NAI issues 'dos and don'ts' guidance for AI, agentic workflows in adtech

The advertising technology industry has long been at the forefront of this technological advancement through utilizing machine learning and predicative workflows. Integrating AI to improve the ecosystem is just the latest example, particularly with streamlined and enhanced personalization experiences.

However, the rapid advancement of AI's capabilities are posing new challenges for digital advertisers. The Network Advertising Initiative recently published voluntary guidelines to address members' governance questions as they seek to utilize AI and agentic workflows.

The guidance lists each item's dos and don'ts for NAI members, which include creating an inventory and enabling of AI use cases, testing and monitoring of AI systems, AI use disclosures, and understanding permissions and constraints applied to AI systems.

"One immediate issue members and the industry at large are facing right now is definitional," NAI Vice President and General Counsel Tony Ficarrotta said in an interview with the IAPP. "What processes and technologies are 'AI' or 'agentic' in a way that raises novel privacy and data governance issues? That scoping question is more important than you might think because it helps the teams tasked with overseeing ads privacy and compliance focus their attention on systems where net-new risks may arise."

The main goal is to "promote the responsible use of agentic and AI systems by focusing attention on novel or potentially more-severe risks" for NAI members, according to Ficarrotta. He indicated he is encouraging members to seek out ways to proactively follow the guidance in the absence of mandatory standards or clear regulation.

"(We're) not trying to throw up roadblocks for every innovative use of AI in advertising, so the more a system can act, and the more it can change a privacy or legal outcome before a person reviews the specific action, the more carefully these recommendations should be considered," he said. "If you wait for the standards to settle completely, you risk delaying sufficient attention to controls. We expect technical standards and privacy and data governance guidance to change as this ecosystem evolves."

To help member organizations solve issues around definitions, the new NAI guidance contains a checklist for members to evaluate where they may experience headaches with certain aspects of AI and agentic integration. Each item on the checklist corresponds with one of the nine dos and don'ts featured in the guidance. 

"A company can run a workflow against the checklist question quickly, and wherever the answer isn't a clean 'yes,' that is an indication to go and read the corresponding question," Ficarrotta said. "Similarly, if you have gone through a more technical or abstract risk assessment for an AI use case, it can also be helpful to see if you can answer more common-sense checklist questions about what you've accomplished at the end of that process. If you still can't answer 'yes' that's a good reason to refer to a section of our guidance more closely."

Motivations

Connectivity between AI and advertising comes due in large part to the industry's inherent technology-intensive nature. Ficarrotta characterized the adtech industry, especially NAI members, among "the earliest and most sophisticated adopters" of AI, deploying machine learning, optimization and predictive modeling technologies for more than a decade.

"Generative tools can take broad, unstructured instructions and build audiences nobody specified the members of in advance," he said. "Agentic workflows are being designed to access data, bid on inventory, and execute ad transactions across intermediaries even when no person is expected to review each specific action."

The guidance was developed following a consultation with the NAI's Legal and Regulatory Working Group. A survey of participating members discerned where AI guidance would help for novel use cases. 

"We also consulted with some outside stakeholders to get a broader perspective," Ficarrotta said. "Guidance that comes from 'on high' without practitioner input and insights is less likely to be practical or address real issues companies are facing."

Participants reported issues related to disclosures, segment review and contracting in the broader context of AI and agentic workflows were of particular interest for seeking further guidance. 

"Privacy, data governance, and AI professionals need a well-defined scope to work with," Ficarrotta said. "You need to define 'personal data' meaningfully for a privacy pro to do their job, and the same is true for AI. 'AI' is not one undifferentiated thing, and undefined or poorly defined uses of the term in diligence, in contracts, and increasingly, in policy conversations is counterproductive."