Social media compliance means being able to prove three things after the fact: that a qualified person reviewed a post before it went live, that the post carried whatever disclosures your regulator requires, and that you still hold a retrievable copy of what was published, when, and by whom. Everything else — tooling, calendars, sign-off tiers — exists to make those three proofs cheap to produce.
At a large bank that job belongs to a seven-figure compliance suite. At a four-person advice firm, a two-partner law practice, a dental clinic or a council comms team, it has to run on a scheduler, a shared drive and a spreadsheet, without hiring anyone. This guide is the small-firm version.
One caveat: I run a scheduling tool, not a compliance practice. What follows is the operational shape regulated teams keep landing on. The rule numbers, retention periods and required wording come from your regulator or counsel — they differ by country, sector and licence. Get those in writing, then build the process around them.
The four obligations underneath every regime
Strip away the sector-specific language and almost every social media rulebook asks for the same four things:
- Review before publish. Someone with the authority to say no looks at the content first, and that fact is recorded.
- Disclosure. Paid relationships, material risks, professional status, and — newly — AI involvement are stated in the post itself, not buried.
- Records. What you published survives independently of the platform, along with edits and deletions.
- Control. Named people hold access, and that access is removed when they leave.
Cover those four and you are ahead of most small regulated firms, who typically hold a strong opinion about tone of voice and no record of who approved anything.
Which rules actually touch you
| Sector | Typical regimes (examples) | What it forces operationally |
|---|---|---|
| Financial services | FINRA and SEC rules in the US; FCA financial promotions rules in the UK | Pre-approval of promotional content by a qualified person; risk warnings inside the post; retained communications |
| Health and medical | Patient-privacy law such as HIPAA; national medical council advertising codes; advertising-standards rules on health claims | No identifiable patient information without written consent; substantiated claims; strict rules on before/after imagery and testimonials |
| Legal | Bar and law society advertising and solicitation rules | Required labels in some jurisdictions; no guarantees of outcome; copies of advertising kept for a set period |
| Public sector | Public-records and freedom-of-information law | Posts, and often the comments underneath them, are records; deletion and blocking must follow a written, consistently applied policy |
| Everyone | Consumer-protection and advertising codes; data-protection law; EU AI Act transparency rules | Clear paid and gifted disclosure; lawful handling of personal data in comments and DMs; AI-content transparency |
Two patterns are worth pulling out of that table.
First, in financial services the distinction that keeps mattering is between static and interactive content. Broadly, your profile, pinned posts and scheduled promotions are advertising needing sign-off before it appears; a live back-and-forth in the replies is supervised rather than pre-approved. Which is why scheduling helps compliance — it turns a spontaneous act into a queued item with a review step in front of it.
Second, public-sector teams have the opposite problem. Their risk is not the outbound post, it is the deletion: a councillor removing an awkward comment can be a records issue and, in some jurisdictions, a rights issue. Write the moderation rule down before you need it.
Obligation 1: the approval trail
An approval trail is not "she said yes on Slack". A trail that survives a complaint contains, for each post:
- The exact content as submitted — caption, media, links, destination platform
- Who submitted it, with a timestamp
- Who reviewed it, and what authority they hold
- Any feedback given, verbatim, and what changed in response
- The approval itself, with a name and a timestamp
- The publish time and the live URL
Most of that is metadata your scheduler already generates. The gap in ad hoc processes is the middle: the review and the named approval.
Not everything needs the same rigour. Tier your content by risk and write the tiers into your policy — promotions, performance claims and anything touching a client's circumstances get full review; an event photo or a job ad does not. The mechanics, including how to stop feedback arriving in five separate messages over three days, are in our content approval workflow guide, with an internal-team version in the team content approval workflow guide.
This is the part SocialKit is genuinely built for. Approval workflows come with the Team and Enterprise plans: a post is drafted, routed for review, and cannot auto-publish until approved, with the calendar showing what is waiting on whom. There is a click-by-click walkthrough on setting up a content approval workflow. Pricing is flat — every plan carries all 11 supported platforms and unlimited scheduled posts, from €29/month as of July 2026, with a 7-day trial.
One clinic runs it like this: the practice manager drafts on Monday, the clinical lead reviews Tuesday morning, nothing publishes without that second name attached. Fifteen minutes a week, and "who approved this?" has an answer.
Obligation 2: three kinds of disclosure
Regulated teams treat disclosure as one thing. It is three, with separate triggers.
Commercial disclosure. Paid partnerships, gifted products, affiliate links, employee content about their own employer. The rule of thumb that holds across most advertising codes: the disclosure sits in the post, near the top, in plain language, readable before anyone taps "more" — not in the first comment, not as the last hashtag in a block of thirty. Our guide to disclosing sponsored content covers placement per platform.
Regulatory disclosure. Risk warnings, professional status, jurisdictional limits, and whatever wording your regulator mandates. The hard part on social is that these must be standalone — each post has to comply on its own, because someone will see the reel without ever seeing your bio or the linked page. A promotion that only makes sense alongside a disclaimer on your website is a promotion with a problem. If the required wording will not fit, check our character limits reference before designing the format, and ask whether that platform is the right home for that message.
AI disclosure. This is the new one, and it deserves its own section.
Obligation 3: the EU AI Act transparency rules
If you operate in the EU, or your content reaches people there, the AI Act's transparency obligations in Article 50 are the newest item on the list. They apply to deployers — the organisation using an AI system — so a two-person marketing team with a generative tool is in scope, not just the company that built the model. As of July 2026, those obligations become applicable on 2 August 2026.
Two duties matter for social media:
- Synthetic image, audio and video. If you publish AI-generated or AI-manipulated content that resembles real people, places or events — a deepfake in the Act's sense — you disclose that it is artificially generated or manipulated.
