Who Governs the Algorithm? Accountability, Liability, and Consumer Protection in AI Marketing

1. Introduction

The deployment of artificial intelligence in marketing has introduced a governance problem that existing legal, organizational, and ethical frameworks were not designed to address. Recommendation systems, dynamic pricing engines, and personalized advertising platforms now determine what consumers see, at what price, and under what persuasive framing. When those decisions cause harm, the question of accountability becomes acute: who is responsible, what evidence establishes that responsibility, and what governance mechanisms exist to prevent similar harm in the future? In most jurisdictions, and certainly in Georgia, no clear enforceable answer exists. This absence of accountability is not incidental; it is structural, arising from the simultaneous failure of four governance dimensions that have not previously been analyzed as an interdependent system.

This paper develops a systematic analytical response. The starting point is a diagnosis: four governance failures, legal, organizational, human resource management (HRM), and marketing ethics, each insufficient alone, but together constituting the AI Marketing Accountability Gap. The diagnostic step matters because the governance literature has addressed these failures in isolation. A strict liability reform cannot generate accountability without governance documentation that makes claims practically assertable. A governance framework cannot function without staff competent to evaluate AI outputs. HRM investment in AI literacy cannot protect consumers if professional ethics standards are inadequate for systems manufacturing preferences at scale.

The analytical response is the AI Marketing Accountability Model (AMAM). It integrates four theoretical traditions into a governance architecture unified by the Concentration Principle: effective accountability requires all four dimensions to be concentrated in the institution that deploys the AI system and captures its commercial benefit. The AMAM is applied to Georgia, an EU candidate country with a growing digital marketing sector, no dedicated AI legislation, and an under-resourced data protection authority, as a representative case for EU-aspiring economies digitalizing without adequate regulatory infrastructure. The paper contributes the first integrated governance framework that addresses all four accountability dimensions simultaneously, the first AI marketing governance analysis in Georgia, and a transferable model for developing economies.

2. Theoretical Framework: The AI Marketing Accountability Model

2.1. Why Existing Frameworks Are Insufficient

Two frameworks must be engaged directly. [1] propose a three-dimensional AI governance model: transparency, accountability, and controllability as necessary conditions for responsible organizational AI management. [2] provide the most rigorous existing analysis of consumer welfare consequences in AI marketing. Both contribute genuinely to their domains. The question is whether, taken together, they are sufficient to address the AI Marketing Accountability Gap. They are not, for structural rather than merely incomplete reasons.

[1] framework operates within the organizational governance domain and does not address legal liability, the human capital preconditions for its own effectiveness, or the marketing ethics dimension. An organization meeting all three conditions may still produce no civil liability consequence for AI marketing harm if fault-based law cannot reach its conduct. Governance structures without human competence to operationalize them produce nominal rather than substantive accountability. [2] identify consumer welfare consequences of AI marketing with precision but do not provide the institutional architecture to translate ethical principles into enforceable governance obligations. The AMAM fills both gaps by integrating all four dimensions through the Concentration Principle.

2.2. The Four Pillars

Pillar 1 Legal accountability draws on [3] cheapest-cost-avoider principle: liability should be assigned to the party best positioned to reduce harm at the lowest social cost. In AI marketing, this is unambiguously the deploying organization, which controls the system's design, objectives, training data, and captures its financial benefits. The injured consumer cannot access the system's architecture or reduce the risk it poses. Strict liability without proof of fault is therefore the prescribed legal standard. The EU revised Product Liability Directive (2024) operationalizes this by classifying AI software as a defective product and creates the compliance-liability nexus: AI Act non-compliance constitutes evidence of product defectiveness.

Pillar 2 Organizational governance draws on [4] principal-agent framework. The AI marketing system (agent) optimizes for conversion rates and engagement metrics that may diverge from the deploying organization's (principal's) ethical and regulatory obligations. [1] transparency, accountability, and controllability dimensions operationalize the principal-agent prescriptions and are incorporated directly into the AMAM's organizational pillar.

Pillar 3 Human capital and HRM draws on [5] AI4People framework, which treats AI accountability as a human capital challenge. [6] specify three necessary HRM conditions for substantive oversight: technical competence, clear role accountability with the authority to intervene, and a culture that treats algorithmic errors as systemic failures. [7] document automation bias, uncritical deference to algorithmic outputs as the characteristic failure when these conditions are absent, establishing that HRM investment in AI literacy is a functional governance requirement, not a professional aspiration.

