Most marketing teams can approve a creator post in an afternoon. Some cannot. When the product touches health, money, or an age-restricted category, a single sentence in a caption stops being creative copy and becomes a regulated claim, and the brand that paid for it becomes answerable for it. That is what makes influencer marketing in regulated industries a different job from influencer marketing everywhere else: the creative is quick, the approval is the work.
The scale explains why this stopped being a niche problem. Global influencer marketing spend reached $32.55 billion in 2025, a compound annual growth rate of 33.11% since 2014, according to the Influencer Marketing Hub benchmark data, while independent market forecasts project continued double digit growth for the platform segment. Other trackers put the 2026 figure past $40 billion, and a third dataset counts 86% of U.S. marketers using creator partnerships and $12.17 billion of U.S. spend alone. Creator partnerships are no longer a line item a brand can quietly keep away from compliance.
The audience is already there. Pew Research Center found that 40% of U.S. adults get health and wellness information from influencers or podcasts, a share that nearly doubles among young women. Pew's wider work on where Americans get health information shows medical professionals still lead, and its breakdown of use by race and ethnicity shows the influencer channel is not evenly distributed. Nearly 4 in 10 of the largest wellness creators describe themselves as health care professionals, which is exactly the ambiguity regulators care about: a credentialed voice and an uncredentialed one look identical in a vertical video.
Why regulated influencer marketing is not ordinary influencer marketing
In an unregulated category, the risk of a bad post is reputational. In a regulated one, the risk is legal and it attaches before publication, not after. The FTC's endorsement guide FAQ makes an advertiser responsible for the claims an endorser makes on its behalf, and the agency's plain-language disclosures 101 brochure sets out what a disclosure has to look like. Its endorsements hub collects the guidance and the case history in one place. Legal analysis of the 2023 revisions describes the standard as moving from visible to impossible to miss, with the duty now reaching the advertiser, the endorser, and any intermediary such as an agency or talent manager.
That is the structural difference. In a normal campaign the brand commissions content and hopes it performs. In a regulated campaign the brand is buying both content and evidence: proof that a claim was substantiated, proof that a required warning travelled with the post, proof that someone with authority signed off before it went live. The regulatory research guides that catalogue these obligations now run across several jurisdictions, and practitioner checklists for what brands are actually liable for reach the same conclusion: the campaign file is part of the deliverable.
The longer literature still frames the questions. The mechanics of persuasion that make an endorsement work were mapped in Cialdini's work on influence and revisited for how ideas spread socially in Berger's account of contagious content. The commercial logic underneath the creator economy was described in Wu's history of the attention business and the analysis of surveillance capitalism, while the question of how audiences interpret commercially framed information is older than any platform, as the arguments in Lippmann on public opinion and Le Bon on crowd behaviour still show.
For regulated teams the useful shelf is the practical legal one. Reference texts on advertising and public relations law, social media law for business, and advertising and marketing law in Canada were written before the creator stack existed and remain the reference for substantiation and disclosure duties. Practice guides such as digital marketing strategy supply the operational frame, and the older literature on consumption, ethics and collective decision making, from Veblen on conspicuous consumption to Mill on liberty, Mill on utilitarianism, Russell on the limits of certainty, and Machiavelli on counsel and power, keeps resurfacing in policy arguments about how far commercial persuasion should reach.
The three regulatory regimes that shape a creator campaign
The first mistake is treating regulated as one thing. It is at least three, and each regime controls a different part of the post. National regimes also disagree with each other, which is why policy bodies have started publishing comparative standards work on influencer advertising and industry bodies maintain an international code of advertising practice as a baseline that predates digital channels.
Health and wellness regulation controls what may be claimed. A product that is not an authorised medicine or a registered medical device cannot imply that it diagnoses, treats, prevents, or cures a condition, no matter how the claim is dressed up. Lawyers tracking UK enforcement describe the Advertising Standards Authority drawing a hard line on medicinal claims, including claims made through creator content and user-generated reviews, and a review of wellness device rulings shows how quickly a cosmetic benefit claim slides into medicinal territory once a specific condition is named. The regulator's own rulings database and its influencer guide are the reference documents behind those decisions.