- AI-generated text on matters of public interest. If you publish AI-generated or AI-manipulated text to inform the public on a matter of public interest, you disclose it, unless the content went through human review and a named person or organisation holds editorial responsibility for it.
Read that second duty carefully, because it is narrower than the panic suggests. An ordinary product caption drafted with AI help and edited by a human is not usually "information on a matter of public interest". A public-health explainer from a clinic, or a council post about a policy change, plausibly is. Either way, the human-review-plus-editorial-responsibility route is the approval trail described above — a pleasant coincidence for anyone who already built one.
A separate obligation, applicable since February 2025, asks organisations to ensure staff using AI systems have sufficient AI literacy for their role. For a small team that is not a training programme; it is a written page listing approved tools, permitted uses, and who checks the output. Our AI usage policy template for social media teams covers that, and the labelling side — platform-native AI labels, what to say and where — is in our guide to AI content disclosure on social media. Settle the judgement calls about synthetic faces, voices and testimonials in advance too; those are in AI ethics for social media marketing.
One honest hedge: the Act's timetable has attracted amendment proposals since it entered into force. Confirm the current position for your own obligations rather than trusting any blog post, this one included.
Obligation 4: record-keeping, and where a scheduler stops
The straight answer, because getting this wrong is expensive: SocialKit is not an archiving product. It is a scheduler with an approval step, holding your drafts, approvals, schedule and published posts — which covers review-before-publish well. It does not do compliance capture of inbound comments and DMs, has no unified inbox or moderation queue, and does not produce the tamper-evident, WORM-style archive supervised financial firms are typically required to keep.
If you are a broker-dealer or investment adviser under a supervision regime, you need a dedicated archiving vendor — the compliance-capture category, firms like Smarsh, Global Relay and Proofpoint. That is a real budget line, and I would rather say so than sell a scheduler as a substitute.
| Requirement | Scheduler with approvals | Dedicated archive |
|---|---|---|
| Proof a post was reviewed and by whom | Yes | Usually |
| Copy of what you published, and when | Yes | Yes |
| Capture of comments and DMs you received | No | Yes |
| Capture of edits and deletions as they happen | No | Yes |
| Tamper-evident storage with audit trail | No | Yes |
| Supervision alerts and lexicon flagging | No | Yes |
For firms not under a formal supervision regime — most clinics, most small law firms, most councils, most B2B brands with a nervous legal team — a lightweight retention practice is proportionate and genuinely defensible:
- Pick a retention period and write the number down. Get it from your regulator, not from an average of what tools offer.
- Export monthly. A dated folder per month: a CSV of what published, the media files, and PDF or screenshot captures of the live posts. Fifteen minutes with a coffee.
- Store it somewhere you cannot casually edit. A separate cloud folder with restricted write access and version history, so nobody can quietly rewrite history — including you.
- Keep an index. One row per post: date, platform, content type, approver, live URL, and whether it was later edited or removed and why.
- Log deletions instead of doing them silently. If a post comes down, the record of it does not.
To automate it, SocialKit exposes an API and webhooks on every plan, including Solo. A published-post webhook firing into a Google Sheet, an S3 bucket or your own database keeps that record updating without anyone remembering the export.
Control: access, offboarding and the personal-account problem
The unglamorous failure mode is not a bad post. It is a former contractor who still holds admin rights on the LinkedIn page, or a shared password in a note somewhere.
Minimum viable control: named individual logins rather than a shared account, two-factor authentication everywhere, a documented list of who holds admin rights on each channel, and an offboarding step that removes access on the last day. Review it quarterly — our social media audit checklist includes an access pass, and who-may-do-what is clearer when social media team roles are written down rather than assumed.
Then the personal-account question, which regulated sectors feel hardest. An adviser recommending a product from their own account, a doctor commenting on a patient's public post, a solicitor discussing a live matter — each can be a regulatory event regardless of whose handle it happened on. That belongs in your written social media policy, a governance document distinct from the step-by-step social media SOP that runs the day. Advertising-restricted professions — law firms in particular — need an explicit personal-use section, not a general "use good judgement" line.
Decide in advance what happens when something goes wrong, too: who can pause the queue, who speaks, whether a correction is a new post or an edit. Our social media crisis management guide covers the sequence; the compliance-specific detail is that the correction and its timing are part of the record, so document the decision and not just the fix. This whole bundle is what a policy means when it says social media governance.
Start here: a two-week build
You do not need a project for this. Two focused sessions and a recurring diary entry:
Week 1 — establish the facts.
- Ask your regulator or counsel three questions in writing: what needs pre-approval, what wording promotional posts require, and how long records must be kept.
- List every channel you operate and who holds admin rights on each. Remove anyone who should not be there.
- Pick your retention period and where the archive will live.
Week 2 — build the process.
- Turn on an approval step so nothing publishes without a named reviewer, and set tiers so low-risk posts are not stuck behind the same gate as promotions.
- Put your required disclosure wording into a caption template per platform, so nobody has to remember it.
- Add an AI section to the policy: approved tools, permitted uses, who reviews output, when you label it.
- Run the first monthly export and start the index spreadsheet — or wire up a webhook and let it run.
Then, quarterly: re-read the policy, re-check the access list, spot-check ten archived posts against what is live, and confirm nothing in your regulator's guidance has moved. Book it as a recurring 45-minute block — the practice that survives is the one with a slot, not the one with good intentions.
None of this makes you audit-proof. It does mean that when someone asks who approved a post from fourteen months ago and what it said, you can answer in five minutes — which, for a small regulated firm, is most of the battle.