Key takeaways
Marketing in Regulated Industries
Marketing a regulated business is genuinely hard. Every claim gets reviewed, every campaign carries legal risk, and the creative freedom other marketers take for granted simply isn’t available to you. If you work in health, law, finance or anywhere near them, it’s something you wrestle with every day.
And it doesn’t stand still. Regulation changes constantly, sometimes for the better, sometimes not, and keeping on top of it is a job in itself, on top of the actual marketing.
There’s no point moaning about any of that, because none of it’s going away. What you can do is make it easier to live with, and that’s what this guide is for: practical processes that get copy through review first time, keep you current as the rules move, and stop compliance eating time it doesn’t need to eat. We’ve taken copy through these reviews ourselves and had it bounced back, so everything here comes from doing it, not theorising about it.
One idea runs through the whole guide: the rules work better as a brief than as an enemy. A claim that survives sign off is usually a stronger claim, because it’s backed by evidence a cautious buyer will actually trust.
You’ll find named regimes below, clear do and don’t lists, and short before-and-after rewrites you can take straight back to your team. None of it is legal advice. We say that properly further down.
What counts as a regulated industry, and why the rules differ
A regulated industry is any sector where a body outside your business controls what you can claim, and can penalise you for getting it wrong. The rules differ sharply between them, so advice that ignores your regime is close to useless.
There are four worlds you might sit in. Each has its own referee.
Medical and clinical. The Advertising Standards Authority and the CAP Code govern your marketing claims, and the MHRA governs medicines. You can’t make medical efficacy claims without evidence, and you can’t discourage people from seeking treatment they need.
Life sciences and pharma-adjacent. If you promote prescription medicines to health professionals, the ABPI Code applies, administered independently by the PMCPA. The current code reflects UK law and goes beyond it. This is the tightest regime of the four.
Legal. The Solicitors Regulation Authority sets expectations for how firms present themselves, including transparency rules on what must be published about prices, services and complaints. The firm carries responsibility for every published word, whoever drafted it.
Financial services and insurance broking. The FCA requires that financial promotions are fair, clear and not misleading, across every channel: a website, a social post and an email all count as promotions. Risk warnings are mandatory for many products, and pressure tactics are treated as a red flag.
And it doesn’t stop at those four. Regulated sub-sectors run through most industries: manufacturers with safety-critical products, technology businesses handling sensitive data, and plenty more. We see it constantly across the sectors we work in, from health and wellness to professional services, where a client might be a healthcare product one month and an insurance business the next, both regulated, each differently.
The common thread is evidence. Across all four worlds, you must be able to prove what you say before you say it, not scramble to justify it after a complaint lands. What changes is the strictness. A wellness clinic and a pharma company both market in health, but the pharma company operates under far tighter rules.
If you want the fuller picture of marketing hard-to-sell and heavily regulated businesses, the differences between these worlds are exactly why generic marketing advice keeps failing you.
Getting sign off first time
The goal is copy that clears legal and compliance the first time it lands on their desk. Not copy that gets bounced, rewritten, resubmitted and finally approved a fortnight after the campaign should’ve gone live.
Before anything else, understand that what’s allowed is different for every business, even within the same regime. You’ve got the actual industry regulation, and then most companies in these spaces layer their own rules and guardrails on top: house positions on risk, tone, claims they won’t make even though they legally could. So something that cleared review for one business won’t necessarily clear it for yours, and something you saw working at a previous company may not fly here. The processes below work everywhere precisely because they’re built around finding out what your rules are, rather than assuming.
Sign off first time happens when compliance is a stage in your workflow, not a gate at the end. And it starts with a mindset shift.
Stop treating claims as things you write and then defend. Start treating them as things you can prove, then phrase well. The evidence comes first. The wording follows.
This flips how most marketing teams work. Usually the creative comes first and the substantiation gets bolted on when someone asks for it. In a regulated business, that order gets you bounced.
A marketing approach that survives sign off has three habits built in:
- Every objective claim is backed by evidence you already hold.