Financial regulation controls who may communicate and what must be kept. An unauthorised person communicating an invitation to invest can be a criminal matter in some jurisdictions, and firms are responsible for promotions they cause to be made even when a third party pressed publish. The U.S. regulator for broker communications has been explicit that firms must supervise and retain influencer content, a point it enforced in a multi-million dollar action that included failure to supervise paid creator communications. European supervisors are working the same problem through ESMA guidance, and national competition authorities such as Italy's AGCM pursue misleading commercial practices that reach creator content.
Age-restricted regulation controls who sees the content. In the UK, regulators published compliance principles for platforms on hidden advertising and expect audience targeting to be verifiable, and the competition authority's work on social media endorsements treats an inaccurate audience claim as its own problem. Analysis of UK enforcement notes that the regulator holds brands responsible for content published on their behalf, and industry bodies summarise the same hidden advertising position for members. National guidance also varies by market and by wording, which is why cross-border disclosure tables now name the accepted language for each country rather than assuming one hashtag works everywhere.
Health claims: the line creators cannot see
Regulatory experts who work with pharmaceutical marketers describe a recurring misunderstanding: a creator paid by a health brand is treated as speaking on the company's behalf, which means the ordinary rules of promotion apply to them. Claims must stay inside the approved labelling, the indication has to be stated accurately rather than paraphrased, and a before-and-after visual can itself be read as a claim. Specialist consultancies argue that sponsors cannot assume creators understand any of this and should build training and pre-approved talking points into the campaign itself.
Academic work on patient influencers made the same point years ago: health marketing through lived experience is persuasive precisely because it looks editorial, and that is why researchers called for more scrutiny rather than less. A review of patient influencers in direct-to-consumer promotion documented how quickly the boundary between personal experience and commercial message blurs, a scoping review of health-related communication by influencers found misinformation to be a systematically under-studied area, and a public health review of social media and misinformation spread frames the problem as one that needs action from creators, companies, and regulators together. The wider literature on online influencer marketing explains why the format is so effective, which is exactly what makes an unchecked claim so costly. A companion piece in the same journal argues that responding to the problem needs work on the information environment itself, not only on individual creators.
The enforcement record is not theoretical. Regulators have issued warning letters over creator posts that presented benefits without any risk information, and legal commentary on those cases explains that a risk statement buried at the very end of a video is treated as effectively absent. A later action against a biopharma company went further and treated a founder's podcast appearance as promotional material, which is the clearest signal yet that conversational formats do not sit outside the promotional perimeter. Supplement sellers have been warned in parallel by the two agencies that share the space, as this joint FTC and FDA warning letters on supplement claims shows, and a series of warning letters to supplement companies shows the claim categories that draw action.
Regulators outside the United States work the same seam. A public health warning on supplements marketed therapeutically and a separate warning on an unregistered supplement both turn on the same idea: a product that is not a medicine cannot be promoted as one, whatever the channel. Regulatory inspection records from manufacturing enforcement add a second layer, with current good manufacturing practice findings showing that claim compliance and product compliance are audited by the same agency.
Fair balance, the requirement creators never see coming
Fair balance is the single hardest obligation to transfer to a creator because it runs against everything that makes short-form content work. A post has to convey the benefit and the risk with comparable prominence. In practice that means the risk information has to appear in the same asset, at the same moment, in a format a viewer will actually absorb, and legal analysis of the guidance warns that a link to safety information cannot substitute for the disclosure inside the post. Guidance for healthcare campaigns is equally direct that pre-approval is the norm and that teams should budget two to four weeks of medical, legal, and regulatory review into the timeline. Templates designed for pharma creator governance put the same review requirement at the centre of the workflow, with disclosure standards, approval records, and monitoring treated as one system.
This is where most campaign calendars break. A review window measured in weeks does not fit a publishing plan built around a single day, and the temptation is to shorten the review instead of the plan. Teams that do the opposite, running compliance and creative review in parallel rather than in sequence, report that approvals move faster without the claims getting looser. That sequencing discipline is the same one described in playbooks for regulated industry creator campaigns, where the review order matters more than the review depth.
Financial posts: when a caption becomes a financial promotion
Financial content has a different failure mode. The question is not only what the post claims but whether the person posting it was allowed to say it. Commentary on the UK regime explains that a communication which invites or induces investment activity must be made or approved by an authorised firm, that causing a communication to be made counts as communicating it, and that an unauthorised promotion can be a criminal offence. Regulators have run coordinated weeks of action against illegal financial promotions, pairing arrests with hundreds of takedown requests, and coverage of that enforcement describes how firms answer for what their affiliates post whether or not they wrote a word of it. The same analysis notes that some jurisdictions have moved from warnings to mandatory registration and licensing requirements for creators who publish financial recommendations.
