Every brand I've ever helped govern eventually runs into the same uncomfortable question: whose fault is it when the mistake didn't happen inside your own walls? I don't think most founders have a good answer ready, because most governance thinking, including plenty of my own early frameworks, quietly assumes the brand and the organization producing its content are the same entity. They increasingly aren't, and the gap between them is where some of the ugliest drift I've studied actually lives.
One vendor, dozens of brands, one governance gap
In November 2023, Futurism reported that Sports Illustrated had published product reviews under fabricated author names — "Drew Ortiz," "Sora Tanaka" — complete with AI-generated headshots lifted from a stock-image marketplace. Sports Illustrated's publisher, the Arena Group, was quick to point to the source: the articles were licensed content from a third-party company called AdVon Commerce, which supplied product-review content to a long list of publishers. AdVon initially denied using AI in its editorial process at all, insisting its writers followed a policy involving counter-AI software on every piece. That denial didn't hold. Within days, further reporting turned up an internal AdVon training video showing an AI system being used to generate exactly the kind of content that had shown up under fabricated bylines at Sports Illustrated — and, as follow-up investigations later found, at a much wider set of outlets, including USA Today and several regional newspapers, that had all been running AdVon-supplied content without necessarily knowing its actual production process.
Sit with that shape for a second, because it's not the same shape as the other vendor failures I've written about. Chevrolet's chatbot problem was one dealership, one vendor, one bad afternoon. This was one vendor's undisclosed AI practice quietly running underneath the editorial identity of several separate, unrelated publishers at once, each of whom presumably believed they were licensing conventionally reported, human-written content. The governance gap wasn't duplicated across those publishers by coincidence. It was the same gap, worn by a single vendor, multiplied across every brand that vendor happened to serve.
Why "we didn't write it" was never going to be a defense
I want to be precise about why this matters more than a simple "vet your vendors" platitude. Sports Illustrated's readers didn't experience AdVon. They experienced Sports Illustrated — seventy years of editorial trust, attached to a byline that turned out not to exist. The brand a customer encounters is whatever touchpoint reaches them, regardless of which entity technically produced it, and regardless of how many licensing agreements sit between the brand's name and the actual keyboard, human or otherwise, that generated the words. "We didn't write it ourselves" describes an org chart. It says nothing about what the reader actually experienced, and it is not, and was never going to be, a defense that restores trust once the gap is public.
This is the exact structural point I keep returning to across every version of this story: governance that stops at your own headcount isn't governance of your brand. It's governance of the part of your brand you happen to have kept in-house, which for a growing number of businesses is a shrinking fraction of the actual content reaching customers.
The audit most businesses have never actually run
Here's the uncomfortable exercise I'd ask any founder reading this to try, honestly, before assuming this doesn't apply to them: list every vendor, agency, freelancer platform, or outsourced content provider currently producing anything that reaches your customers under your brand's name, and for each one, ask whether you actually know how that content gets made. Not whether they told you it's "high quality" or "carefully reviewed." Whether you know, concretely, what tools are involved, what the review process actually looks like, and whether you have any contractual right to check. Most businesses I talk to can answer this for their in-house team in detail and go noticeably vague the moment the question turns to a vendor, precisely because the assumption — reasonable-sounding, rarely tested — has always been that a paid professional relationship implies a governed one.
AdVon's own publicly stated policy claimed exactly this kind of assurance: writers, editors, and researchers curating content, with counter-AI software running on everything. That claim was false in practice, and the publishers relying on it had, as far as the public record shows, no real mechanism for verifying it themselves before the fact — only the ability to end the relationship after a journalist had already done the verification for them, in public, at maximum reputational cost.
What actually closes this gap, contractually and operationally
The fix here isn't exotic, and it doesn't require rebuilding your vendor relationships from scratch. It requires three specific things most content or agency contracts currently lack. A written disclosure requirement: any vendor producing customer-facing content on your behalf discloses, specifically, what tools and what human review process are involved, not as a one-time sales pitch but as a standing, updateable commitment. A right-to-audit clause: the contractual ability to actually sample and review vendor-produced content against your own stated standards, on a schedule, not only after a public problem forces the issue. And a kill-switch understanding, agreed in advance rather than negotiated in a crisis: a clear, pre-defined process for pausing a vendor relationship the moment a sample review turns up something that doesn't match what was disclosed, rather than discovering only in the moment of crisis that nobody had actually planned for this.
None of this is expensive to build. It's the same Intelligent Human Oversight pillar from my own BIG Framework, just extended past the edge of your own payroll, which is precisely where most versions of that framework quietly stop without anyone noticing the boundary was ever drawn there in the first place.
Why "vet your vendors once" isn't the same as governing them
I want to push back gently on a version of this advice that sounds right but isn't sufficient: doing due diligence before signing a vendor contract. That's necessary, and most businesses at least attempt it — a reference check, a portfolio review, a conversation about process. What almost nobody does is repeat any version of that check after the contract is signed, on an ongoing basis, even though a vendor's actual practices can drift just as easily as a brand's own output can, and usually for the same underlying reason: production pressure quietly outrunning whatever review process existed at the start of the relationship. AdVon's stated policy of human writers and counter-AI software may well have been accurate when a given publisher first signed on. Whether it stayed accurate is precisely the question nobody with a contract in hand was positioned to answer, because nobody had built in a mechanism to keep asking it.
What a slightly braver contract conversation looks like
I recognize this is an uncomfortable conversation to have with a vendor you already trust, and I don't want to pretend otherwise. Asking a long-standing content partner for ongoing disclosure and audit rights can feel like an accusation, especially if the relationship has been perfectly fine so far. But the honest reframe is that this isn't a statement about their integrity — it's a statement about your own responsibility for what reaches your customers under your name, one that exists regardless of how trustworthy any individual vendor happens to be this year. The businesses that will handle this well over the next few years won't be the ones who found unusually trustworthy vendors. They'll be the ones who built the habit of checking regardless, the same way a careful landlord still inspects a rental property they've leased to the same reliable tenant for a decade.
The part that should actually worry a growing business more than a chatbot going viral
I think this deserves more attention than it currently gets, specifically because it scales in a direction most founders aren't watching. A single ungoverned in-house AI tool is a contained problem, bounded by the size of your own team. A single ungoverned vendor is a problem shaped like their entire client roster, which for a large enough outsourced content or marketing provider can mean dozens of separate brands inheriting the exact same undisclosed risk simultaneously, each one discovering it independently, each one assuming, until proven otherwise, that they were the only one affected.
If you outsource any meaningful share of what reaches your customers, the question worth sitting with isn't whether your vendor is trustworthy in the abstract. It's whether you'd actually know if they weren't, before the internet finds out for both of you at once.
If you're not sure what's actually happening inside a vendor relationship that touches your customers, that's worth checking before it becomes someone else's discovery to make. Get Your Free Brand Audit →
References
Harrison Dupre, M. (2023, November 27). Sports Illustrated published articles by fake, AI-generated writers. Futurism.
Harrison Dupre, M. (2023, November 28). Sports Illustrated's AI-generated content excuse doesn't hold up. Futurism.
NPR. (2023, December). AI-written content and the AdVon investigation [Radio broadcast transcript]. All Things Considered.
The Arena Group. (2023, November 27). Statement on AdVon Commerce partnership [Corporate statement]. X (formerly Twitter).
Variety. (2023, November 29). Sports Illustrated's parent says articles by allegedly fake writers with AI-generated photos came from third-party provider.