- Every claim has a documented trail showing where the evidence came from and who approved it.
- Compliance sees the thinking early, not the finished asset.
Get those right and review stops being a bottleneck. Your reviewers are checking work that was built to pass, so they pass it. And it’s worth saying plainly: these aren’t weaker claims, they’re better-evidenced ones. A specific, provable statement almost always outperforms a vague, sweeping one with a cautious audience anyway.
Hold your evidence before you publish, not after
Under CAP Code rule 3.7, marketers must hold documentary evidence to support objective claims before an advertisement is published. Not when the ASA asks. Before.
For health, beauty and slimming claims the bar is higher still. The evidence should normally include at least one adequately controlled experimental human study, as the ASA guidance on substantiation sets out.
So the rule for your team is simple. If you can’t put your hand on the proof today, you can’t run the claim today. Write the claim you can support now, and park the stronger one until the evidence exists.
Substantiate every claim and keep the trail
A claim substantiation file is your defence and your speed. It records three things for every claim you make: the claim itself, the source that backs it, and who signed it off.
Build one row per claim. “97% of clients renewed” sits next to the report it came from, dated, with the approver’s name. When compliance or the ASA asks, you answer in minutes, not days.
This trail is what turns review from a negotiation into a rubber stamp. It also stops knowledge living in one person’s head, so a departure doesn’t reset your whole approval process.
Build a pre-approved checklist
The single most useful thing you can put in place, whether you’re in-house or you’re an agency or freelancer working with a regulated client, is a pre-approved checklist agreed at the very start.
It’s two lists, written down together with the people who give sign off. The first is everything that’s compliant by default: the types of content, claims, channels and changes that can go ahead without individual approval, because you’ve agreed upfront that they meet the rules and the company’s own risk appetite. The second is everything that always needs approval, with the evidence it’ll need attached.
The point is speed in both directions. Work on the first list ships without a queue, so you stop wasting review time on things that never needed checking. Work on the second list arrives at compliance with its evidence already attached, so it clears faster too. And because the company’s own view of the rules is baked in, not just the regulator’s, nobody discovers a house rule for the first time at sign off.
If you’re in-house, build this with your compliance and legal colleagues directly. If you’re an agency or freelancer, make it the first working session of any regulated engagement. It’s how we start ours: an upfront conversation about what is and isn’t allowed for that specific company, based on their regime and their own line on it. That checklist then underpins everything we do, which is how we never break compliance and never waste anyone’s time asking permission for things we already know we can do.
Beyond the checklist, the workflow that keeps everything moving is simple: compliance sees the concept and the claims at the brief, evidence gets logged before copy is written, a qualified person reviews the draft against the regime, and the sign off is recorded with a date and a name. Approval sits inside the workflow rather than bolted on at the end, so the hard conversations happen when changing direction costs a sentence, not a finished asset.
Stay on top of the rules, because they keep changing
Regulation moves constantly. Guidance gets updated, codes get revised, enforcement priorities shift, and a claim that was fine last year can quietly stop being fine. Discovering that at sign off, or worse, after publication, is the expensive way to find out.
So alongside the checklist, set up a way for changes to reach you rather than the other way round. The simplest version is an RSS feed or email alerts pulling updates from your regulators: the ASA, the FCA, the SRA, the MHRA, whoever governs your world. Ten minutes to set up, and scanning it becomes a five-minute weekly habit that occasionally saves you a very bad month. When something relevant lands, update the checklist, so the change propagates into your process instead of living in one person’s head.
It’s something we do for our clients as standard: every client we work with in a regulated space gets a bespoke feed monitoring their specific regulators, so the checklist we work to is never quietly out of date.
Show Google you’re allowed to talk about this
One more thing that’s different about regulated industries: E-E-A-T isn’t a nice-to-have here, it’s core to whether you’re visible at all.
Google holds health, finance and legal content to its highest standard, because getting these answers wrong hurts people. Google’s own documentation is explicit that its systems give extra weight to strong E-E-A-T, experience, expertise, authoritativeness and trust, on topics affecting health, financial stability or safety. In most industries it’s one ranking consideration among many. In yours, it decides whether Google is willing to show your content at all, and being seen as an authority, allowed and respected to talk about these topics, is one of the biggest difference-makers available.