The academic picture is not flattering either. A discussion paper on financial influencers analysed tweet-level data from a large stock-picking platform and found that most finfluencers were unskilled or actively harmful, producing negative abnormal returns, while the least skilled were the most engaging and attracted the largest followings. A study of finfluencer recommendations and consumer outcomes reached a compatible conclusion: influencers tend to recommend assets that already performed well, and returns after the recommendation are typically negative. A quality framework for finfluencer partnerships in the Journal of Financial Services Marketing exists because brands needed a way to select credible creators before the regulator selected them, and research on endorsement, trust, and purchase intention explains why audience confidence in a creator does not transfer into reliability of the underlying advice.
Age-restricted categories: audience is the compliance object
For alcohol, gambling, and other restricted categories, the regulator cares less about wording and more about reach. Marketing codes in several markets require the overwhelming majority of an audience to be of legal age, which turns audience analytics into a compliance artifact rather than a reporting nice-to-have. Recent platform accountability settlements have made the same point from a different direction, with default age-based restrictions reshaping how much of a young audience a campaign can structurally reach.
That requirement is awkward for creator partnerships because a creator's audience composition is not something the brand controls and is rarely static. The practical answer is to verify demographics before the brief is written, not after the content is live.
Disclosure was never the whole job
Regulated industries tend to over-invest in disclosure because it is the visible obligation. It is also the smallest one. A clear disclosure tells an audience that a post is paid. It does nothing about whether the claim was lawful, whether the risk information was adequate, or whether the post should have been published to that audience at all. The research literature on source credibility and endorsement effects and on the effects of disclosing sponsored content has been consistent on this for years: disclosure changes how an audience reads a message, not whether the message was appropriate to send.
Later work sharpened the mechanism. A large-scale analysis published in Electronic Markets found that disclosed advertising gathers less engagement in the short run, while undisclosed advertising has a persistent negative effect on future engagement with the same creator's organic posts, because audiences read concealment as a credibility signal. Field experiments on optimal disclosure strategy found that the best-performing approach for both brand and creator was a genuine recommendation with an impartiality label rather than a hard sell with a legal footnote, and that the wrong combination reduced trustworthiness among a creator's own followers. A review of message value and credibility in branded content reaches the same place from the consumer psychology side.
That finding has a compliance edge. In a regulated category, the moment a brand insists on message control, the content stops looking like a genuine recommendation and starts looking like an advertisement with a creator attached. The audience reads it differently, and so does a regulator assessing whether the brand directed the claim.
Brand-directed liability is the pattern worth internalising
The clearest trend across jurisdictions is that liability moves toward the party with control. If a brand writes the brief, approves the draft, and pays on performance, it had the ability to catch a problem. Regulatory commentary describes a shift in which most recent enforcement actions name the brand rather than the creator, and analyses of the FTC approach stress that brands are expected to give written guidance, monitor content, take corrective action, and keep documentation proving they did. Case commentary on the earliest warning letters made the same point years ago, when the agency put both companies and influencers on notice at the same time.
Contract language does not transfer that exposure. Delegating disclosure duty to a creator creates a paper trail showing the brand asked for the right thing, which is useful, but it does not move the regulatory obligation. Guides written for brands explain this in plain terms: the material connection must be disclosed by the party with the relationship, and the brand still owns the consequence. The distinction matters most in categories where consumer harm is concrete: health claims, financial products, and children's content.
What enforcement actually looks like in practice
The record is dominated by brands that were not trying to deceive anyone. A review of consumer review enforcement describes the FTC's first warning letters under the rule on reviews and testimonials, and a follow-up analysis by a second firm traced how those letters, published quietly months later, revealed the agency's first enforcement focus: incentives offered in exchange for positive reviews, in services that are consequential to people's lives. The rule itself is set out in the agency's guidance for marketers on paid reviews, and commentary on the agency's wider enforcement posture traces the move from warning letters to consent decrees that carry ongoing obligations.
Advertising disclosure is not the only front. Regulators are also moving on paid political content, with state level measures that give electoral commissions direct authority to fine undisclosed sponsored posts, which puts a second regulator inside the same creator campaign file.
