Compliance throughput: the next martech bottleneck

Salesforce Agentforce can run a campaign end-to-end inside Marketing Cloud. True.

Adobe GenStudio signs every asset it originates with Content Credentials. True.

Canva, post-Ortto, covers design to activation without leaving the Canva suite. True.

On 2 August 2026, none of the three is enough.

Compliance throughput, not content throughput, is how campaigns ship in 2026. The valuable adjective on campaign production has moved from fast to fast, auditable, and portable across the vendors the buyer already owns. That is the argument. The rest of this piece explains why the axis swapped in Q1 2026, why no incumbent wins on the new axis by construction, what the metric means operationally, and what changes in the Deputy General Counsel's room and in the CMO's room between today and enforcement day.

Length note: this is a pillar, not a cluster. It reads as one long argument because the argument is one thing. If you are scoping a Q3 2026 vendor decision, the thirty minutes it takes to read it is less than the first question a procurement committee will spend relitigating the category later.

What compliance throughput actually means

Most of the vocabulary around AI-in-marketing in 2025 and early 2026 is elastic. Agentic, AI-native, next-generation, transform every deck leans on them, no buyer parses them. Compliance throughput is deliberately the opposite. One measurement, three dimensions.

Dimension one: cycle time through the governance layer. The elapsed-time distance between a campaign brief landing in intake and the campaign shipping through Salesforce Marketing Cloud, Adobe GenStudio, Canva, Figma, an ad console, or an external agency, with every disclosure applied and every approval signed. Enterprise benchmark across published 2026 research is roughly 105 days end-to-end; the legal-review slice is roughly eleven business days; the target we build toward with design-partner firms is under forty-eight hours on routine artefacts. The difference is not human speed, which is already faster than any review cycle can accept. It is the number of tool boundaries the artefact crosses and the amount of rework generated at each one.

Dimension two: audit assembly time. When an outside-counsel request or a regulator enquiry arrives, the elapsed-time distance between the first email and a cryptographically signed Evidence Pack containing every version, approver, disclosure, model invocation, and activation log for the campaign in question. Today, at a US mid-market financial-services firm with a Dublin subsidiary, that elapsed time is between eight and twenty hours per campaign; a four-person compliance-ops team runs it by hand across six systems. Target: under one minute, assembled from a single graph query. The Evidence Pack is not a feature; it is a first-class artefact with its own contract.

Dimension three: cross-vendor completeness. Expressed as a percentage, the share of artefact hops in a campaign pipeline where provenance is signed into an append-only ledger. Today at a buyer whose stack includes Canva, Figma, Workfront, an external agency's SharePoint, Marketing Cloud, and GenStudio, the honest number is well under fifty percent Adobe's Content Credentials sign Adobe-originated assets, Workfront signs approvals, nothing else signs anything, and the handoffs in between break. Cross-vendor completeness is the dimension the architectural argument in this piece lives on.

These three are the numbers that belong on a Monday-morning dashboard shared across the Deputy General Counsel, the Chief Marketing Officer, and the Marketing Operations Lead. Every other metric in this category campaigns per quarter, reach per dollar, time to review is a downstream function of them.

Why the axis swapped in Q1 2026

Categories do not swap because a vendor announces that they have. They swap because a set of preconditions that were missing in 2024 become true at the same time. Five triggers landed inside four quarters.

Multi-agent orchestration crossed the reliability threshold. CrewAI, AutoGen, Vellum, OpenAI's Agent Builder, Sitecore's parallel-and-sequenced execution model a generation of deterministic-enough orchestration primitives arrived between late 2024 and Q1 2026. In 2023 an artefact graph that ran policy, Judge-agent QA, and approval gates across a seven-tool pipeline was a research demo; in 2026 it is a two-quarter engineering build. This is the enablement underneath the assembly-line claim.

Model Context Protocol standardisation. MCP collapsed the per-platform integration slog that the "one brain, many channels" control plane needed to sit on top of. Slack, Microsoft Teams, WhatsApp, Telegram before MCP, adding each was a project. After MCP, the tool definitions are the same, the transports are the difference. This is the enablement underneath the ChatOps claim.

