Risk-Calibrated Generative AI Governance for Responsible AI Adoption in U.S. Organizations: Evidence from Marketing and Corporate Disclosures

Abstract

Generative artificial intelligence (GenAI) is increasingly embedded in marketing content creation, personalization, customer communication, advertising, and multi-channel campaign execution. Although GenAI can improve speed and scalability, its use creates risks involving accuracy, privacy, intellectual property, bias, compliance, brand consistency, and consumer protection. This study develops and empirically examines a risk-calibrated governance framework for cross-functional marketing projects. The research combines an integrative review and thematic synthesis of relevant scholarly literature with an archival content analysis of official AI-governance disclosures from a purposive sample of large U.S. public companies across technology, finance, and consumer/media sectors. Six governance gates were coded as publicly disclosed or not observed: risk classification, input and data governance, output quality review, legal and ethical compliance, approval and human oversight, and post-deployment monitoring and escalation. The mean governance disclosure score was 5.27 out of 6. Legal and ethical compliance was universally disclosed within the sample, while data governance, risk classification, output quality review, and approval or human oversight were also widely observed. Post-deployment monitoring and escalation was the least consistently disclosed governance stage. Fisher's exact test showed that firms disclosing risk classification were more likely to disclose approval or human-oversight controls (odds ratio = 36.00, p = .038). The corresponding association between risk classification and post-deployment monitoring was positive but not statistically significant (odds ratio = 10.67, p = .117). Governance disclosure scores did not differ significantly across sectors (Kruskal-Wallis H = 0.067, p = .967). The findings support risk-calibrated pre-deployment oversight while highlighting comparatively less consistent public disclosure of lifecycle monitoring after deployment