Health and wellness keeps appearing because the harm is easy to articulate. Regulators have acted against supplements marketed as treatments, against diagnostic claims made for products that were never authorised to make them, and against weight-loss promotions that put prescription medicines in front of the general public through affiliate codes. Coverage of one ruling shows a brand ending its influencer programme entirely after an affiliate code arrangement tipped it into promoting a regulated medicine. A separate review of beauty and wellness enforcement shows that even a filtered creator repost can be ruled misleading, and that repeating a customer's testimonial does not make it substantiated.
A third pattern runs through the case law: enforcement follows the operator. Consumer protection lawyers writing on cross border enforcement describe how the same conduct can be pursued under consumer protection law in one market and advertising codes in another, which is why multinational campaigns need a jurisdiction map rather than a single disclosure rule.
The four failure patterns that keep repeating
Strip away the categories and the same four mistakes show up.
No pre-publication review. A creator publishes, the brand discovers it afterwards, and there is no record that anyone checked the claim. Legal summaries of influencer programmes describe pre-approval and monitoring duties as baseline expectations rather than best practice.
Borrowed claims. A creator restates a study headline the brand itself never used in its own advertising, at a dose or population the study never covered. Guidance on compliance for consumer brands is explicit that a study on one ingredient at one dose does not validate a claim for a finished product, and that unsubstantiated claims in creator posts can be inherited by the brand.
Disclosure that exists but cannot be seen. A tag in a settings panel, a phrase in the last line of a caption, a spoken mention at the eight-minute mark. Reviews of repeated enforcement show the same fixes being prescribed again and again: unambiguous language in the right place, matched to the format, and repeated in live formats. Format-specific guidance reaches identical conclusions for video sponsorships and for brand campaigns with creator partners.
Nothing in the file. The campaign ran, the content was taken down, and there is no archive showing what was approved, by whom, on what basis. Analysis of the practical workflow argues that informal approvals do not survive an investigation and that documented review is the difference between a programme and an exposure. Practitioner threads in marketing communities describe the same problem from the inside, with one marketer describing how fast a campaign became a legal problem and another asking how to keep legal review from stalling every launch.
The vetting layer regulated teams keep skipping
Standard creator vetting checks audience quality, engagement, and brand fit. Regulated categories need a second layer on top, because a creator's history is a preview of the claim they will write next.
Start with a longer content audit. Twelve months is a reasonable window, and the questions are specific: has this creator made health outcome claims, predicted investment performance, or promoted a category that conflicts with the campaign? Regulatory literacy comes next, and it does not require an examination. A short call walking through scenarios, such as what the creator would say if a follower asked about side effects in the comments, reveals more than a test. Audience composition is non-negotiable for restricted categories, and coverage of the regulated industry vetting framework shows why brands cannot take a creator's self-reported demographic split at face value. Guidance on influencer due diligence in healthcare adds the step most teams miss: checking a creator's professional claims before treating their credentials as a compliance asset.
The discovery problem compounds this in regulated categories, because the creator who looks best on engagement is rarely the one with the cleanest claim history. Platforms that combine discovery with a documented relationship record make the audit cheaper: Infmap keeps each creator's profile, deal history, and deliverables in one place, which means the vetting evidence is a record rather than a research project repeated every quarter. That profile-first model is the same one described in discussions of managing creator content at scale, where the advice is consistently to centralise review rather than to add reviewers.
A review workflow legal will not fight
The review process is where regulated influencer marketing usually fails, not because anyone disagrees about the rules but because the sequence is wrong. The default flow, creator drafts, legal reviews, marketing relays, creator revises, routinely burns two to three weeks and a lot of creator goodwill on a single post.
Three changes fix most of it. Brief legal before the creator sees anything, so the no-go zones are defined while the concept is still a paragraph rather than a filmed asset. Give creators a checklist rather than a script, because guardrails preserve a voice and scripts destroy it. Run the compliance review and the creative review in parallel, with legal checking claims and warnings while marketing checks tone and quality. Workflow guides designed for creator content approval make the same argument: review stages that run in sequence, with a human relay in the middle, are the bottleneck. Guides to compliance monitoring across channels and to AI-assisted marketing compliance push the same principle further, treating pre-publication validation and post-publication monitoring as two halves of one control.
