CMS has spent a decade holding Medicare marketing to a strict standard. Agents learned to document consent, retain records, and prove that every ad met the rules. The ACA marketplace lived under lighter scrutiny. That gap just closed.
The 2027 Notice of Benefit and Payment Parameters is final and takes effect July 20, 2026, ahead of open enrollment on November 1. Most of the coverage has focused on eligibility and subsidies. The part marketers should read twice is the set of new 2027 ACA marketing rules in the marketing standards at 45 CFR 155.220(j), and they change who is on the hook when an ad crosses the line.
Here is what changed, in plain terms.
1. A written list of prohibited practices. CMS pulled marketing conduct out of the general standard and gave it its own section. Marketing has to provide correct information without leaving out material facts, and it cannot be misleading, inaccurate, coercive, or discriminatory. The rule then names specific practices that are now off limits, including fake or facsimile government logos, false “you always qualify for a zero dollar plan” claims, misstated deadlines, invented legal citations, and the use of a celebrity or politician’s image or words to imply an endorsement that never happened. CMS calls out AI generated video by name. If you have seen these tactics in the wild, that is the point. They drove the fraud complaints that prompted the rule.
2. You have to produce your materials on request. Agents, brokers, and web-brokers now have to retain their marketing materials and hand them to CMS in a timely manner for monitoring, audit, and enforcement. This covers more than finished ads. It reaches landing pages, lead forms, email and text content, call scripts, and the creative variants behind them. “We do not have it” is no longer an answer.
3. You own your downstream. This is the one most teams have not absorbed. You are responsible for marketing created by you or on your behalf. If a lead generator, an affiliate, a field marketing organization, or a white label vendor runs a misleading ad tied to your offer, that is your exposure, not just theirs. “The vendor did it” is no longer a defense.
Who is most exposed
The rule binds agents, brokers, and web-brokers directly. Web-broker and enhanced direct enrollment platforms carry the most risk, because they sit above large networks of downline agents and answer for what those agents publish. Large brokerages and the FMOs, IMOs, and lead generators that feed them are close behind, because they produce and distribute the very materials the “on their behalf” language now captures.
Carriers are not directly liable for broker marketing under this section. But any carrier with affiliated agencies, captive sales forces, web-broker relationships, or co-branded acquisition channels should read this as a distribution governance rule. When a downstream partner misbehaves, the brand and the enrollment book are both at risk.
How to prepare for the 2027 ACA marketing rules
The teams that handle this well will treat marketing materials the way compliance teams already treat regulated documents. That means three things.
First, a single system of record for every asset, every version, and every approval, so an audit request is a search and not a scramble. Second, a real review step before anything publishes, so risky claims get caught before they reach a consumer rather than after a complaint. Third, control over what your downline actually uses, so partners work from approved templates instead of building their own from scratch.
None of this is a policy problem. It is an operations problem. The rule did not ask whether your process is compliant. It asked whether you can prove it.
How Aproove can help: own your downstream without drowning in it
You are now on the hook for marketing you did not create and often never see. A partner ships a risky ad, and it is your exposure. The problem is that most teams have no way to catch that asset before it goes live, no capacity to review the volume by hand, and no clean record to hand CMS when the request comes. Aproove closes that gap. It gives you one place to intake, check, approve, and prove every asset that moves through your ecosystem, with AI carrying the first pass so your team is not buried. Two workflows do the work. Both run on the same idea: AI takes the first pass and flags the risk, a human makes the call, and the system records all of it.
Workflow one: a submission portal for your downline
Picture a single intake link that lives on your site or behind your agent login. Here is what a downline partner experiences.
- The partner submits through a structured intake. Aproove captures the campaign details, ingests all campaign assets, securely streams them, and starts a structured, smart routing process.
- The files land on secure infrastructure, with cloud, self-hosted, and hybrid options so your data stays where your compliance team needs it.
- Aproove breaks each asset into pixel-level components and its AI scores and tags risk against your internal policies, ACA guidelines, and any custom guidelines you define.
- Every organization sets its own workflow for each project type and risk profile. For example, you might send high risk items straight to a compliance reviewer with the flags already attached, while low risk items take a lighter, faster path so your team is not the bottleneck. You decide the paths and the thresholds.
- A human approves. The AI never has the final say. Every flag, comment, and decision is locked to that version and stored in a Grade 1 audit trail with timestamps and approver identity.
Your partners get fast, clear answers. You get a defensible record of every asset that entered your ecosystem. The goal is simple. Keep your agents and downlines out of trouble.
Workflow two: a distribution hub for approved templates
The other half of owning your downstream is controlling what your partners publish in the first place, and distributing approved templates, policies, and guidelines without heavy communication overhead. Automation carries that load. Instead of every agent building their own flyer, they work from materials you have already approved.
- Your team routes a master template through Aproove for approval, with marketing, compliance, and any outside agency reviewing in one place instead of across email threads.
- Once approved, the template is version locked and published to a secure brand portal that only verified downline partners can reach.
- When a partner localizes a template for their clients or market, Smart Review compares their version against the approved master and highlights what changed, so a compliance check is a glance and not a full re-review.
- Your team holds a clean record of every template approved and every version in the field. Your partners get one place to find on brand, compliant materials instead of inventing their own.
Why the AI matters here
The rule creates volume no manual process can absorb. Every ad, landing page, lead form, email, and call script, from every downline partner, is now in scope. Aproove embeds AI inside the workflow to carry that first pass at scale, scoring and tagging risk at the component level and surfacing only the items that need a person. Humans still approve. The difference is that your reviewers spend their time on real decisions instead of drowning in low risk assets, and every AI action is captured right next to the human one.
When CMS asks you to produce a piece of marketing, the answer is one search away.
The rule is already in effect, and open enrollment follows in November. If getting ahead of it feels like a heavy lift, it does not have to be. Aproove can be up, live, and a meaningful part of your tech stack in 30 to 45 days.
Frequently asked questions
When do the 2027 ACA marketing rules take effect?
The rules are final and take effect July 20, 2026. That is before open enrollment for the 2027 plan year, which begins November 1, 2026.
Who is responsible for marketing created by a downstream partner?
The agent, broker, or web-broker is responsible for marketing created by them or on their behalf. If a lead generator, affiliate, field marketing organization, or vendor runs a non-compliant ad tied to your offer, the exposure is yours.
What marketing practices does the 2027 ACA rule prohibit?
The rule bars marketing that is misleading, inaccurate, coercive, or discriminatory, and it names specific practices such as fake government logos, false zero dollar plan claims, misstated deadlines, invented legal citations, and the unapproved use of a public figure to imply an endorsement.
What marketing records do agents and brokers have to keep?
Agents, brokers, and web-brokers must retain their marketing materials and produce them to CMS in a timely manner for monitoring, audit, and enforcement. This includes ads, landing pages, lead forms, emails, and call scripts.
Does the rule apply to carriers?
Carriers are not directly liable for broker marketing under this section, but any carrier with affiliated agencies, captive sales forces, or web-broker relationships should treat it as a distribution governance issue.
With regulators now demanding full audit trails for every marketing asset, the question is not whether your approval process is documented. It is whether you can prove it.