Regulatory deadline stacking. EU AI Act Article 50 enforceable 2 August 2026. India IT Rules SGI amendments effective 20 February 2026. New York A8887-B live with civil penalties today. Utah AIPA, Texas TRAIGA, Colorado AI Act layered underneath. The IAB January-2026 AI Transparency and Disclosure Framework published. WFA brand guidance in circulation. FINRA Rule 2210 and the SEC Marketing Rule applied to AI-generated advertising at the principal-review gate. This is not "AI might be regulated one day." This is a dated, enforceable stack with named civil penalties and a compliance-officer-mapping structure that attributes each violation to a named individual inside the regulated firm. Compliance professionals have been waiting for this environment for a decade. In Q1 2026 it arrived.

Provenance metadata infrastructure shipped. Adobe Content Credentials, the C2PA standard, the work IAB Tech Lab has done on AI-transparency metadata the provenance layer went from aspirational specification to interchange standard over the last eighteen months. Cross-vendor provenance became composable, not inventable. A cross-vendor artefact graph now ingests Content Credentials as first-class provenance nodes instead of having to invent its own credential format from scratch.

Content generation got commoditised. HubSpot's 2026 State of Marketing reports roughly eighty percent of marketers use AI for content and seventy-five percent for media planning; Salesforce's 2026 data has over eighty percent of CMOs admitting to running generic AI-generated campaigns. When every buyer has the content, content throughput stops being the attribute the buyer will pay a premium for. The premium moves upstream.

Pull any one trigger out and the thesis collapses. Without reliable orchestration, the assembly line is a demo. Without MCP, the control plane is a per-platform slog. Without regulatory enforcement, nobody pays a premium for compliance. Without provenance standards, cross-vendor trails are a marketing claim. Without content commoditisation, the constraint sits upstream of the axis we want to compete on. All five landed together between Q4 2025 and Q1 2026. That is the why-now argument.

Nobody said it out loud, because most incumbents cannot afford to.

The 2x2 and why the bottom-right is empty

Map the 2026 martech landscape on two axes. One is architectural: the platform is either ecosystem-locked (retention depends on the buyer staying inside the vendor's cloud) or stack-neutral (retention depends on the buyer keeping the chain-of-custody even when they leave). The other is metric: the platform optimises either content throughput (faster output inside a buyer's own ecosystem) or compliance throughput (audited output across every vendor the buyer owns). Four quadrants appear.

Top-left ecosystem-locked and content-first. Salesforce Agentforce, Adobe GenStudio, HubSpot Breeze. Best-in-class work on the content axis inside their own ecosystem. The buyer who is looking for faster AI copy or a better creative variant workflow inside the ecosystem is correctly served here. This quadrant produces the 2025–2026 "agentic marketing cloud" consensus, and the consensus is right about its own quadrant.

Top-right stack-neutral and content-first. CrewAI, AutoGen, Vellum as toolkits. Canva-plus-Ortto as a creative OS that spans design through activation for SMB and mid-market-unregulated buyers. Storyteq on the content supply chain. Strong on cross-vendor content assembly; silent on compliance throughput because their buyer is not a Deputy General Counsel carrying personal attribution. The quadrant is correct for its own buyer. It is not ours.

Bottom-left ecosystem-locked and compliance-first. Does not really exist, and the reason is structural. An ecosystem cloud can add compliance tooling at the edges; every one is doing that in 2026. What the buyer on the compliance axis actually needs is a cross-vendor audit that travels across the cloud boundary. Shipping that would force the ecosystem cloud to accept non-native assets as first-class provenance nodes, which unwinds the lock the cloud's margin model depends on. Incumbents will ship features in this direction; they will not ship the architecture. The gap is not a feature gap; it is a margin-model gap.

Bottom-right stack-neutral and compliance-first. Empty. This is where the Deputy General Counsel carrying personal attribution under the firm's compliance-officer mapping has been waiting for a vendor to arrive. This is where the carrier underwriting the cyber-and-privacy insurance rider needs a counterparty to exist. This is where the AmLaw advertising-law firm co-authoring the financial-services policy pack wants the engineering substrate to live. This is where Salesforce, Adobe, and Canva cannot be the answer by the same architectural argument that makes them the right answer in their own quadrant.