The platform layer matters too, because most of the mechanics of disclosure now live in product settings. Creator facing resources such as the creator academy guidance on branded content and platform marketing resources from Google's creator marketing team describe the built in disclosure controls, and social media management vendors publish their own compliance walkthroughs for teams running creator programmes, including practical guidance on influencer disclosure and campaign management at scale. Practice guides for creators and brands reach the same operational conclusions from different angles, whether the focus is legal requirements for video creators, disclosure rules that span formats, an interview with the regulator's own regional director, or general guidelines aimed at brands and creators. Cross border teams add one more layer, since jurisdiction specific rules and affiliate disclosure obligations do not always point the same way, and a general marketing compliance checklist is a reasonable template for the internal control that catches the gaps.
For always-on partnerships there is a further shortcut. Once a claim has been approved in a specific framing, it can be reused without re-review, which is how long-running ambassador programmes keep both compliance and velocity. Documented approval is what makes that reuse safe, and it is the same reason the contract file matters as much as the content file. It is also why compensation structure belongs in the same review as compliance, since performance based payment is itself evidence of direction. Marketing approval workflows designed for regulated teams reach a similar conclusion, arguing that templated content should skip brand review while only the variables get checked, which is exactly the pre-approved framing idea applied to a creator programme. Teams that have to document the review layer for auditors often buy rather than build it, and vendor comparisons of campaign management systems for regulated sectors list multi-stakeholder approval routing and audit trails as the features that decide the purchase.
Quick quiz: how well do you know the regulated playbook?
Answer from instinct, then check yourself.
1. A creator you paid posts a balanced, accurate video but puts the required risk information in the caption only. Compliant?
- A. Yes, the information is present in the post
- B. Yes, as long as the disclosure tag is enabled
- C. No, the risk information has to travel with the claim itself
Reveal the answer
The answer is C. Fair balance means the benefit and the risk appear with comparable prominence in the same asset. A description that most viewers never open does not carry the risk information, and neither does a platform label on its own.
2. A creator with a clean record makes an unapproved claim in a comment under their own sponsored post. Whose problem is it?
- A. The creator's, since the comment is not part of the brief
- B. The brand's, because it commissioned the content and had the ability to catch it
- C. Nobody's, because comments are user-generated content
Reveal the answer
The answer is B in practice. Liability follows control. A brand that briefs, approves, and pays for content is treated as having had the ability to monitor it, and comments under a sponsored post are part of the asset that gets reviewed.
3. Your campaign is documented, reviewed, and compliant. What are you still missing?
- A. Nothing, if nothing went wrong
- B. A record of who approved what, when, and against which rule
- C. A longer disclaimer
Reveal the answer
The answer is B. When a regulator or a plaintiff asks, the question is not whether the campaign felt careful. It is whether you can produce the approval chain, the brief, and the live asset with its disclosure visible. Platforms that keep the deal, the brief, and the approved deliverable in one place turn that scramble into an export.
The contract clauses that carry the weight
Regulated campaigns need standard clauses plus a handful that ordinary creator agreements leave out. The first is a compliance obligation that names the specific conduct: disclosure format per channel, the claims the creator may and may not make, mandatory pre-publication submission, and record retention for a defined period. Making a breach of those terms a material breach is what gives the clause teeth.
The second is a pre-publication review right. It sounds obvious and it is frequently missing, because most template agreements assume the creator owns the edit. In a regulated category the brand needs the right to see the asset before it is live and to require changes for compliance reasons rather than creative ones.
The third is a clean allocation of liability. Most brands carry primary responsibility for compliance review, and the creator indemnifies the brand for what the creator does outside the approved version: publishing a draft, adding an unapproved claim in a comment, editing the caption after approval. The fourth is a termination right specific to compliance, without a long cure period, because a non-compliant post that stays live keeps generating exposure. The fifth is retention and audit cooperation, which is not optional in a supervised category. Legal commentary on creator agreements consistently places these clauses alongside scope, usage rights, and indemnification as the non-negotiable set.
Records, retention, and the audit you cannot improvise
Every regime discussed here converges on the same demand: produce the file. Supervised financial firms must retain public communications for defined periods. Health campaigns need the substantiation behind every claim. Restricted categories need audience evidence. Consumer protection regulators want the approval chain and the live asset.
What a compliant campaign file actually contains
Retention is where informal processes collapse. Screenshots saved to a personal drive, approvals buried in a chat thread, and captions edited after sign-off all fail the same test, because none of them reconstruct what was actually published at the moment it mattered. A campaign file that holds the brief, the approved version, the published version, the disclosure as rendered, and the approval timestamp answers the question in one pass.
