Updated Oct 2026
How compliance review actually works
When compliance review is on, PostSignOff checks each post’s words against a set of marketing rules picked for your brand. This page explains what that check does and where it stops. It also explains why your judgment, not the checker’s, is the thing that counts. For the clicks, see Run a compliance check before approving.
A pack is a set of rules for one industry
Compliance review is set up per brand. When you turn on Enable compliance review before approval, you pick a compliance pack. A pack is a set of rules built from one industry’s marketing laws. Today there’s one: Medicare (CMS marketing rules). It’s also the pack that applies if the list of packs can’t load.
A brand can add its own custom rules on top. Right now, though, a problem that breaks only a custom rule never shows up as a finding. So don’t count on custom rules to catch anything yet.
A pack isn’t a legal opinion. It’s a written reading of a rulebook. And it’s applied the same way to every post your brand makes.
What the check reads
The check reads the post’s text: the body, the sign-off, and the hashtags. That’s all it gets.
That limit matters as much as anything inside it. The checker never sees an image or video you attach. It doesn’t open the page a link points to. It can’t see the comments after a post goes out. If a claim lives in a picture or on a page you link to, the check won’t catch it. Your own review has to.
An AI model does the reading. PostSignOff then checks the AI’s work. Each finding the AI reports has to match a rule in the pack. It also has to quote your post word for word. If the quote isn’t really in your post, the finding is dropped.
When the check runs
Nobody has to remember to run it. It runs when AI writes a post, when you save an edit, and when you approve. You can also start it yourself with Analyze.
Approving is the one that matters. Approve always checks the text as it reads right now before it lets a post through. So an approved post has always passed a check, or had its findings acknowledged. If you edit a post after it’s approved, it goes back to Needs approval and has to clear the check again.
How findings are graded
Every finding has a severity: info, warning, or high. The pack tells
the checker how to pick one. high is for a clear break of a rule. warning
is for a close call that a compliance pro should look at. info is for a
note about style. A missing disclaimer is always high.
Severity tells you where to look first. It doesn’t change what you have to do. Any open finding, at any level, has to be fixed or acknowledged before the post can be approved.
A finding can also quote the words it flagged, or offer a suggestion. A missing disclaimer comes with an Insert disclaimer button that adds the text for you.
When a disclaimer is needed
The Medicare pack asks for a disclaimer only on marketing posts. Those are posts that name plans, benefits, or costs. Under the pack, a post that only teaches how Medicare works doesn’t need one. The required text is called the TPMO disclaimer.
PostSignOff splits this into two jobs. A plain text search looks for the disclaimer in your post. The AI decides if the post is marketing at all. If the AI flags any rule, the post counts as marketing. Then a missing disclaimer becomes a finding. If the AI flags nothing, no disclaimer is asked for.
If the AI part fails, the text search still runs. Then a missing disclaimer can show up even on a post that only teaches, because nothing could judge it.
Why every finding cites a rule
Every rule in the Medicare pack names where it comes from. Most cite a
federal rule. The TPMO disclaimer, for example, cites
42 CFR §422.2267(e)(41). Some cite the CMS marketing guidelines, instead
or as well.
The citation comes from the pack, never from the AI. So it points at the real rule, even if the AI words its finding loosely.
Assistance, not certification
Every result carries the same line: “This is review assistance, not a compliance certification.” That line is an honest picture of the design.
The checker’s job is to narrow the field. It reads every post the same way, every time. It points out the words a trained reviewer would want to look at. What it can’t do is make the call. Whether a flagged phrase is fine in context is a judgment, and that judgment stays with you. Compliance review is designed to support your supervision process. It doesn’t replace it. And it doesn’t promise that you meet any rule.
That’s also why your acknowledgement goes on record instead of being skipped. When you approve a post with open findings, PostSignOff writes down who acknowledged them and when. It also keeps a fingerprint of the exact text, sign-off, and hashtags you saw. The human decision is the supervision step, so the human decision is what gets recorded. Approving many posts at once never makes that decision for you. A post with open findings is skipped until someone opens it and decides.
Why an edit resets the check
A result describes one exact piece of text. Change anything, even a hashtag, and the result now describes text that’s gone. So the post needs a new check before it can be approved. Saving an edit runs one for you, and so does approving.
The same idea shapes the record. Each check is saved as its own review. A fingerprint ties it to the text it read. Old reviews are kept, not written over. If you check the same text again, you get the same saved review. It isn’t run twice. That holds even when part of the check failed, so a fresh check needs changed text.
Changing your brand’s pack or custom rules counts as a change too. Posts then get a fresh check under the new rules.
If it ever matters what was checked and what was approved, the answer is exact. To see where that record shows up, read Keep an audit trail of what went out.