Trivago promised customers something simple: find the cheapest room, automatically, every time. In reality, the hotel comparison site's ranking algorithm weighted results toward whichever booking site paid the highest fee per click, instead of the lowest price. Higher-priced offers were displayed as the “Top Deal” in 66.8 per cent of listings. Nobody wrote misleading copy. The algorithm's design did that on its own. In 2022, the Australian Federal Court fined the German company $44.7 million for misleading Australian consumers.¹ While Trivago has no Australian ownership, the Australian Consumer Law reached it anyway, because the law follows the conduct, not the company's home address.
That's the shape of exposure organisations face today, and as an external-facing organism, marketing frequently meets it first, more often than any other function. Marketing doesn't own AI governance any more than one single function owns data privacy. Every function that touches an AI decision carries part of it. But marketing's role is larger than most leaders currently assume. A generative AI tool drafting a customer message. An automation deciding who receives which offer. An AI agent quoting a price or completing a booking with no human checking the result. Each is a marketing decision, made inside a marketing workflow, with marketing's name on the outcome.
So what do we mean by Governance? Here, we mean the decisions, checks, and lines of accountability that determine whether an AI system is used lawfully and in line with what a business has told its customers to expect. Not a rulebook signed off once, but a live question asked every time a new AI system touches a customer-facing decision.
This content series is anchored in Australian law as it applies today. Trivago wasn't found liable under some future AI-specific statute. It was found liable under the Australian Consumer Law that already existed in 2020, applied to a ranking algorithm the same way it would apply to a person making the same misleading claim.
On 20 July 2026, the federal government named “retail surveillance pricing” and “agentic commerce” among five AI consumer-safety priorities it intends to examine under the Australian Consumer Law.² While no bill has been drafted, nor a timeline given, the announcement confirms that the government is examining ground the Australian Consumer Law already covers — the same underlying provisions Trivago was found to have breached.
Section 18 covers misleading conduct broadly; Section 29 targets price specifically, with direct civil penalties³ — now up to the greater of $100 million, three times the benefit gained, or 30 per cent of turnover during the breach period, doubled this year.⁴ That last figure scales with revenue, not a fixed cap, so it hits a five-person agency the same way it hit Trivago.
If an agency, consultant, or vendor is running the AI tool on your behalf, the liability doesn't move with the work. The Australian Consumer Law places accountability with the business making the representation to the customer, not with whoever built or operated the system that produced it. An agency confidently saying “we've got the AI side handled” may be right about execution, but you have to check what compliance exposure travels with them. By default, it stays with you, making it worth a direct conversation with anyone running AI-driven work on your behalf.
Our legal mechanisms don't distinguish by business size. A director's duty of care applies whether there are five direct reports or five thousand. Strict-liability misleading conduct doesn't ask how big the marketing team is. What differs is how much protection a business has between making a mistake and facing its consequences.
Trivago had a legal team, a compliance function, and an appeal process, and was still held accountable for the error. A solo operator running an off-the-shelf AI booking tool has none of that standing between a mistake and the same underlying exposure. The mechanism is identical. The buffer isn't.
Your exposure already existed before you read this. What changes is that you can now see it.
Who decides how a tool gets used? Who owns what it produces? And who's accountable if it's wrong? What happens to customer data along the way, including client data handled on someone else's behalf? Who answers for it when the work is done by an agency rather than in-house? While they may seem like standard questions, what's new is how often marketing must now answer them, without anyone assigning that role formally.
This content series sits alongside, not in place of, board-level AI governance work many organisations already have underway. For example, the AICD publishes detailed director-level guidance this series doesn't duplicate.⁵ What follows here is the layer underneath such work, in the decisions marketing makes long before anything reaches a board agenda.
Next we'll address who (should) actually get to decide how an AI tool is used, and provide a practical decision-rights framework marketing functions of any size can apply directly.
Stephanie Silvester is the founder of The UnConsultants, The Agentic CMO Lab and Uncomplicated AI for Business. After 30 years leading marketing inside global organisations, she now works with leaders across every scale of business, from enterprise to owner-operated, on what it actually takes to use AI with discernment.