This is also where a platform record beats a spreadsheet. Infmap structures each deal as a record with deliverables, approvals, and payment in one workflow, so the audit trail is a by-product of running the campaign rather than a project that starts the week a regulator calls. A public creator profile with performance data also makes the pre-campaign evaluation auditable, which is the piece regulators ask about first. The same structure is what makes a precise brief enforceable, because the brief and the approved content sit next to each other instead of in two different inboxes. The same file is what separates a campaign that failed from a campaign that failed for a diagnosable reason.
What this changes about how brands talk to creators
The uncomfortable truth about regulated influencer marketing is that the instinct which makes content work is the instinct that creates the risk. Creators perform when they sound like themselves. Regulators evaluate whether what they said stays inside the label. The resolution is not to script the creator into a press release, which kills performance and pushes the message toward the hard sell pattern that research shows damages creator credibility.
The resolution is to move the constraints earlier and make them explicit. A creator who knows before filming that they cannot promise a health outcome, cannot predict a return, and cannot skip the risk line writes better content than one who discovers those limits during a review cycle. In practice this means the brief carries the constraints, the review checks them, and the record proves it happened. Practitioner discussions in creator communities describe the same thing from the other side, with marketers asking how to handle claim review for creator content without turning every post into a negotiation, and operators in influencer marketing communities comparing notes on how to recover when a partnership goes wrong after publication.
Where influencer marketing in regulated industries goes next
Two forces are pushing the same direction. The first is automated enforcement. Consumer protection regulators now describe machine learning tools that scan advertising at scale rather than waiting for complaints, which means the campaigns that were never reviewed are the ones most likely to be found. A large scale study of affiliate marketing compliance analysed two million videos and found that disclosure compliance remained low across a decade of content, with platform level disclosure features the single most effective lever. Research on commercial content reaching younger audiences found that nearly half the videos examined failed to use the platform's own disclosure mechanism, which is exactly the gap automated scanning is built to close. Academic analysis of regulatory frameworks and benchmarks for influencer marketing argues that the current rules still leave cognitive biases exploitable in the digital marketplace, which is a polite way of saying enforcement has room to grow.
The second is synthetic content. New transparency rules require AI generated or AI modified content to be labelled, and compliance guides for creator campaigns now treat AI disclosure as a documented verification step rather than a statement of intent. Quarterly regulatory tracking for creator rules across the EU, UK, US and Asia shows how many separate deadlines now fall inside a single campaign year. For regulated categories this stacks on top of everything else: a synthetic claim needs both the AI label and the substantiation, and a synthetic audience needs verification that the people watching exist.
The wider climate is hardening in a way that makes compliance infrastructure a commercial asset rather than a cost centre. Analysis of the creator economy's regulatory shift argues that brands whose growth depends on unrestricted access to young audiences now need audience verification and outcome reporting that most have not built, and that the brands adapting fastest have moved from campaign thinking to systems thinking. A quarterly legal brief, run against contracts, creative approvals, and live assets, is the cheapest version of that system, and the industry watchlists that track influencer regulation across markets are a reasonable starting point for building one. Even the tools creators use are part of the picture, since AI features inside editing and optimisation workflows are themselves being pulled into disclosure and authenticity debates.
Ten questions to ask before the next regulated campaign
If you take nothing else from this, take the checklist.
Does the campaign have a named compliance owner, or is it everyone's job. Which regime applies, and what does it regulate: the claim, the communicator, or the audience. Which specific words are prohibited, and are they written into the brief. What risk information must appear, in which asset, and how prominently. Who reviews before publication, and is that review logged. What is the retention period, and where does the file live. How will disclosure render in each format, including shortened captions and live content. What evidence proves the audience was appropriate. What happens when a creator deviates, and who is contractually responsible. When did the file last get audited against current rules.
Influencer marketing in regulated industries is not harder because the rules are secret. It is harder because the work is unglamorous: briefs that constrain, reviews that document, and records nobody wants to maintain until the day they are the only thing that matters. Brands that treat that work as part of the product, rather than as an obstacle to the campaign, are the ones that keep running creator partnerships in categories where everyone else eventually stops.
If you are rebuilding this process, start with the file. Get started with Infmap and run the deal, the brief, the approval, and the payment in one place, so the evidence exists before anyone asks for it.