Table of contents
Quick answer: Scope an AI marketing advisory engagement around two or three real workflows, a data and consent review, and a measurement baseline. Buy named blockers with owners and dates, not a maturity score or a tool shortlist.
Last verified: 2026-09-12
Start from workflows, not from the technology
Every useful AI readiness assessment starts with the same unglamorous question: which repeated marketing tasks happen often enough, and identically enough, that a machine doing a first draft would save real hours? Brief writing, ad variant production, review triage, data cleanup and reporting summaries usually qualify. Strategy, pricing and client judgement do not.
That framing keeps the engagement out of the trend cycle. Generative AI is strongest where a competent draft plus human editing beats a slow blank page, and weakest where the cost of a plausible-sounding error is high. Scope the first, exclude the second in writing.
Put data, consent and measurement before tooling
An AI marketing consultant who proposes tooling before looking at your data has skipped the part that determines whether anything works. The scope should require an inventory of where customer data lives, who administers each system, and what your consent language actually permits — feeding personal data into a third-party model is a processing decision with obligations under regimes such as GDPR.
Measurement comes next, because an AI change you cannot measure is an opinion. If conversions are miscounted or events are missing, fix that first: event configuration and platform attribution windows decide whether a pilot can be judged at all. That work belongs to conversion tracking and analytics, and it is a legitimate first phase of an AI engagement.
Write the risk rules into the statement of work
A scope should name what may never be pasted into a public model, who reviews machine-generated output before publication, and how AI involvement is disclosed where that matters. The NIST AI Risk Management Framework is a reasonable spine for this: govern, map, measure, manage — applied to marketing rather than to a data science lab.
Regulated or high-claim categories need an extra line. Where the EU AI Act or sector advertising rules apply, the engagement should state which uses are out of scope entirely rather than leaving it to a junior with a prompt. Standard statement of work discipline covers the rest: deliverables, dates, acceptance criteria, and who owns the output.
| Scope element | What to require | Failure signal |
|---|---|---|
| Workflow list | Two or three tasks, ranked by hours and volume | A department-wide transformation narrative |
| Data review | Systems, owners, consent basis, what may leave the building | Tooling chosen before anyone read the privacy policy |
| Baseline | Current cost or hours per task, captured before changes | Pilot starts with no before number |
| Review gate | Named human editor and acceptance criteria per asset | Output publishes automatically at volume |
| Risk rules | Prohibited inputs, disclosure, excluded use cases | Nothing written down; policy is folklore |
| Handover | Documented process and a trained internal owner | The consultant is the only operator |
Price and phase it so you can stop
Phase one is assessment and baseline, measured in weeks. Phase two is one or two pilots against that baseline with a stated success threshold. Phase three, only if the pilots hold, is marketing automation rollout with documentation and training. Every phase ends with a decision point where stopping is a legitimate outcome.
Third-party advisory rates for this kind of work span a wide band — roughly low four figures for a short assessment to mid five figures for a multi-month build, depending on market and scope — so compare like for like on deliverables rather than on day rate. We quote after scoping; ask any vendor for their baseline method before their price.
What goes wrong
The failure mode: the engagement buys volume. Content output triples, nobody reviews it, and six months later the site is full of thin pages that Google's own guidance on helpful, people-first content already told you would not rank. The scope prevents this with one clause: a named editor and a quality gate per published asset.
Second failure mode: no baseline. Without a before number, the pilot cannot be judged and the decision defaults to whoever is most enthusiastic. Capture hours, cost per asset, or cost per qualified lead before anything changes.
Third: the consultant becomes the process. If the engagement ends and nobody internal can run the workflow, you bought a dependency. Require documentation and a trained owner as an acceptance criterion, not a nice-to-have. Method notes live in the help library; delivery sits under growth marketing.
Frequently Asked Questions
How long should an AI readiness assessment take?
Two to four weeks for a mid-sized marketing team. Longer usually means the assessment has expanded into a strategy project without saying so.
Do we need new tools to start?
Usually not. Most first wins come from applying existing tooling to a defined workflow with a review step; buying software before the use case is the most common waste.
What should never go into a public model?
Personal customer data, unreleased commercial terms and anything covered by a confidentiality obligation, unless a reviewed data-processing agreement covers it.
Who should own AI marketing internally?
One named marketing owner with authority over the review gate, supported by whoever administers the data systems. Splitting it between IT and marketing stalls both.
Sources: NIST AI RMF; European Commission, AI Act framework; GDPR; GA4 events, Google Ads conversion windows, Google helpful content guidance; Generative AI, Marketing automation, Statement of work (Wikipedia). Verified 2026-09-12.
