A buyer's guide to creative advertising tools and the suppliers behind them

What to take away

This guide is written for buyers in England. The supplier market is largely global. Public product pages rarely establish local availability, contract terms or support. UK government and NCSC material is used for selection and security questions. Its public-sector scope is stated where relevant. Product access, pricing and performance were not tested. Research closed on 5 September 2026.

Define the job before naming Canva or Smartly.io

Map one campaign from approved brief to served advert. Include asset creation, adaptation, claims review and rights checks. Also cover export, media hand-off, amendments and withdrawal. Count the people and organisations involved, including agencies or local teams. The map should show where authority changes hands.

Write requirements as witnessed tasks. For brand governance, ask whether a local maker can alter an offer but cannot replace the legal line. Can that maker also not replace the master logo?

For AI copy, ask whether a reviewer can see the generated text and supporting record. Can the reviewer see edit history and the final approved variant? Each essential requirement needs a pass condition and owner.

GOV.UK's current Service Standard asks public teams to understand total ownership cost. It also asks how technology works, future change and effects on users when they choose tools and technology. It is not a rule for private advertisers. Its insistence on explaining build-or-buy decisions is still a useful counterweight to demonstration-led purchasing.

Set exclusions early. These may cover personal data, unreleased products and biometric material. They may also cover regulated claims, direct media activation or model training. A candidate that cannot respect an essential boundary should leave the process before a trial.

Choose the right product category: template editors, ad builders and automation

Several overlapping categories appear under creative software. A template editor helps people assemble and resize assets. Canva, Adobe Express and Figma are common examples.

An asset-based ad builder combines supplied components inside a media platform. Google Ads, Meta Ads Manager and TikTok Ads Manager include builders of that kind. Creative automation services connect templates, feeds, variations and localisation. Smartly.io, Celtra, Flashtalking and Innovid sell those services. A broader advertising platform may join creative production to activation and reporting.

The widest category is not automatically the most capable for a particular team. Every added connection changes the evidence required for access, data movement and failure recovery. Assembling many narrow products can introduce hand-offs, duplicate libraries and inconsistent approvals.

Use a boundary table before naming candidates:

This classification prevents a simple maker from being scored poorly for lacking media functions the buyer does not need. It also prevents an integrated supplier from receiving credit for unused breadth.

Name the tools and suppliers behind the categories

Template editors cover basic creative work. Canva has a free tier and paid plans. Canva Pro is published at about £10.99 per month in the UK, with an annual option. Adobe Express has a free tier and a Premium plan at about £9.98 per month.

Figma lists Professional at about $12 per editor per month. Organisation is about $45 per editor per month. Enterprise is about $75. Figma suits teams building reusable components and design systems.

Adobe Creative Cloud All Apps is published at about £56.98 per month in the UK. It suits studios that need Photoshop, Illustrator and InDesign alongside ad production. Google Web Designer is free and builds HTML5 display ads. It suits display teams that need code-level control.

Asset management and brand governance sit behind larger libraries. Bynder, Frontify and Brandfolder (part of Smartsheet) publish custom pricing rather than list rates. Bynder and Frontify suit brand portals, guidelines and approval chains. Brandfolder suits central asset libraries with permissions and rights metadata.

Creative automation services handle feed-driven variation. Smartly.io combines creative automation with media buying for social and display. Its pricing is custom, typically a platform fee or a share of media spend. Celtra and Bannerflow focus on dynamic creative, approvals and ad serving. Both quote on contract, not public list prices.

Flashtalking and Innovid provide ad serving, creative optimisation and measurement. Flashtalking suits advertisers that need independent ad serving and verification. Innovid suits video, TV and display personalisation. Clinch covers dynamic ads for programmatic and social. These suppliers price by contract, often with volume tiers.

Media platforms include free ad builders once you have an account. Google Ads has responsive search ads and Performance Max. Meta Ads Manager has asset-based creatives and Advantage+ options. TikTok Ads Manager has Smart Creative and video templates. Amazon Ads and LinkedIn Campaign Manager add their own creative builders. You pay for media, not a separate licence.

Build an evidence ladder

A product page establishes what the supplier currently says. It does not establish that the feature exists on the proposed plan. It does not prove the feature works with the buyer's files or produces a promised outcome. Raise confidence in stages:

Mark any missing stage. Do not replace it with marketplace popularity, an undated screenshot or another customer's case study. Reviews may surface questions. They cannot answer whether a supplier grants the rights, controls or service terms this buyer requires.

The government guidance for commercial off-the-shelf products tells public service teams not to commit before discovery. It also tells them to try options during alpha. A commercial creative team can adopt the same sequence as a risk-control method. It should leave public-service compliance claims out.

Research a shortlist of named tools without creating a ranking

Use inclusion rules that follow the defined job. Require a live supplier record for the relevant function. Require evidence of the necessary format or workflow boundary. Require a route to request security and contract material. State the research date, geography and exclusions. A shortlist is complete when it contains credible alternatives, not when it reaches an arbitrary number.

For each candidate, record:

Avoid best labels unless the criteria, weights, evidence and tie handling are published and defensible. Even then, the result applies only to that method and date. Supplier products change too quickly for a category-wide winner to become a permanent fact.

Compare like with like, and show the gaps

Use consistent units for any commercial data. If one proposal meters seats and another combines usage or serving, show separate components rather than inventing an equivalent rate.

Give suppliers a sanitised task specimen with troublesome conditions. Include long copy, restricted photography, several markets and a late product change. Ask them to demonstrate rejection, version restoration and withdrawal as well as creation. Record who operated the service and which steps were described rather than shown.

