Prepared by Purely Works · June 2026 · Confidential
This is a sample report for a fictional company. All data is illustrative.
Forge Marketing Group is in a reactive AI posture — a state where AI tools are actively being used across the business without any formal strategy, governance, or oversight. Our assessment found 17 distinct AI tools in active use across content creation, client communication, design work, and internal operations. Of these, only 5 have been formally reviewed and sanctioned by leadership.
The most urgent finding is the presence of 4 HIGH-risk exposures involving client confidential data. Multiple team members routinely share client briefs, campaign budgets, competitive strategies, and financial projections with consumer-tier AI products that have no data processing agreements and may use conversation data for model training. This is a direct violation of most client NDAs and creates significant legal liability.
Beyond immediate risk, we identified three significant opportunities where structured AI adoption would deliver measurable value: a formalized content production system, an internal knowledge base with AI assistance, and a complete client data protection protocol. Together, these initiatives represent $847,000 in 24-month projected value against a total investment of approximately $37,400 — a payback period of under 4 months.
The good news: Forge is not behind. Most B2B agencies at this stage of growth have the same shadow-AI problem. The difference between companies that thrive with AI and those that face regulatory or reputational damage is almost always a matter of governance — not tool selection. This roadmap gives Forge a clear path from reactive to strategic.
We identified 17 AI tools in active use across Forge Marketing Group — spanning content creation, client communication, design, and operations. Of these, only 5 are formally sanctioned by leadership. The remaining 12 are in use without policy review, vendor agreements, or data handling controls.
| Tool | Use Case | Risk Level | Sanctioned | Notes |
|---|---|---|---|---|
| ChatGPT | Content writing | High | No | Client briefs, campaign strategies, and budget data routinely shared without data retention controls |
| ChatGPT | Ad copy generation | High | No | Same consumer-tier exposure; client competitive data at risk |
| ChatGPT | Email sequences | High | No | Client contact data and messaging strategy exposed to consumer product |
| Midjourney | Brand imagery | Medium | No | IP ownership of generated images unclear; public by default on free tier |
| DALL-E | Social media assets | Medium | No | Used for client deliverables without IP rights review |
| Jasper | Content at scale | Medium | No | No enterprise agreement; client brand data entered without controls |
| Grammarly | Proofreading | Low | ✓ Yes | Business plan with DPA in place |
| Notion AI | Internal docs | Low | ✓ Yes | Used for internal knowledge only; low client data exposure |
| Otter.ai | Client call transcription | Medium | No | Recording clients without documented consent; consent laws vary by jurisdiction |
| Adobe Firefly | Design work | Low | ✓ Yes | Commercially safe; IP indemnification in Adobe Enterprise agreement |
| Canva AI | Social graphics | Low | ✓ Yes | Canva for Teams plan; acceptable use for client deliverables |
| GitHub Copilot | Automation scripts | Low | No | Used by 1 team member; low client data exposure but unlicensed |
| Perplexity | Research | Low | No | Used for market research; inputs reviewed, low sensitivity |
| Claude.ai | Financial / strategic analysis | High | No | Financial projections and client acquisition strategies entered into consumer tier with no DPA |
| HubSpot AI | CRM insights | Low | ✓ Yes | Covered under existing HubSpot agreement; data stays within CRM |
| Loom AI | Video summaries | Low | No | Used for internal async communication; upgrade to Business for DPA |
| Zoom AI Companion | Meeting transcripts | Medium | No | Transcripts stored; data region unverified; client calls included |
Forge Marketing Group scores 2.0 out of 5.0, placing the organization in the "Reactive" stage. AI adoption is happening informally without strategy or oversight. The radar below compares Forge's scores against the B2B agency benchmark across all 7 pillars.
Our risk assessment identified 4 HIGH-severity findings that require immediate action. Each represents an active, ongoing exposure — not a theoretical risk. These are happening today.
Data Breach / Client Trust / NDA Violation
Multiple team members routinely paste client briefs, campaign budgets, and competitive strategies into ChatGPT (consumer tier). OpenAI's consumer products use conversation data for model training unless users manually opt out — a step that has not been taken by any team member. Client NDAs at Forge prohibit third-party disclosure of proprietary information. This practice is in ongoing, daily violation of those agreements.
Immediately prohibit consumer-tier ChatGPT for all client data. Migrate to ChatGPT Team or Enterprise with a Data Processing Agreement executed prior to any client data input. Provide all-hands training on what constitutes "client data" for this policy.