Pillar 4 Marketing ethics draws on the consumer autonomy tradition (Murphy et al., 2017; [9]). [2] demonstrate three systematic threats: the exploitation of cognitive biases at scale, the manufacture of preferences through personalized environmental design, and the erosion of autonomous choice conditions. The EU AI Act's Article 5 prohibitions on subliminal manipulation and psychological exploitation translate these principles into legally enforceable obligations.

2.3. The Concentration Principle

The AMAM is unified by the Concentration Principle: legal, organizational, HRM, and ethical accountability must be concentrated in the institution deploying the system and capturing its commercial benefit. The principle resolves structural interdependence: legal reform without governance documentation fails at the enforcement interface; governance documentation without HRM investment fails at the operational interface; HRM investment without ethics engagement fails at the consumer welfare interface. Table 1 summarizes the AMAM.

Table 1. The AI Marketing Accountability Model (AMAM). Source: Authors.

3. Literature Review

3.1. AI in Marketing and Consumer Welfare

The marketing AI literature has moved from efficiency-focused accounts ([10]) to welfare-critical analysis. [11] establish that governance challenges escalate as AI moves from task automation toward autonomous judgment about consumer desires and vulnerabilities the conceptual basis for risk-based governance classification. [2] demonstrate that AI marketing creates qualitatively different welfare threats from conventional marketing: vulnerability exploitation at the population scale, preference manufacture, and erosion of autonomous choice. These threats are functional characteristics of systems optimized for commercial performance, not incidental failures, thereby directly motivating the AMAM's fourth pillar. [12] empirically confirm that large language models generate persuasive messages whose effectiveness derives from exploiting individual psychological profiles. [13] extend the concern upstream, showing that generative AI in marketing ideation systematically amplifies market inequalities.

3.2. Organizational Governance and Consumer Trust

[1] provide the foundational organizational AI governance framework incorporated into the AMAM's second pillar. [14] demonstrate governance failures are organizational rather than technical, motivating the governance officer and audit requirements. [15] confirm that accountability gaps arise from governance design choices even in sophisticated organizations. Regarding consumer trust, [16] document that algorithm aversion is strongest in domains involving personal vulnerability precisely where AI marketing is most capable. [17] find that transparency increases consumer trust, reframing governance investment from compliance cost to a competitive asset. [18] show consumers undervalue privacy under pressure, justifying mandatory privacy-by-design that cannot rely on fully informed consent.

3.3. Emerging Economy AI Governance

[19] demonstrate that AI governance frameworks developed in wealthy democracies assume institutional capacities that are absent in developing countries, thereby motivating the AMAM's phased approach. [20] document that regulatory lag, legislative reform without institutional capacity, produces unenforced law, directly informing the Phase 1 priority of supervisory capacity before legal obligation. [21] establishes the context of Georgian economic and EU integration. No Scopus or WoS-indexed publication has examined AI marketing governance in Georgia, confirming the gap this paper addresses.

4. Methodology

This study employs a qualitative, comparative, and conceptual research design combining three analytical phases, appropriate to its purpose of developing an original governance framework and applying it through comparative legal analysis. The approach is consistent with established conceptual framework development in management and marketing journals ([2]; [11]; [1]). Five research propositions constitute the empirical validation agenda.

Phase 1 examines AI marketing governance across five purposively selected jurisdictions: the EU, the US, the UK, Estonia, and Georgia, chosen for regulatory diversity (from comprehensive to absent), civil-law comparability with Georgia, and direct relevance to reform. Primary sources include the EU AI Act (Regulation EU 2024/1689), revised Product Liability Directive (2024), GDPR Article 22, FTC AI guidance (2023, 2024), UK ICO guidance (2024), and the Estonian draft Kratt Law, analyzed as a draft instrument not yet enacted as of mid-2026.

Phase 2 maps nine AMAM governance requirements against Georgian primary law: Civil Code Articles 992–998, 999, 1009–1016; Consumer Rights Protection Law (2019); Law on Personal Data Protection (2024); General Administrative Code; and the National Bank of Georgia's Regulation on Data-Driven Statistical, AI, and Machine Learning Model Risk Management. The EU AI Act is the comparator standard, selected because Georgia's Association Agreement obligations require convergence with EU standards. Partial coverage under general consumer protection provisions is explicitly noted.

Phase 3 synthesizes the four theoretical traditions into the AMAM, identifying structural conditions generating each failure, mapping interdependencies, and deriving governance prescriptions addressing interdependencies rather than isolated conditions.