This is the category compliance throughput creates.

Priya on a Tuesday morning, in April

The category argument lives or dies on whether a specific buyer in a specific room believes it. The buyer who decides this category is a Deputy General Counsel. The canonical version, built from dozens of discovery conversations with Priya-shaped incumbents, goes by the name Priya Desai. She is a composite persona; the sentences she says are the sentences the actual incumbents have said, in close to the same language.

It is 7:15 on a Tuesday in April at a mid-market US wealth-management firm with a Dublin subsidiary. Priya opens her laptop at the kitchen table. Forty to sixty overnight marketing-review requests are in her Jira queue already, each breaching the Chief Marketing Officer's forty-eight-hour SLA, each arriving from a different tool: Marketing Cloud, Workfront, Figma, Canva, an external agency's SharePoint. Her four-person team will spend today doing the same five classes of rework they did yesterday missing disclaimers, un-substantiated performance claims, undisclosed AI-generated imagery, wrong-jurisdiction disclosures, stale hyperlinks on roughly sixty percent of the artefacts.

The Board Risk and Compliance Committee meets in three weeks; her agenda paper is due. EU AI Act Article 50 enforces on 2 August 2026, sixteen weeks from today. There is no cryptographic trail across the seven systems in her pipeline. There is no cross-vendor provenance on the Dublin-routed campaigns. There is no systematic detection on the synthetic-performer images that keep leaking through Canva-and-agency handoffs. There is no insurance that covers AI-disclosure misclassification. Under her firm's compliance-officer mapping, a missed disclosure is personally attributable to her, not to the firm.

She drinks her coffee standing up.

This is the buyer whose budget this category is for. She is not the CMO; she is not the CISO; she is not the Chief Compliance Officer overseeing the firm's entire AI footprint. She is the seat that sits in the marketing workflow with personal attribution for what ships. She is the seat that the incumbent agentic clouds do not design for, because their customer is her CMO.

The after-panel of this story is the product vision on a dated roadmap, not a shipped reference yet. That matters for honesty. Priya is the design-partner conversation this category needs to close. She is not yet a named paying customer at any vendor in this quadrant. The right way to describe her outcome is: "here is what a Priya-shaped Deputy General Counsel has described to us in discovery, and here is what the same Tuesday would look like in product vision, on a dated roadmap, with our design partner, with named milestones through Q3 2026." Anything more present-tense than that is marketing getting ahead of the truth.

What the metric means operationally, measured at the customer

Three numbers on the Monday-morning dashboard, emitted by the product, reported per tenant.

Marketing-review cycle, measured draft to activation on routine artefacts. Today the honest number at the buyer we described above is eleven business days; the design-partner pilot bar we build toward is under forty-eight hours. The mechanism is not a faster human reviewer; routine artefacts clear draft-time policy checks without touching a human reviewer at all. Only true-exception cases escalate. The review queue that reaches Priya's four-person team is the exception queue, not the full inbound. Numbers validate per contract; every outcome here is tagged as a target until a design-partner customer confirms it on their own campaign volume.

Evidence Pack assembly latency, measured first-request to signed artefact. Today, eight to twenty hours per campaign, assembled by hand from versions in Marketing Cloud, approvals in Workfront, source metadata in Canva and Figma, query snapshots in the data warehouse, activation logs in the ad console. Target: under one minute, P95, on campaigns up to five hundred artefact nodes. The mechanism is a deterministic composer reading from a hash-chained ledger and the campaign's frozen graph snapshot, with the output signed via an ECDSA P-384 key held in a dedicated AWS Key Management Service account. The numbers behind this are engineering, not aspiration; the question that remains open is regulator acceptance, which is the next section.

Cross-vendor completeness, measured as the share of artefact hops in a campaign pipeline that carry a signed provenance node. Today the honest number at a typical buyer is under fifty percent; four to six of the seven tools in the pipeline emit nothing that a downstream system could reliably verify. Target: one hundred percent of hops signed, with Adobe Content Credentials ingested as first-class C2PA provenance nodes and non-C2PA sources (Canva, Figma, external agencies, SharePoints) signed on intake with a content hash plus source identity plus author provenance. The number is a direct consequence of the architecture; the engineering is tractable.

