Why Your AI-Written Medicare Ad Might Violate CMS Rules

The post that almost went out

Picture the ordinary version of this. It's a Tuesday night, AEP is six weeks out, and an agency owner needs a Facebook post about their Medicare Advantage lineup before the morning. They open ChatGPT, type something like "write a Facebook post promoting our Medicare Advantage plans for open enrollment," and get back three tight paragraphs in under ten seconds. The copy is clean, upbeat, and reads like something a marketing agency would charge four hundred dollars for. It says the plans are "the best options available in your area" and closes with "enroll today before it's too late."

Nothing about that moment feels risky. The owner isn't cutting corners, they're using a tool that every productivity article this year told them to use. The problem is that the sentence "the best options available in your area" is not a stylistic choice a marketing professional would flag and soften. It's a specific violation of a specific federal rule that governs exactly this kind of material, and the post is missing a second required element entirely: the disclaimer CMS mandates on any Medicare marketing material produced by a third party marketing organization, worded a very particular way, that isn't optional and isn't something a general purpose writing tool has ever seen unless someone tells it to include it.

This isn't a piece about whether AI tools belong in an insurance agency. They clearly already are: 68 percent of independent agents say they plan to increase their AI use in the next 12 months, according to the Big "I" Agents Council for Technology's 2026 Tech Trends Report, published February 19, 2026⁷. It's a piece about the specific, narrow, and very fixable gap between what a general purpose AI tool produces by default and what federal Medicare marketing regulation actually requires, and about the fact that the agent's name, not the AI company's, is the one CMS's own rules attach liability to.

What a TPMO actually is, and why it probably includes you

Every rule in this piece hangs on one term, and it's worth defining precisely because agents routinely assume it applies to somebody bigger than them. Under 42 CFR 422.2260, a third party marketing organization, TPMO, means "organizations and individuals, including independent agents and brokers, who are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment," meaning the steps a beneficiary takes from becoming aware of a plan to making an enrollment decision¹. TPMOs can be a first tier, downstream, or related entity under the plan's contract, but the definition explicitly also reaches "entities that are not FDRs but provide services to an MA plan or an MA plan's FDR"¹.

Read that definition slowly and notice what it does not require: a minimum agency size, a minimum number of employees, or a formal marketing department. A single licensed agent taking commission on Medicare Advantage enrollments, who posts on their own Facebook page or sends their own text blast, is performing marketing and enrollment related functions in the chain of enrollment for compensation. That is the definition. There is no carve out in the regulatory text for "just one person."

This matters for the AI question specifically because it means the rule follows the person, not the payroll. An agent who drafts their own copy with an AI assistant is still the TPMO. Nothing about typing a prompt instead of a paragraph changes who CMS's regulation is looking at when it asks whether the material complied.

The disclaimer a generic AI tool cannot write correctly

CMS requires a specific, standardized disclaimer on Medicare marketing material produced by a TPMO, and the regulation gives the exact wording rather than a general instruction to "disclose your relationship." Under 42 CFR 422.2267(e)(41), verified live against the current electronic Code of Federal Regulations, a TPMO that does not sell for every MA organization in its service area must use this exact disclaimer: "We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options"². A TPMO that does sell for every MA organization in its area uses a shorter variant instead².

The regulation doesn't stop at the wording. It also specifies where the disclaimer has to appear: it must be used by any TPMO selling plans on behalf of more than one MA organization, prominently displayed on TPMO websites, and "included in any marketing materials, including print materials and television advertisements, developed, used or distributed by the TPMO"². There is no social media exemption in that list. A Facebook post is a marketing material developed and distributed by the TPMO, and it needs the disclaimer exactly as much as a printed flyer does.

The words that turn a draft into a violation

The disclaimer is a structural requirement, easy to check for because it's either present or it isn't. The content rules are less mechanical and exactly where an AI draft tends to fail quietly. Under 42 CFR 422.2262, "MA organizations may not mislead, confuse, or provide materially inaccurate information to current or potential enrollees"³, and a related provision bars organizations from engaging in "activities that could mislead or confuse Medicare beneficiaries, or misrepresent the MA organization"³. Comparisons to other plans are only permitted when "the information is accurate, not misleading, and can be supported by the MA organization making the comparison"³.

This is exactly the register a general purpose AI writing tool operates in by default, because persuasive superlatives are what makes marketing copy read well everywhere else in the economy. "Best," "guaranteed," "the top rated plan in your area," "every plan we offer includes," these are the phrases a model reaches for because they're rhetorically strong, not because it evaluated whether they're defensible under a specific comparison rule. An AI tool doesn't know it needs support for a comparative claim. It just knows the sentence sounds confident, which is what you asked for.