5. Comparative Legal and Governance Analysis

5.1. The European Union

The EU AI Act (2024) and revised PLD (2024) constitute the most complete operationalization of the Concentration Principle currently in existence. The compliance-liability nexus addresses all four AMAM dimensions: the PLD creates strict product liability for AI software defects; AI Act non-compliance constitutes evidence of defectiveness (legal); the Act mandates quality management systems, technical documentation, audit logging, and bias validation (organizational); Article 26 requires technically competent human oversight (HRM); and Article 5 prohibits manipulation and psychological exploitation (ethics). GDPR Article 22, together with AI Act Article 13, creates an individual right to explanation the consumer-protection entitlement most absent from Georgian law. The AI omnibus simplification (adopted November 2025, political agreement May 2026) extended transition periods for certain high-risk obligations but left the compliance-liability nexus intact.

5.2. The United States, United Kingdom, and Estonia

The US and the UK share a structural characteristic: enforcement capability without integrated ex ante governance obligations to systematically prevent harm before it occurs. The FTC's Section 5 authority enables enforcement against deceptive AI marketing practices, with actions brought in 2023 and 2024, but operates reactively. AT&T Mobility v. Concepcion (2011) forecloses class actions for most individual AI marketing-harm claims. The UK's Consumer Protection Act, ICO guidance, and Online Safety Act (2023) provide coverage without statutory HRM governance mandates or strict liability. Estonia provides the most instructive civil law comparator: the draft Kratt Law concentrates liability in the deploying organization and mandates a right to explanation, operationalizing the Concentration Principle in the Continental tradition Georgia shares. Estonia simultaneously leads the EU's Digital Economy and Society Index, directly refuting the argument that strict AI accountability deters digital development.

5.3. Comparative Overview

Table 2 presents the systematic assessment across five jurisdictions.

Table 2. Comparative AI marketing governance. Source: Authors' comparative analysis.

6. The Georgian Governance Gap and Research Propositions

6.1. Georgian Institutional Context

Georgia's digital economy has expanded substantially: the e-commerce market reached approximately US$1.1 billion in annual revenue by 2025 ([22]), with card-based transactions growing 19% year-on-year as of mid-2025 ([23]). The fintech sector has developed rapidly since the National Bank of Georgia introduced VASP licensing in 2023, and AI-driven recommendation systems, personalization engines, and dynamic pricing are standard practice across digital retail, financial services, and hospitality. This development has occurred against three structural governance features representative of a wider class of EU-aspiring economies: a complete absence of dedicated AI legislation; an under-resourced data protection authority that relies substantially on Council of Europe technical assistance and has no dedicated AI competence; and EU integration obligations that require convergence with EU consumer protection standards. These features characterize comparable Eastern Partnership countries, making the Georgian analysis transferable.

6.2. Regulatory Gap Assessment

Table 3 maps nine AMAM governance requirements against Georgian current law. Where general provisions provide partial coverage, this is documented explicitly.

Table 3. AI marketing governance gap: Georgian current status. Source: Authors' analysis.

Three gaps are particularly consequential. The absence of any AI definition means governance obligations cannot be coherently attached to AI marketing systems. The absence of any manipulation prohibition renders practices explicitly prohibited under EU AI Act Article 5 entirely lawful in Georgia. The absence of any right to explanation leaves consumers unable to access information necessary to identify that harm has occurred, let alone assert a remedy.

6.3. Research Propositions

The AMAM generates five propositions forming a structured validation program. P1: Firms concentrating AI marketing accountability in a single designated governance officer will demonstrate significantly lower algorithmic consumer harm rates than firms distributing accountability without designated authority (Jensen & Meckling, 1976; test: comparative governance audit of Georgian firms). P2: Consumers receiving a meaningful explanation of an AI marketing decision will report significantly higher institutional trust than those receiving none, controlling for prior trust disposition (Dietvorst et al., 2024; test: between-subjects experiment, N ≥ 300). P3: Introduction of strict civil liability will generate greater ex ante governance investment than voluntary standards (Calabresi, 1970; test: difference-in-differences before and after Civil Code amendment). P4: Marketing professionals completing mandatory AI literacy training will exhibit significantly lower automation bias than untrained counterparts (Banerjee et al., 2022; test: experimental vignette study, N ≥ 120). P5: Governance effectiveness will be significantly lower when AMAM dimensions are addressed in isolation than simultaneously, confirming the interdependence prediction ([1]; test: SEM of Georgian firms across all four dimensions).