These three numbers, measured weekly at the customer, compose into the dashboard the Chief Marketing Officer and the Deputy General Counsel watch together. The CMO reads cycle time as throughput. The Deputy General Counsel reads Evidence Pack latency as audit readiness. Both read cross-vendor completeness as the architectural precondition for Article 50 defensibility. One dashboard, three seats, one agreed definition of done.

Marcus's Board math

The axis-swap argument lives on Priya's desk. It is ratified on Marcus Chen's. Marcus is the Chief Marketing Officer, the economic buyer, the seat that signs the invoice.

Marcus is not a skeptic about governance. He is a skeptic about being sold a tool that will slow his team down for a compliance benefit he already believes he has. Three years of martech purchases have trained him to discount claims of "we enable compliance faster." The buying committee in his room includes a Chief Marketing Officer who cares about throughput, a Deputy General Counsel who cares about defensibility, a Marketing Operations Lead who cares about her team's week, a Chief Information Security Officer who cares about procurement gates, and a CFO who asks whether this line item cannibalises the outside-counsel retainer or adds to it.

The math Marcus carries into the Board's quarterly AI-governance conversation has three lines.

The first line is campaign volume. At the current cycle time of roughly eleven business days and roughly 50 major campaigns per year, a fifty-person marketing organisation runs approximately one campaign per person per year in compliance-reviewed output. If the cycle compresses to forty-eight hours on routine artefacts while holding compliance-pass rate constant, the same organisation ships roughly 150 major campaigns per year, on the same headcount, with a rework rate under ten percent rather than over sixty. The cost-per-campaign-shipped falls. The CMO does not need a compliance argument to approve that math; he needs the governance story that lets the Deputy General Counsel agree to the cycle-time number.

The second line is the AI story the CEO keeps asking about at Board meetings. In 2025 that question was answered with an inventory: "here are the AI tools we are using." In 2026 that answer is necessary but not sufficient. The Board expects the CMO to describe, in one sentence, the firm's governance posture across those tools. A governance dashboard the Deputy General Counsel already signed is the answer. A dashboard Marcus built without the Deputy GC is not the answer; a paragraph the Deputy GC wrote without a dashboard is not the answer. One artefact, one sign-off, both seats in the room.

The third line is the TCO comparison. The CFO's question is whether this line item cannibalises or adds to the firm's existing outside-counsel retainer. The honest answer is the former when the scope lands right. A mid-market US financial-services firm's advertising-law retainer runs in the range of four to nine hundred thousand dollars per year at a firm with a material Dublin or Frankfurt subsidiary. Most of that retainer is human re-assembly of audit trails after the fact, human interpretation of jurisdictional overlays, and human drafting of remediation. A cross-vendor artefact graph with a policy engine and an Evidence Pack displaces a substantial share of the assembly work; the interpretation and remediation work stays with outside counsel at a lower, higher-value share of the retainer. The TCO math is a substitution, not an addition and the CFO does not love software vendors, but he does love substitutions.

That is the math that clears Marcus's room. If any of the three lines is missing, the category argument is incomplete and the deal does not close.

The shared-responsibility wrap, and why restraint is the product

Compliance throughput would be a nicer CRM if it shipped only as software. The load-bearing commercial layer is the shared-responsibility clause plus the cyber-and-privacy insurance rider that underwrites it.

A shared-responsibility clause is a contractual term that says the vendor accepts first-loss on misclassified disclosure within covered policy packs, up to a scoped cap, for a specified category of disclosure event. A Chubb, AIG, or Beazley-class carrier underwrites the rider. The carrier wins access to a new actuarial dataset cryptographically-audited marketing-artefact provenance across a statistically-useful cross-section of mid-market regulated firms. The vendor wins pricing power, because the buyer's Chief Information Security Officer and the buyer's Deputy General Counsel and the buyer's CFO all treat a signed first-loss clause as qualitatively different from a software license. The buyer wins because, under her firm's compliance-officer mapping, a portion of her personal attribution has converted into a vendor-absorbed financial loss.