Demonstrating it is concrete, not mystical. Put named, credentialed authors on your content, with real bios that show why they’re qualified to write it. Add reviewed-by lines where a qualified professional has checked the piece. Cite primary sources: the regulator, the study, the code, not a blog summarising them. Keep your about pages, credentials and registrations easy to find and verify. And publish original insight where you have it, because content only you could have written is the strongest authority signal there is.
Notice the overlap: almost everything E-E-A-T rewards, your compliance process already produces. Evidenced claims, qualified review, primary sources, documented expertise. Run the processes in this guide and you’re most of the way there.
The lines that get copy bounced
Some lines get bounced almost every time. Share this list internally and you’ll spare your team the rewrites.
- Implied guarantees of outcome.
- Unsubstantiated superlatives such as “best” or “leading”.
- Testimonials used where the regime restricts them.
- Before and after imagery in clinical contexts without proof.
- Scarcity and urgency tactics in financial promotions.
- Borrowing a competitor’s claim without checking the evidence behind it.
- Treating AI-generated copy as review-safe by default.
Those last two catch people out. A competitor running a claim doesn’t mean the claim is compliant, and it doesn’t mean you hold the evidence to run it. You need your own proof for your own words. And AI can draft fast, but it doesn’t know your regime and it invents facts. Your firm stays fully responsible for everything you publish, however it was produced, so treat AI output as a first draft a qualified person reviews against the rules and the evidence file. Never as review-safe copy you can ship.
The trickiest four deserve a closer look.
Implied guarantees
Words that promise an outcome trip evidence requirements you probably can’t meet. “Guaranteed results” and “risk-free” imply certainty a regulator will ask you to prove. Superlatives are the same trap: “the best law firm in Leeds” or “the UK’s leading broker” needs objective evidence, held before you publish, or it comes straight out.
Swap the promise for a fact. Not “guaranteed to lower your bills” but “clients saved an average of £340 in year one”, with the file to back it.
Testimonials and before and after imagery
The ASA treats before and after photos like testimonials, which triggers the evidence rules in CAP. You must hold signed, dated proof that the images are genuine and unmanipulated, as the ASA guidance on before and after photos confirms.
In clinical contexts this is where a lot of marketing falls over. A glowing patient story or a dramatic before-and-after shot may look persuasive and still fail review. If you use them, get the sign off in writing and dated, and keep it. If you can’t, don’t run them.
Scarcity and urgency in financial promotions
Countdown timers and “only three spaces left” pressure tactics are a problem in financial promotions. The FCA standard is that a promotion must be fair, clear and not misleading, and manufactured urgency pushes against all three.
Pressuring someone into a financial decision is exactly what the rules exist to prevent. So drop the timer. Sell on the substance instead: clear terms, plain pricing and honest information about risk do more for compliance than any artificial deadline, and more for conversion with this audience too.
Work with us
Copy keeps bouncing? We work with regulated businesses already, and compliance is built into how we run marketing rather than bolted on at the end
Worked examples: non-compliant lines rewritten to sell within the rules
Here’s the principle applied in each of the four worlds: a line that fails review, rewritten to sell within the rules. The pattern is the same every time: drop the promise, add a provable fact. Specific beats sweeping.
Medical and clinical
Non-compliant, in a paid ad: “Our treatment cures chronic back pain, guaranteed.”
That fails CAP rules 12.1 and 12.2. It makes a medical efficacy claim without evidence and could discourage someone from seeking proper care.
Compliant: “A physiotherapist-led programme designed to reduce chronic back pain, with a plan tailored to your assessment.”
It describes the service honestly, sells the tailored approach, and makes no claim you can’t support.
Life sciences and pharma-adjacent
Non-compliant, in a public-facing ad: “Ask your doctor about Drugname, the number one choice for lowering cholesterol.”