Data Breach / Regulatory / Fiduciary
The Director of Strategy uses Claude.ai (consumer tier) to analyze client financial projections, pricing models, and acquisition strategies. Anthropic's consumer product privacy policy does not meet enterprise data handling standards and includes no data processing agreement. Financial data shared in this manner may constitute a breach of confidentiality obligations under client service agreements.
Upgrade to Claude Pro with Team plan and execute DPA before any further use with client financial data, or restrict financial data processing to on-premise or zero-data-retention solutions. Document the policy change in writing and obtain employee acknowledgment.
Legal / Client Trust / Privacy Law
Otter.ai is used to record and transcribe client discovery calls, strategy sessions, and review meetings without disclosing this to clients. In California, Illinois, Florida, and most EU jurisdictions, all-party consent is required for recording. At least 6 active clients are headquartered in states with strict recording consent laws. No client onboarding materials reference recording or transcription. Otter.ai is on the consumer plan with no DPA.
Update client onboarding documentation to include explicit recording and transcription disclosure. Verbally announce at the start of every call. Upgrade to Otter.ai Business for enterprise data compliance. Consider obtaining written consent as part of the engagement agreement.
Client Trust / Contractual Breach / IP Liability
AI-generated content — including copywriting, imagery, strategic frameworks, and analysis — is being delivered to clients as agency work product without any disclosure that AI tools were used in the creation process. A review of 4 active client contracts found that 2 explicitly prohibit undisclosed use of AI tools in deliverables. This creates active breach-of-contract exposure. The remaining contracts are silent on AI, which creates future renegotiation risk as clients become more AI-aware.
Audit all active client contracts for AI-related clauses. Draft an AI disclosure addendum for clients with explicit prohibitions. Update all new client contract templates to include a clear, balanced AI usage policy. Create an internal content quality checklist that documents what was AI-assisted vs. human-authored in each deliverable.
Images generated by Midjourney (consumer plan) are not owned by Forge Marketing Group under Midjourney's terms of service. Delivering these images to clients as agency work product may violate copyright provisions in client agreements. DALL-E images via API have clearer ownership terms, but are not currently used under an enterprise account with IP indemnification.
Zoom AI Companion is enabled on the team account and generates meeting transcripts and summaries. The data storage region for AI-generated content has not been verified. For Forge's EU-based clients (2 active accounts), this creates potential GDPR transfer compliance risk. No data processing addendum has been executed with Zoom for the AI features specifically.
The roadmap is structured in three overlapping phases. Phase 1 starts immediately and is free. Phases 2 and 3 can be initiated in sequence or in parallel, depending on Forge's bandwidth and priorities.
Objective: Eliminate the 4 HIGH-risk exposures identified in the risk assessment through policy creation, tool controls, and team training — with zero software spend.
Key Deliverables:
Objective: Build a structured, quality-controlled AI content workflow that standardizes how the team creates client content — eliminating inconsistency and dramatically increasing throughput.
Key Deliverables:
Objective: Build an AI-powered internal knowledge base that captures Forge's institutional knowledge — client histories, process documentation, brand guidelines, templates — and makes it instantly accessible to every team member.
Key Deliverables:
| Initiative | Investment | Annual Value | Payback | 24-Month Net |
|---|---|---|---|---|
| Client Data Protection Protocol | $0 | Risk elimination (incalculable) | Immediate | $0 + risk mitigation |
| AI Content Production System | $8K + $400/mo (~$17.6K total) |
$34,000 | 6.2 months | ~$50,400 |
| Internal Knowledge Base + AI Assistant | $15K + $200/mo (~$19.8K total) |
$180,000 | 1.3 months | ~$340,200 |
| Total (Initiatives 2 + 3) | ~$37.4K | $214,000+/yr | < 4 months | $847,000 |
The playbook below covers Initiative 1 — Client Data Protection Protocol in full week-by-week detail. This initiative requires zero budget and can begin immediately. It is the most urgent priority given the 4 active HIGH-risk exposures identified in the assessment.
This deliverable is a 60-minute in-person (or virtual) executive briefing delivered by Purely Works to your leadership team. It is designed to translate the technical findings of this report into clear, decision-ready language — and to generate the organizational alignment needed to actually execute the roadmap.
Get the same depth of analysis for your company — all 7 deliverables, plus the executive briefing for your leadership team. Engagements typically complete in 3–4 weeks.
Enter your work email to unlock the complete Forge Marketing Group AI Audit Report — all 7 deliverables, unredacted.
No spam. You'll get access instantly.