Governed creation just became a category with receipts. Stensul — the enterprise email and landing-page platform whose customer logos include BlackRock, Thomson Reuters, and Equifax — spent the summer productizing it: an MCP server that carries brand, legal, and accessibility rules into ChatGPT, Claude, Gemini, WRITER, and Microsoft 365 Copilot, plus Dynamic Content Assembly, a suite that turns AI-scale personalization into campaigns “cleared to go live.”
It’s the best creation-side compliance story in marketing technology. It’s also only half of the story — and the half Stensul doesn’t ship is the half regulators actually read.
The creation half is real, and it’s good
Credit where it’s due. Stensul’s Governed Creation™ Platform applies the same brand, legal, accessibility, and approval rules “to every marketer, every AI tool, and every AI agent” (their words), before anything reaches a customer. The homepage is blunt about who this is for: “Built for industries where getting content wrong is expensive.” The customer wall is a regulated-enterprise hall of fame — BlackRock, Thomson Reuters, Equifax, “financial institutions managing more than $25 trillion in assets,” and a BlackRock CEO quote praising “strong guardrails for brand and accessibility.”
The product work is real too. June 3: the Stensul MCP Server Early Access Program — “the governance layer is now callable by AI agents,” with a BYO LLM mode so regulated customers can route AI features through their own approved models “inside their existing compliance environment.” August 4: Dynamic Content Assembly — governed audience logic, segment-labeled proofs, with CEO Manlio Carrelli explaining the stakes: “At machine scale, one bad match between audience, content, and code can put the wrong message in front of an entire audience.” Their own line about late accessibility checks — “That’s not governance. That’s cleanup.” — is the right standard, and the creation side meets it.
Then the fine print, where the story turns: “Human review and approval remain in place before the work moves into production.”
Stensul’s own blog tells you why that isn’t enough
Here’s the part worth sitting with. Stensul’s own blog, July 1, on what the FTC, FDA, SEC, and EU AI Act are telling us about AI content in 2026:
“Regulators have stopped waiting for complaints. The FTC, FDA, SEC, and EU have each, in their own way, started building active surveillance infrastructure for AI-generated content. They’re scanning channels, running examinations, and writing technical standards. The penalty amounts were always there. The detection capability is new.”
The vendor selling governed creation is telling enterprises that regulators are scanning channels and running examinations — while its own governance gates stop at the send button. “Approved before production” is a moment. Surveillance reads what shipped: the campaign as it actually ran, the claims that actually reached customers, in the jurisdictions where they reached them. That surface is the operations record, and the creation model doesn’t touch it.
The coin: creation governance and operations governance
“Governance” in the creation category means something different from “governance” in the operations category — and conflating them is how regulated agencies end up with an approval trail and no compliance record.
- Creation governance (Stensul’s half): rules applied to a draft before it ships. Brand, legal, accessibility, approval paths. It produces an approval trail — who signed off on which version.
- Operations governance (the missing half): a record of what actually ran. Every change, attributed to the human, tool, or AI agent that made it, with before/after values, timestamps, jurisdiction, and budget — stored independently of the platform and exportable on demand.
Same word. Different answers to different questions. The approval trail answers “was this approved?” The operations record answers “what ran, who changed it, and can you prove it?” — and “approved” is not an answer to the second question. A campaign can be approved at launch and re-budgeted at 2 a.m. three months later. The moment of approval documents nothing about the months of operation that follow it.
The regulator layer already pointed here
The last three months of regulatory movement keep naming the operations side:
- FCA, Nikhil Rathi, June 24: “Accountability for regulated activities and outcomes must remain clear.” Outcomes — not drafts.
- FCA Handbook API, August 6: the entire rulebook is now machine-readable, and its FAQ carries the fine print: the API does not provide past versions of Handbook content. The regulator will not hand you history. Your own timestamped operations record is the only history that exists.
- IAB Tech Lab AAMP 2.3, July 30: “agentic autonomy that respects a hard approval boundary is a critical requirement for regulated advertisers.” Stensul implements that boundary at creation. On the operations side — budget deductions, campaign changes, creative swaps — the same boundary is required, and almost nobody ships it.
- SEC Regulation Crypto Assets (proposed August 18): the safe harbor turns on what an issuer “represented or promised” — and those representations live in the ads that shipped, not the drafts that were approved.
Approval is a moment. Compliance is a record.
The market check: 15 weeks, and the operations half is still empty
Fifteen consecutive weeks of monitoring the PPC landscape: zero full-stack finance PPC platforms. The horizontal PPC crowd doesn’t ship either half — Synter’s “audit trail on every write” is copy without compliance documentation; Windsor’s audit log is one changelog line; Supermetrics and Optmyzr write ads with no proof layer; TracerGram’s AI sales agent records nothing it says to broker and crypto leads. And the one company in the broader marketing stack that does ship real governance — Stensul — ships it on the creation side, for email and landing pages, and stops at production.
Even Stensul’s own MCP — real, documented in release notes, named on the homepage — has no canonical product page: /mcp returns 404, and its llms.txt page list doesn’t mention it. The governance layer exists; its documentation lives in blog posts. That’s the state of “compliance infrastructure” in the marketing stack today: a governed front door and an ungoverned back office.
What the operations half has to answer
When a regulator or a client asks about a campaign that ran, four questions decide whether your agency has an answer:
- What changed? Every edit to budget, bid, creative, targeting, or status — with before/after values, not just “campaign was updated.”
- Who changed it? Attributed to a named human, a tool, or an AI agent. “The AI did it” is not an actor; it’s a gap.
- When, and where? Timestamps plus jurisdiction tags — which market’s rules applied to which change.
- Can you export it? A record stored independently of the platform that made the changes, deliverable in about 90 seconds — not a week of screenshots.
That’s what Ott ships. Activity Logging timestamps and attributes every campaign change — human, tool, or AI agent — and stores it independently of Meta, exportable in about 90 seconds. Agency Hierarchy bounds responsibility per client, brand, and market with FCA/MiCA/ESMA/Alberta jurisdiction tags. Budget Ledger and approval gates put the hard approval boundary on the operations side: prepaid client balances, real-time deduction, overdraft alerts, compliance-triggered freezes. Telegram tracking covers the funnel where regulated leads actually convert.
Stensul governs the draft. Ott governs the run. That’s the coin — and for a finance agency, both sides are now part of the compliance answer.
The agency checklist
- Draft side: is creative creation governed? If you run email or landing pages at regulated-enterprise scale, governed creation is the right answer — approved components, brand rules, accessibility checks before anything ships.
- Run side: what records the months after approval? Who changed the campaign, when, in which jurisdiction — and can you export it in 90 seconds?
- The pairing: governed creation for the asset, governed operations for the account. One without the other leaves half the record missing.
The regulators stopped waiting for complaints. The detection capability is new — and it reads what shipped. Make sure your record covers the half that ships.