This is the single highest-leverage line item in the category's go-to-market. Every other claim in this piece supports it. The artefact graph makes the disclosure verifiable after the fact; the policy engine catches misclassification before it ships; the Judge agents stress the output against jurisdictional rules; the Evidence Pack hands the regulator the defensibility in seconds. Each of those capabilities is a precondition for a carrier to underwrite the rider. Without them, the insurance is uninsurable. With them, the category has a commercial wrap that no agentic cloud inside any ecosystem will match in 2026, because the actuarial surface runs across vendors the cloud does not control.

The corollary of the shared-responsibility wrap is that restraint is the product. A vendor that accepts first-loss on a disclosure it did not verify is not a vendor for long. "Autopilot" autonomous campaign execution without human-attributable approval is a marketing claim that commits the vendor to a risk model the carrier will not underwrite. Compliance throughput therefore ships with stage-gated approval as the default. Every policy-pack rule is versioned; every approval is human-attributable; every model invocation is logged. Autopilot is a roadmap milestone gated on three certifications (SOC 2 Type II, ISO 42001) and one signed insurance rider, not a headline in a product launch. The buyer whose RFP lists "fully autonomous marketing" as a 2026 requirement is not this category's buyer. The buyer scoping compliance throughput with a shared-responsibility contract and a cyber-and-privacy rider underneath it is.

Refusing autonomy in the marketing copy is the same discipline as publishing the Evidence Pack as an open specification rather than a proprietary format. The restraint is the trust surface.

What the open specification changes

The Evidence Pack format is published at evidencepack.org as an open JSON-LD schema, with a Python reference validator, and a conformance test suite. Five node types (Source, Transform, Approve, Activate, Evidence), four edge types (each carrying a cryptographic signature), one Merkle-root chain, and one machine-readable disclosure block. The spec is contributed to the IAB AI Transparency and Disclosure Working Group as a candidate addendum to the IAB January-2026 framework, and to the C2PA working groups as an extension surface for non-Adobe-originated assets.

Open specification is not philanthropy. It is the design decision that makes the category durable.

An Evidence Pack that only the originating platform can read is a retention hook, not evidence. The buyer has one system of record for the life of the contract and loses retrospective defensibility the day she leaves. She will not buy it, because her outside counsel will not accept it, because her Board Risk Committee will not accept that the firm has no exit plan, because her CISO will not accept the lock-in. A closed Evidence Pack format fails diligence at the first procurement gate.

An open spec inverts that. The format outlives the vendor. The regulator, the outside counsel, the cyber-insurer, and the successor system the buyer chooses to run in year seven all read the same file. The vendor earns authorship credit on the spec, maintainer status in the working group, and the gravitational pull that comes with being the seat where the spec is discussed. Standards belong to the category. Authority belongs to the author. That is the trade.

What we are not

Anti-positioning is focus written down. Here are the categories a compliance-throughput vendor is explicitly not in, in the buyer's own language.

We are not another agent product. We do not compete on agent count, agent sophistication, or agent-marketplace breadth. A buyer comparing us to NoimosAI or a CrewAI deployment is measuring the wrong thing. We are the governance substrate that the agents a buyer is already running write into.

We are not a content tool. We do not generate better copy, better images, or better video than Adobe, Canva, or a generative studio. We sign, govern, and export whatever a buyer already generates, upstream or downstream of us. A buyer whose primary purchase criterion is creative output velocity is not in this category's buyer set.

We are not a replacement for Salesforce Marketing Cloud or Adobe GenStudio. We sit on top of them. We export into them. We ingest from them. A buyer whose incumbent-vendor account team describes us as a migration project has described a product we do not sell.

We are not enterprise governance-risk-compliance software. OneTrust, Credo AI, and Holistic AI answer a Chief Compliance Officer's governance-inventory job across the firm's entire AI footprint. We answer a compliance-throughput job inside the marketing workflow. If the question is "what AI models are approved at our firm," that is their category. If it is "did this specific campaign ship clean across every vendor and is the audit regulator-addressable," that is ours. A buyer with an enterprise GRC RFP is solving a different problem.

We are not outside counsel. We do not opine on whether a specific campaign is legal in a specific jurisdiction. We produce the evidence the buyer's outside counsel, regulator, and Board need to make that judgement faster. Davis, Gilbert, and Reed Smith stay on retainer; we stop making them reassemble Evidence Packs by hand.