Who is liable when AI writes it

The regulation is explicit about where responsibility sits, and it was written years before generative AI tools were part of an agent's workflow, which means it draws no distinction between a human-typed draft and an AI-assisted one. Under 42 CFR 422.2264(g), when an MA organization does business with a TPMO, either directly or indirectly through a downstream entity, it must implement TPMO oversight, and "when a TPMO is not otherwise an FDR, the MA organization is responsible for ensuring that the TPMO adheres to any requirements that apply to the MA plan"⁴. Contracts between the TPMO and the MA plan must ensure the TPMO "uses the TPMO disclaimer as required under §422.2267(e)(41)"⁴.

Read plainly, the oversight chain runs: CMS holds the MA organization accountable, the MA organization holds the TPMO accountable through contract, and the TPMO, remember, is defined broadly enough to include a solo commissioned agent, is the one who actually produced or distributed the material. Nowhere in that chain is there a branch for "an AI tool generated the noncompliant sentence." The software that assembled the words has no contractual relationship with the MA organization and no compliance obligation under the regulation. The person who published it does.

There's a second, quieter requirement worth knowing here too. Under 42 CFR 422.2261, "MA organizations must submit all marketing materials, all election forms, and certain designated communications materials for CMS review," through the HPMS Marketing Module, which is "the primary system of record for the collection, review, and storage of materials that must be submitted for review"⁵. Materials developed by a TPMO for multiple MA organizations get submitted by the TPMO itself, with prior review noted for each organization it's submitted on behalf of⁵. An AI-drafted post that skips this submission step entirely, because nobody thought to route a "quick Facebook post" through the same review process as a printed brochure, is out of compliance before anyone even reads the copy for banned phrases.

It's worth sitting with why the regulation is built this way instead of assuming it's bureaucratic excess. CMS oversees a program where a confusing or misleading marketing claim doesn't just cost a beneficiary money, it can put someone into a plan that doesn't cover their actual doctors or drugs, discovered months later at a pharmacy counter or a specialist's office. The oversight chain running from CMS to the MA organization to the TPMO exists because that's the only structure that puts a specific accountable party behind every piece of marketing a beneficiary sees. An AI tool sitting outside that chain entirely, with no license, no contract, and no enrollment obligation, is precisely why the regulation was never going to route liability through it.

What it costs

The penalty structure for exactly this failure mode, materially inaccurate or misrepresented marketing information, is written into the regulation with a specific dollar ceiling, not a vague warning. Under 42 CFR 422.752, CMS or the HHS Office of Inspector General may impose civil money penalties "of not more than $25,000 as adjusted annually under 45 CFR part 102 for each determination made" for the deficiencies listed under §422.752(a), which include an MA organization that "misrepresents or falsifies information that it furnishes... to an individual or to any other entity"⁶. For a determination made specifically under that misrepresentation provision, the penalty structure adds "an assessment of not more than the amount claimed by such plan or MA organization based upon the misrepresentation or falsified information involved," on top of the base penalty⁶.

Read that carefully: $25,000 is a per-determination base figure that adjusts upward every year under the federal inflation adjustment schedule, and it's not the ceiling on total exposure. A single piece of marketing material distributed to a mailing list, or run as a Facebook ad reaching a targeted audience, can generate a separate determination for each beneficiary it reached with materially inaccurate information, which is exactly the mechanism that turns a five minute AI-drafted post into a five figure or six figure exposure if CMS treats the reach as multiple determinations rather than one.

Put actual arithmetic on it so the shape of the exposure is concrete rather than abstract. Take the base $25,000 figure and the misrepresentation provision's doubling language literally, and a single determination involving falsified or misrepresented plan information could carry an assessment on top of the base penalty, not a fixed multiplier CMS states as a round number, but "not more than the amount claimed" by the plan tied to that misrepresentation⁶. Now multiply by determinations rather than posts. A boosted Facebook ad that ran for two weeks and reached several thousand accounts is not automatically one violation just because it was one piece of creative. If CMS or the OIG treats the beneficiaries who saw and acted on it as separate determinations, the math stops resembling a single fine and starts resembling a payroll-sized number for a sentence that took an AI tool four seconds to generate and nobody spent thirty seconds reading against the actual rule before it went live.

The checklist: run every AI draft through this before it posts

None of this requires abandoning AI tools or hiring a compliance attorney to review a Facebook caption. It requires a short, repeatable checklist between the AI draft and the publish button, and a disciplined agent can build this habit in an afternoon.

Check for the disclaimer first, not last. If the material is marketing, meaning it names a plan or is designed to draw a beneficiary toward enrollment, it needs the exact TPMO disclaimer language under 422.2267(e)(41), with your real numbers filled in for the organizations and plans you represent². Keep the two disclaimer variants saved somewhere you can paste from, so this becomes a copy-paste step, not a rewrite step, every single time.