Prescription-only medicines may not be advertised to the public at all. The ABPI Code, tightened in the 2024 code of practice, also governs how you promote to health professionals, and superlatives need robust support.
Compliant, to health professionals: “Prescribing information for Drugname, including efficacy data from [study], available via the QR code.”
It stays factual, references the evidence, and respects who you’re allowed to talk to.
Legal
Non-compliant, on a firm’s homepage: “The best divorce lawyers in the country. We win every case.”
“Best” needs objective proof, and “we win every case” is an implied guarantee. The firm carries responsibility for both lines whoever wrote them.
Compliant: “Specialist family law solicitors with over 20 years’ combined experience in complex divorce cases.”
Provable, confident, and clean under SRA expectations. Experience stated as fact outperforms bravado.
Financial services and insurance broking
Non-compliant, in a paid social campaign: “Switch today and save. Offer ends midnight. Rates this low won’t last.”
That stacks urgency on a financial promotion. It pushes against fair, clear and not misleading.
Compliant: “Compare our cover and pricing in full below. Your capital may be at risk.” with the required risk warning shown clearly.
It informs rather than pressures, and it carries the warning where the product needs one.
The examples above happen to be lines of copy, because a claim is easiest to show on a page. But the same principles govern everything a marketing programme produces: the landing pages and ads, yes, and also the email sequences, the PR pitches and press quotes, the webinar slides, the social posts, the video scripts and the sales enablement material. Every channel we run for regulated clients, from SEO content through digital PR to ABM campaigns, goes through the same evidence-first process, because a regulator makes no distinction between an unsubstantiated claim on a web page and the same claim in an email.
One more thing: your evidenced claims are also how you compete
In most regulated sectors you’re up against much bigger names, the NHS, the national firms, the big insurers, and you won’t outspend them. The good news is that everything in this guide doubles as your answer to that.
Institutional giants have to be broad and generic. You don’t. When a buyer asks a detailed, high-stakes question, in search or increasingly in AI answers, the best specific, evidenced answer wins, not the biggest brand. And buyers in health, law and finance are cautious by nature: they don’t respond to hype, they respond to clear, honest, provable information.
So the compliant, substantiated claims this guide has been about aren’t a limitation. They’re your competitive edge. The same proof that clears review is the proof that wins a wary buyer against a bigger name.
A quick word on legal advice
This is a practical marketing guide, not legal advice. Regulations change, and they apply differently depending on your product, your regime and your circumstances. What clears review for one business may not clear it for yours.
So before you publish, check your claims and your process with your own qualified legal and compliance people. They know your situation. A general guide can’t. You can read our disclaimer for the full position.
If you don’t have that support in place, we’re happy to point you in the direction of our own legal counsel. Like most of the people in our business, he’s a senior independent specialist in his own right, and he may be able to advise on your specific situation.
That said, the habits in this guide travel well across all four sectors. Hold your evidence first. Keep a clean trail. Bring compliance in at the brief. Avoid the lines that get copy bounced. None of that depends on the fine detail of your regime. It’s simply good practice for anyone marketing a regulated business.
If you’d rather not manage the headache
The honest hope for this article is that it gives you things that genuinely make next time easier: the checklist, the monitoring feed, the evidence-first habits. None of it is complicated. It just needs setting up.
But if you’d rather not set those processes up yourself, or you’re simply too busy to, it’s something we’re happy to do. It’s how we already run marketing for regulated clients: the pre-approved checklist agreed upfront, a bespoke regulatory feed monitored for you, compliance built into the workflow rather than endured at the end. And the person you meet is the person on the account: no juniors, no account managers, no rules to re-teach a new starter every quarter. We keep the roster capped at ten clients so that closeness is real, and we work with regulated businesses already, including finance clients such as Aurium Finance, so your world isn’t new to us.
Every regulated situation is genuinely unique, which is why the right first step is a conversation rather than a form. Get in touch for a 30-minute discovery call with a senior specialist. No pitch deck, no pressure. Just a straight conversation about what would work inside your rules.