Running legal marketing compliance as a cycle, not a one-off review

What to take away

How to manage legal marketing compliance is a governance question before it is a proofreading task. The program needs a responsible leader, qualified jurisdictional review, channel owners, access to campaign and vendor records, authority to pause distribution, and a direct route for serious issues. A policy without those conditions cannot control production.

Start with the rules that govern lawyer advertising

The authorities are specific. The ABA Model Rules of Professional Conduct 7.1 through 7.5 govern communications about a lawyer's services: 7.1 bars false or misleading communications, 7.2 covers advertising and payments for referrals, 7.3 governs solicitation of clients, 7.4 addresses fields of practice and specialization, and 7.5 covers firm names and letterheads. What binds a firm is the version its own state's highest court has adopted, because state supreme courts adopt the rules of professional conduct. Most states modeled their lawyer advertising rules on the ABA Model Rules; California did not, and applies its own Rules of Professional Conduct.

Some states also require filing or review, not just internal approval. New York requires lawyers to file advertisements with the attorney disciplinary committee, subject to the rule's exceptions. Florida requires filing with The Florida Bar. Texas requires filing with the State Bar of Texas Advertising Review Committee before a public-media advertisement runs. Each filing becomes a record a regulator can pull, so the filing calendar belongs in the scope stage.

Two details follow from those rules. On disclaimers, a communication must not create unjustified expectations, so a results claim needs context showing the outcome depended on the facts of that case, and a testimonial needs the same treatment under both the state rule and the FTC's Guides Concerning the Use of Endorsements and Testimonials in Advertising. On retention, keep the published version of each advertisement, the approval record, and the sources behind every claim, because your state's rule sets what must be kept and for how long.

Section 5 of the FTC Act, which prohibits deceptive acts or practices, applies to the business side of the same claims; the bar rules sit on top of it rather than replacing it. The frameworks named below — the DOJ evaluation criteria, the GAO Green Book, the GOV.UK technology selection guidance, and the CISA software acquisition fact sheet — help structure the program, but none of them is a legal marketing regulator.

Build the management cycle

Worked evidence record for an outcome-claim control:

The U.S. Department of Justice's Evaluation of Corporate Compliance Programs frames prosecutor questions around whether a program is well designed, adequately resourced and empowered, and effective in practice. It is federal criminal-division guidance for case-specific evaluation, not a law-firm marketing certification or universal legal standard.

Translate each risk into a control with a named owner role, frequency, evidence, exception route, reviewer, and failure response. Name the owner role, such as marketing operations lead, professional responsibility counsel, or privacy officer. Set typical frequencies: monthly exception review, quarterly campaign sample, annual vendor review.

For example, an outcome claim may require a source record, client-permission check, review against the state's Rule 7.1, adjacent context, expiry date, published-version capture, and quarterly sample. A checklist item saying results approved is too vague to test.

The GAO 2025 Green Book describes an internal-control system for federal agencies, including objectives, risk assessment, control activities, information, monitoring, documentation, and corrective action. A private law firm is not claiming Green Book compliance by adapting its control logic.

Meet monthly with marketing, professional responsibility, privacy, security, and intake owners; include procurement owners. Review high-severity exceptions, old corrective actions, new channels, vendor automation, and expired evidence; also review recurring failures and target pressure.

Quarterly, observe a campaign from request through publication and inquiry handoff; the operating test often finds gaps policy review misses. Monthly exception reviews also surface the common law firm reputation management questions owners answer from memory, not a written record.

Run a controlled handoff

For the Design and Enable controls, the GOV.UK technology selection guidance recommends adaptable choices, data control, security review, and ownership-cost analysis.

For the Assess and Operate controls, the CISA software acquisition fact sheet covers development practice, supply-chain exposure, deployment, and vulnerability management.

Assign each step to a named owner role and an observable finish condition. Use roles such as marketing operations lead, professional responsibility counsel, or privacy officer. The analyst reproduces the result. The decision owner explains the action and stop rule.

Include one broken-data case and one revoked-access case. Record the repair, time required, and vendor help. Then the written process reflects normal operation, not a prepared demonstration.

Findings should feed incentives and system changes. If the same exception recurs, adjust the owner's performance measure, approval step, or dashboard. Retest to confirm the change reduced recurrence.

Keep the evidence record beside the decision so a reviewer can reproduce the reasoning without relying on memory. Set the next review date, and list the triggers that force an earlier check: new jurisdiction, new channel, vendor change, rule update, enforcement action, or high-severity exception.

Common questions

Who should lead the program?

Assign an accountable leader with access to qualified reviewers, production evidence, senior escalation, and pause authority.

Should every item receive the same review?

Use risk tiers, but preserve minimum ownership, evidence, jurisdiction, publication, and correction controls.

What proves effectiveness?

Representative operating tests, detected issues, timely correction, reduced recurrence, accurate records, and decisions that change when evidence changes.