Do not score an absent answer as a failed feature unless the supplier confirms it is unavailable. Not evidenced is a useful procurement result because it directs the next question. Weight essential tasks before seeing scores. An impressive optional function should not compensate for a missing control.

Assess security in proportion to the use

Creative systems can hold unreleased campaign plans, customer images, access tokens and live publishing connections. Start with the consequence if that information is disclosed, changed, lost or unavailable. The NCSC's choosing a cloud provider guidance links required confidence to data sensitivity and impact. It distinguishes lightweight from fuller principles-based assessment.

For higher-impact use, structure questions around the NCSC cloud security principles. They cover provider responsibilities such as protection in transit, customer separation and governance. They also cover supply chain, identity, service administration and audit information. They are assessment prompts, not a vendor certification.

Request assertions and evidence separately. A current independent report may support controls within its stated scope. It does not prove that the buyer's tenancy is configured safely. Identify responsibilities inherited from an underlying cloud platform. Also identify those retained by the application supplier or buyer.

Examine data, content rights and contract fit

Trace every upload and integration. Identify whether a vendor processes personal data on instructions. Does it determine a separate purpose? Does it use sub-processors? Does it send material to another model provider?

Where a controller uses a processor, the ICO's contracts and liabilities guidance describes mandatory contract subjects. The ICO notes the page is under review after legal changes. It is not a commercial negotiation guide.

Ask counsel to examine rights granted in copy, images, fonts, prompts and outputs. Distinguish use needed to deliver the service from product improvement or training. Record deletion, backup and support-access treatment. Marketing language about safe content or ownership is not a substitute for the governing terms and a fact-specific rights analysis.

Commercial review should connect fees to the operating model. Obtain the unit, commitment, renewal and overage basis. Also obtain serving, storage, integration, service and support terms. Add buyer-side administration, template creation, training, migration, quality review and exit. If the parties cannot state how material cost changes with volume, defer the forecast.

Pilot the hardest ordinary workflow

A pilot is a procurement test, not a miniature launch announcement. Use a task that is common enough to matter and difficult enough to expose limits. Keep the same source files, participants and pass conditions across candidates. Do not place confidential or personal material in trial accounts unless the environment and use have been approved.

Observe account setup, template building, variation and comments. Also observe approval, export and correction. Deliberately create a missing field, wrong crop, expired claim and unauthorised edit. Government quality-assurance guidance recommends normal and unusual test conditions for public services. It also recommends whole-team involvement. Here, it is a testing prompt rather than proof of conformance.

Record task time, manual interventions, errors, support dependencies and abandoned routes. These observations describe one team and specimen. They should not become a universal efficiency percentage or supplier ranking.

Contract for change and exit

Products, models, integrations and media specifications change. The agreement should provide a workable route to assess material changes, retrieve evidence and stop unacceptable use. Define service scope, acceptance, roles and incident support. Also define sub-processor notices, audit material, intellectual-property positions and deletion or return.

Prefer exportable assets and records where the workflow permits. The UK government's Open Standards principles link interoperable formats and exit planning to reducing supplier lock-in in public procurement. Private teams can use that reasoning without claiming the government policy applies to their purchase.

Test departure before signing. Export an editable campaign, brand data, comments, approvals and provenance. Confirm which parts cannot move and price the reconstruction effort. An exit plan that depends on the outgoing supplier's goodwill is an unresolved risk.

Implement through controlled expansion

Begin with a small group, named administrators and one approved workflow. Configure identity, permissions, public sharing and retention. Also configure integrations and model settings before importing an asset library. The NCSC's SaaS security guidance covers user lifecycle, authentication, permissions and sharing. It also covers incident planning and monitoring. It stresses the customer's continuing configuration duties.

Train by role. Makers need safe inputs and template boundaries. Reviewers need to see changes and evidence. Administrators need access, logging and recovery procedures. Run a witnessed release and reversal before adding direct activation or sensitive data.

Adoption should answer the original job. Compare observed work with the baseline, state limitations and capture user problems. Widen use only where the evidence supports it. A product may be suitable for basic adaptation. It may remain restricted from customer data or live publishing.

Record a defensible decision

The final paper should show the task, candidates and dated sources. It should show exclusions, witnessed results and unresolved claims. It should also show the security position, contract issues, total-cost assumptions and exit test. Name each reviewer and the evidence that would reopen approval.

Select only if the proposed use fits within the accepted boundary. Otherwise narrow the use, negotiate, gather evidence or reject. The most useful procurement outcome is sometimes a smaller implementation with fewer unproved dependencies.

Before you act

Common questions

How should a buyer define the job without naming a vendor?

Map one campaign from approved brief to served advert. Include asset creation, adaptation, claims review and rights checks. Also cover export, media hand-off, amendments and withdrawal. Count the people and organisations involved, including agencies or local teams. The map should show where authority changes hands.

What is an evidence ladder and why use it?

An evidence ladder raises confidence in stages. Retain the dated first-party claim. Ask for plan and regional applicability in writing. Watch the function using the buyer's task specimen. Perform a controlled hands-on exercise. Connect the conclusion to contract and security evidence. Mark any missing stage.

How should security be assessed for creative systems?

Start with the consequence if information is disclosed, changed, lost or unavailable. The NCSC's choosing a cloud provider guidance links required confidence to data sensitivity and impact. For higher-impact use, structure questions around the NCSC cloud security principles. They are assessment prompts, not a vendor certification.

Which creative advertising tools should a buyer shortlist?

Start with Canva, Adobe Express and Figma for template and design work. Add Smartly.io, Celtra, Flashtalking or Innovid for creative automation and ad serving. Use Google Ads, Meta Ads Manager or TikTok Ads Manager when the ad builder sits inside a media platform. Bynder, Frontify and Brandfolder cover asset management and brand governance.