Read every draft for the four words that cause the most trouble: best, guaranteed, every, and free. Each one maps to a specific rule. "Best" and "guaranteed" are unsupported superlatives unless you can substantiate them against a specific, named comparison. "Every" plan or carrier is an overclaim unless it's literally true and matches your disclaimer. "Free" needs a second look at whatever it's describing, since $0 premium is not the same claim as no cost to the beneficiary at all.

Ask whether the post would survive without the enthusiasm. Strip out the adjectives and superlatives and see what's left. If a plain, factual version of the sentence still works, that's the version to publish. If removing the enthusiasm leaves nothing but a vague feeling, the original claim probably wasn't specific enough to be defensible in the first place.

Route it through the same submission process as everything else. If your agency submits marketing materials to CMS through HPMS, an AI-drafted social post is marketing material under the same rule as a brochure, and skipping the submission step because it "was just a quick post" is the gap that turns a content mistake into a process failure⁵.

Keep a standing prompt, not a one-off request. Instead of asking a general AI tool to "write a Facebook post," give it your actual constraints every time: your real number of represented organizations and plans, an instruction to avoid superlative language, and a reminder to leave a placeholder for your compliance team to insert the disclaimer. A model does markedly better against rules you actually gave it than rules it's supposed to infer.

How we build content that's compliant by construction

The reason a generic AI tool drifts toward "best plan in your area" is that it's optimizing for confident, persuasive language with nothing anchoring it to a checkable fact. The fix we build into every piece of content we publish for an agency is the opposite habit: every figure, every claim, comes from a primary source fetched in the same session it's written, with the source and the date stated inline. That single habit does two things at once. It's the sourcing discipline that earns AI citation, and it's also structurally incompatible with an unsupported superlative, because "the best plan" has no source to cite, and a piece built around cited claims never reaches for it.

This is what our blog posting and content cadence service actually delivers for an agency, FMO, or IMO running one site or several: a real publishing schedule, Digital Foundation's Pro tier adds one new blog post and one new location page every week, and Scale publishes a new post every business day, 20 to 22 a month, with every number traceable to where it came from rather than drafted from a general purpose tool with no knowledge of your compliance obligations. Verified against the live service page on September 13, 2026⁸.

For agencies that want custom AI tooling built around their own compliance workflow, an intake form that routes drafts to a reviewer before publishing, or a prompt library built around your specific state and carrier mix, that's scoped and priced on a strategy call through our AI Expert program, built on your own accounts and domain, and you own what gets built⁹.

What you get

Concretely, an agency that treats this correctly gets marketing content that doesn't need a last-minute compliance scramble before it posts, because the checklist runs the same way every time instead of depending on whoever happened to be drafting that week. It gets a publishing cadence built on cited, checkable claims instead of confident sounding filler, which happens to be the exact quality answer engines reward when deciding what to cite. And it gets fewer moments where a fast Tuesday-night post turns into a compliance conversation nobody wanted to have during AEP. None of that is a promise about avoiding every possible CMS inquiry, and we're not going to pretend it is. It's a process decision about whether your content workflow has a compliance step built in, or is hoping the tool that drafted it happened to know rules it was never given.

Does this apply to ACA and life insurance too?

The specific citations in this piece, the TPMO definition, the exact disclaimer wording, the HPMS submission rule, and the $25,000 per-determination penalty, come from Title 42, Chapter IV, Subchapter B, Part 422, which governs Medicare Advantage specifically. ACA marketplace marketing operates under its own separate set of rules, and life insurance marketing is regulated primarily at the state level, with no federal TPMO disclaimer requirement attached to it. If your book is entirely ACA or life, the specific citations above don't apply directly to you.

The reason this matters for a mixed book is that most agencies aren't entirely one line of business. An agent who writes Medicare Advantage alongside ACA and final expense plans has to know which rule governs which piece of content before they hand a prompt to an AI tool, because the tool itself has no idea which regulatory bucket it's writing into. It will draft a Medicare post and an ACA post in the same confident tone, using the same kind of persuasive language, with no internal flag that one of the two carries a federal disclaimer requirement the other doesn't. That distinction has to live in your own process, not in the software.

What does carry over is the underlying pattern, and it's worth taking seriously regardless of your line of business: a general purpose AI writing tool has no built-in awareness of whatever specific compliance framework governs your marketing, whether that's CMS's Medicare rules, a state insurance department's advertising regulations for life products, or FTC truth-in-advertising standards that apply to every industry without exception. The checklist habit, strip the draft down to what you can actually support, check it against the rules that specifically govern your line of business, before it posts, holds regardless of which regulator you're answering to.

Questions agents ask