Commercial AI systems can influence customer eligibility, pricing, segmentation, and communication at a scale that exceeds ordinary campaign governance. Boards should treat these systems as governed decision infrastructure, not merely marketing tools.

An independent audit begins with data provenance: what personal and behavioral data enters the model, under which lawful basis, and whether consent survives every transfer between CRM, CDP, analytics, and external model providers.

The control environment must then test model ownership, risk classification under the EU AI Act, explainability, human override, vendor assurances, output monitoring, and a practical kill switch. Governance is credible only when evidence can demonstrate that these controls operate continuously.