supplier is unable to provide a clear answer, it should be classified as a high-risk option.

The second step is the design of control points: it is clear in the workflow of the intelligent body which elements are self-executing, which are subject to manual approval and which are subject to multiple scrutiny. Each high-risk operation is provided with a clear time frame for clearance and approval, ensuring that someone can intervene before a smart body is executed. At the same time, it was confirmed whether the system supported complete retrospectiveization of individual interactions rather than merely providing summary reports.

The third step is compatibility verification: to work with the IT team to confirm whether the smart body can operate in existing marketing platforms, whether the existing rights system is automatically applicable to all operations of the smart body, and whether additional integrated layers or access mapping are required. If compatibility certification is not successful, the integration issue should be resolved before the procurement is advanced, avoiding on-line and forced back to work.

Computing power: The fourth step is the establishment of a measurement framework: indicators of success are defined before the intelligent body is online, including operational outcome indicators (e.g. conversion rates, customer response time, efficiency of activities) and operational cost indicators (e.g., consumption of communications power, manual review of working hours). Vendors are required to provide workflow level reporting interfaces so that the indicators can be tracked on an ongoing basis.

The fifth step is the brand security plan: suppliers are required to provide evidence of deviation tests and safety tests in front of the line, specifying the scope of the tests and the problems identified, as well as corrective measures. At the same time, mechanisms are in place to monitor output quality on-line, including manual spot-checking frequency, automatic warning rules for unusual output and emergency offline procedures. Each step should identify specific roles: data traceability is led by the marketing operator, control point design is jointly confirmed by marketing and IT, compatibility validation is the responsibility of the IT architecture team, measurement frameworks are developed by the marketing analysis team and brand security is reviewed by the brand management team.

08 Suggested actions

Substitution of a one-time, large-scale deployment landing route by phased experiments

The landing rhythm of the intelligent body is itself a key decision variable. A one-time, large-scale deployment would maximize risk and value and make it difficult to locate root causes when problems arise. A more robust path would be to divide deployment into three phases, each with clear validation targets and exit criteria. The first phase selects low-risk, high-frequency and manageable scenarios, such as automatic responses to internal drafts or low-priority client consultations. The central objective of this phase is not to validate what intelligent body can do, but to verify whether the governance mechanism is effective: compliance with data access, accuracy of succession, smooth manual intervention and traceability of output.

The second phase extends to medium-risk scenarios, such as individualized mail referral or campaign audience screening. Emphasis should be placed on validating the sensitivity of the value measurement framework: whether smart body actions can be linked to specific conversion data or efficiency indicators and whether cost accounting is accurate to the workflow level. If the measurement framework is not well developed in the first phase, the second phase will not be able to judge which work streams are worth expanding and which should be adjusted or discontinued. Each phase should have a clear observation cycle and assessment nodes, usually recommended for not less than four weeks, in order to collect sufficient operational data to make informed judgements.

The third phase is a high-risk, client-oriented scenario, such as real-time personalization pricing, automated customer retention or cross-channel marketing. This stage was reached on the assumption that the governance mechanisms and measurement frameworks of the first two phases were validated and that the brand security tests covered a sufficient number of people and scenes. The decision to move forward at each stage should be taken jointly by the marketing director and the IT manager, rather than unilaterally by the marketing team. If, at any stage, governance gaps are found to be unrepairable within a reasonable period of time, the expansion should be suspended and returned to the previous phase of re-testing, rather than moving forward with known risks.

09 Suggested actions

Applicable conditions and adjustment judgement: what circumstances should be suspended or diverted

The above-mentioned framework is not applicable in all cases. If the marketing data base of an enterprise is itself weak, such as the fragmentation of client data across multiple interconnected systems and the lack of uniform data dictionaries and rights management, the smart body project should be put on hold and priority given to data governance. The deployment of intelligent bodies in situations where the data base is weak will only accelerate the dissemination of erroneous data and magnify rather than solve existing problems. Similarly, if an enterprise ' s IT team does not have sufficient energy to participate in the evaluation and deployment of smart body projects, it is not recommended to move quickly, as the governance of the smart body requires continuous IT input, and not one-time approval is granted once and for all.

During the push, there are several clear signals that should be redirected or suspended. First, if, during the pilot phase, the output quality of the smart body was found to be unstable and the supplier was unable to explain the cause or provide an effective improvement programme, consideration should be given to replacing the programme rather than continuing the input. Second, if the value measurement framework is still not able to establish a reliable link between smart body action and business results after a quarter of its operation, it suggests that the scenario may not be suitable for smart body resolution, a return to traditional automation or manual processes should be considered. Third, if brand security controls find that the deviation rate from the output of the smart body is consistently above the acceptable threshold and manual clearance is not able to control the risk without significantly reducing efficiency, client-oriented smart body workflows should be suspended and recalibrated back to the internal testing environment.

Finally, it is important to emphasize that the ability of intelligent bodies to govern is not static. As models are updated, business landscapes are expanded and regulatory environments change, enterprises need to periodically reassess the scope of smart body data access, approval node settings and measurement of the effectiveness of indicators. It is recommended that a quarterly governance review be undertaken with the participation of the marketing, IT and legal parties to determine whether existing controls are still adequate and to adjust the scope of intellectual autonomy in the light of the review. This mechanism of continuous governance is more able to determine the long-term value of smarts in marketing than any one-time technical programme.