We are not autonomous. Stage-gated human approval is the default. Autopilot is a roadmap milestone gated on SOC 2 Type II, ISO 42001, and a signed insurance rider, not a marketing headline.

We are not an SMB tool. The policy-pack architecture, the audit trail, and the shared-responsibility contract are calibrated for regulated enterprises with a staffed compliance function. A buyer without a Deputy General Counsel or Chief Compliance Officer with personal attribution is not our buyer this year. Canva-plus-Ortto or HubSpot Breeze is a better fit.

We are not in the performance-marketing business. We do not forecast ROAS, CAC, or CLV as decision-grade numbers. Our simulation is a directional regulator-flag hotspot preview, not a media-mix model. A buyer looking for a performance-marketing decision engine should look elsewhere.

What this changes for early-2026 category thinking

Three consequences worth holding.

The incumbents' overshoot on content becomes strategically worthless. More features on the content axis do not move the 2026 regulated-enterprise buyer. The Chief Marketing Officer already has enough content. The Deputy General Counsel needs a signed cross-vendor chain of custody. Every feature an agentic cloud ships inside its ecosystem widens a gap the same cloud cannot close by construction.

The disruption shape is new-market, not low-end. A buyer moving onto this category is not substituting a cheaper Adobe. She is converting non-consumption. There is no existing tool the buyer is replacing because there is no existing tool that does cross-vendor governance end-to-end. The category is adding a seat to the stack, not taking one away. That is the Christensen-class new-market disruption signature: different buyer, different axis, different basis of competition.

The window is dated. 2 August 2026 is not a marketing frame. It is an enforcement date. Enterprises that finalise 2026 compliance-vendor selections before that date will not revisit those choices until 2027 renewal. The category is decided in the sixteen weeks between demo and contract for any firm scoping procurement now. The vendor with the shared-responsibility clause drafted and the AmLaw co-author on the policy pack and the carrier in underwriting review walks into the buyer's room warm; the vendor without walks in cold, regardless of product quality.

What is honest at T0

Everything above is an argument, not a track record. At the time of writing this pillar (April 2026), the firms living this problem are living it; the vendor writing this sentence is in design-partner conversations with them; the AmLaw-50 partner co-authoring the financial-services policy pack is in an engagement, not a signed client alert; the cyber-insurer underwriting the rider is in negotiation; SOC 2 Type I is in progress, Type II is on a dated roadmap; the Evidence Pack format v0.1 is published open-spec, not yet a ratified IAB standard; one US FS design partner is in pilot.

The honesty discipline is the register, not an asterisk. A category whose entire commercial promise is defensible under regulator scrutiny cannot begin by inflating its own status. The axis swap is the argument. The substrate is the work. The shared-responsibility clause is the paper. The Evidence Pack is the artefact. The dashboard is the math. The Deputy General Counsel is the seat. 2 August is the date.

Compliance throughput is the metric every other thing in this category is measured against. If you run a regulated-enterprise marketing team and the last three board meetings have carried some version of this conversation, the next step is specific, time-boxed, and measured in sixteen weeks, not quarters.

Further reading on our domain

• Cross-vendor provenance: the technical field guide for marketing assets why single-vendor provenance is structurally insufficient, where the chain breaks, and what the bridge looks like across Salesforce Marketing Cloud, Adobe GenStudio, Canva, Figma, Workfront, and external-agency pipelines.
• EU AI Act Article 50: the 16-week readiness runway for US firms with an EU subsidiary what Article 50 actually requires, where the typical financial-services pipeline breaks, what defensible looks like, and the four-milestone readiness plan.
• Evidence Pack open specification the JSON-LD format published for contribution to IAB Tech Lab and C2PA working groups; what goes in a signed Evidence Pack, what the reference validator does, how verification works independently of the originating vendor.
• Pricing enterprise SaaS, annual in advance, value-based against outside-counsel-retainer displacement; Foundation, Throughput, and Enterprise tiers; the three founding-customer ratchet slots.
• Book a 20-minute evaluation founder-led call with one of your own campaigns from the trailing 90 days as the demo input.