7. Policy Framework

The six-reform phased agenda is organized by the Concentration Principle and calibrated to Georgian institutional capacity and EU Association Agreement obligations. Phase 1 (months 0–12): enact a functional AI definition and risk classification, designating consumer-facing marketing AI as high-risk by default (EU AI Act Art. 3(1) alignment); establish an AI Marketing Supervisory Unit within the Personal Data Protection Service with technical staff and enforcement mandate (EU AI Act Art. 70 alignment). Phase 2 (months 12–24): amend Civil Code Articles 1009–1016 to include AI software as a defective product subject to strict liability, with new Article 999(2) designating AI marketing as an increased-danger source and establishing joint and several liability with vendors (EU PLD 2024 alignment); insert Chapter V(A) 'Algorithmic Marketing Rights' in the Consumer Rights Protection Law, providing the right to explanation, opt-out from profiling, manipulation prohibition, and compensation without proof of fault (EU AI Act Arts. 5 and 13 alignment). Phase 3 (months 24-36): enact an AI Marketing Governance Act mandating a designated governance officer, quarterly bias audits, procurement governance, and HRM competency obligations (EU AI Act Arts. 14, 25–28, 26 alignment); mandate AI marketing liability insurance and professional AI literacy certification (Estonian insurance model alignment).

The Phase 1 priority on institutional capacity before legal obligation reflects [20] regulatory lag analysis: enacting Phase 2 obligations without the supervisory enforcement infrastructure to implement them produces formal rights without practical protection. Framing Phase 3 reforms as EU Association Agreement approximation obligations rather than as domestic regulatory initiatives activates the EU monitoring accountability mechanism and builds the political coalition necessary to overcome resistance from the business community. The model's transferability to analogous Eastern Partnership economies follows from the Concentration Principle's derivation from economic theory rather than Georgian-specific doctrine, and from the shared characteristics of civil law tradition, regulatory lag, and EU integration incentives that define the representative class.

8. Discussion

8.1. Theoretical Implications

The AMAM's central theoretical contribution is to demonstrate that AI marketing governance failures are structurally interdependent and cannot be adequately addressed by single-dimensional frameworks. The interdependence analysis establishes a general design principle: where governance failure conditions span multiple institutional domains, frameworks that treat them as separable will underperform at their interfaces. The Concentration Principle addresses this by identifying a single accountable institution, eliminating interface failures by requiring simultaneous attention to all four dimensions. Future research should examine whether this principle applies with equal force to AI governance in healthcare, criminal justice, and financial services. The paper advances [1] by adding legal liability, HRM, and marketing ethics dimensions that their organizational focus did not address, and by providing the Concentration Principle as the integration mechanism connecting all four.

8.2. Practical Implications

Three implications follow for marketing managers. First, the compliance-liability nexus the EU AI Act creates, and Georgian reform will replicate, means AI marketing governance will be assessed against legally enforceable standards with civil liability consequences, not voluntary ethics codes. Second, [17] transparency-trust evidence establishes that AMAM-compliant governance creates competitive differentiation, not merely compliance cost. Firms investing in explanation mechanisms and bias audits build consumer trust advantages. Third, [7] findings on automation bias confirm that governance documentation without HRM investment is systematically ineffective; formal oversight structures without technical competence among oversight personnel produce accountability that exists on paper but not in practice.

8.3. Limitations

Three limitations define the paper's boundaries. The most significant is the absence of primary empirical evidence from Georgian consumers or marketing professionals; the five research propositions constitute the systematic agenda for addressing this. The comparative analysis covers five jurisdictions and does not address Asian AI governance models relevant to Georgia's eastern economic relationships. Finally, the EU AI Act's omnibus simplification amendments continue to evolve; the AMAM's theoretical architecture is regulation-agnostic and durable, but specific legislative references may require updating as secondary legislation develops.

9. Conclusion

This paper addressed the question of who governs the algorithm through a three-step analytical process: diagnosing the AI Marketing Accountability Gap as a structural condition arising from four interdependent governance failures; developing the AMAM and Concentration Principle as an integrated governance architecture; and applying both through comparative legal analysis and Georgian regulatory gap assessment to generate a phased policy agenda. Three contributions follow: the AMAM as the first governance framework integrating all four accountability dimensions; the first systematic AI marketing governance analysis of Georgia and the South Caucasus; and a transferable governance model for developing countries combining rapid digital adoption with limited regulatory capacity. The governance of AI in marketing cannot be addressed incrementally by individual disciplines. The Concentration Principle offers a systematic basis for designing governance frameworks that address the problem at its structural root.

Disclosure Statement: The authors declare no competing interests. This research received no external funding. AI tools were used for structural organization and linguistic editing. The theoretical framework, comparative analysis, and policy conclusions are the original intellectual contribution of the author(s).

References