The EU AI Act’s transparency obligations (Article 50) took effect on August 2, 2026, with penalties reaching €15 million or 3% of global annual turnover, whichever is higher. Most of what it actually requires is narrower — and different — from what circulates in “is your marketing AI-Act-compliant” content online.
- What’s actually regulated: AI chatbots must disclose they’re AI at the point of interaction; AI-generated content that could pass as authentic needs a machine-readable label.
- What generally isn’t (yet): routine ad targeting and personalization — unless it touches credit, insurance, employment, or essential-services eligibility, which falls under a separate high-risk category with a later deadline.
- Who this is for: marketing teams running AI chatbots, generative ad creative, or profiling-based targeting in or toward the EU.
- Article 50 transparency obligations — the rules most relevant to marketing — took effect August 2, 2026, with the European Commission’s implementing Guidelines finalized July 20, 2026.
- General ad targeting and personalization is not automatically “high-risk” under the Act; that classification applies to credit scoring, insurance risk-pricing, and similar eligibility decisions, with a 2027 deadline.
- 53.8% of German AI decision-makers had taken no concrete compliance action one month after the Act’s core provisions began applying, per a Deloitte Legal Germany survey of 500 respondents.
- AI-generated ad creative only triggers mandatory labeling if it meets a three-part realism test — minor edits like color correction don’t count.
1. The actual timeline (not the one most posts cite)
The EU AI Act rolled out in stages, and marketing-relevant obligations are split across three separate dates. February 2, 2025: Article 5’s prohibited practices and AI-literacy requirements took effect, banning AI systems that use subliminal, manipulative, or deceptive techniques to materially distort behavior — the European Commission’s own guidance cites dark-pattern-style manipulative ad engines as a concrete example. August 2, 2026: Article 50 transparency obligations took effect, with the Commission’s final implementing Guidelines published July 20, 2026. December 2, 2027: high-risk obligations under Annex III become applicable — this date was itself delayed from an earlier August 2026 target via the May 2026 “Digital Omnibus” political agreement.
Getting this sequence right matters, because a marketing team that assumes the whole Act “just started” is probably already 18 months late on the prohibited-practices ban, and a full year ahead of schedule worrying about high-risk classification that doesn’t apply yet.
2. What’s regulated vs. what isn’t
The single most common overclaim in AI Act marketing content is treating all AI-driven ad targeting as “high-risk.” It isn’t. High-risk classification under Annex III is specifically tied to credit, insurance, employment, and essential-services eligibility decisions — not general audience targeting or personalization.
| Marketing activity | Regulatory status | Effective date |
|---|---|---|
| Manipulative or subliminal ad techniques that materially distort behavior | Prohibited outright (Article 5) | Feb 2, 2025 — already in force |
| AI chatbot without disclosure at point of interaction | Transparency violation (Article 50) | Aug 2, 2026 — already in force |
| AI-generated ad image/video meeting the deepfake three-part test | Requires machine-readable “artificially generated” mark | Aug 2, 2026 (retrofit deadline Dec 2, 2026) |
| General ad targeting or personalization (not tied to eligibility) | Not automatically high-risk | N/A |
| AI-driven credit scoring, insurance risk-pricing, eligibility profiling | High-risk (Annex III) | Dec 2, 2027 |
3. Chatbots: the disclosure rule marketers miss
Article 50 requires that an AI chatbot disclose it’s AI at the point of interaction — a mention buried in your terms and conditions does not satisfy this. The Commission’s Guidelines explicitly reject generic “our services may use AI” disclaimers as insufficient. For a marketing team running a customer-facing chatbot, this is the most immediately actionable item on the whole Act: check where and how your bot currently discloses its nature, not whether a compliance page mentions AI somewhere on the site.
This sits alongside the broader question of what these systems can responsibly be trusted to do unsupervised, which we cover in more operational terms in AI marketing automation: what changes beyond rule-based workflows.
4. AI-generated ad creative and the three-part deepfake test
Article 50(4)’s labeling requirement for AI-generated content only applies when the content passes a three-part test: appreciable realism, depiction of real or plausible people or objects, and content that would appear authentic to the audience viewing it. Minor edits — color correction, background swaps — don’t trigger it. AI-generated product imagery, beauty and fashion visuals, and synthetic spokesperson content are the categories flagged as higher-risk for meeting this test.
Practically, this means a marketing team using generative AI for ad creative needs a review step that specifically asks “would this pass as real to someone seeing it once,” not a blanket rule that every AI-touched asset needs a label. Teams evaluating an outside agency’s AI creative practices should make this part of that vetting conversation — see our guide to choosing an AI marketing agency for the broader due-diligence list this belongs on.
5. How unprepared marketing teams actually are
53.8% of 500 German AI decision-makers surveyed by Deloitte Legal Germany had implemented no concrete compliance measures — no task force, no dedicated department, no active project — one month after the Act’s provisions began applying. Only 26.2% had actively begun compliance work, while 35.7% rated themselves “well prepared” and 19.4% “poorly prepared.” Separately, 77% of organizations globally report they’re already working on AI governance in some form, per the IAPP’s 2025 AI Governance Profession Report — a reminder that “governance activity” and “AI Act-specific readiness” are not the same measurement.
6. A compliance-check sequence
Before assuming your marketing stack is or isn’t exposed, a practical sequence:
- List every AI-facing customer touchpoint — chatbots, AI-generated ad creative, any profiling or scoring system — and check each against the table in Section 2.
- For chatbots specifically, verify disclosure happens at the point of interaction, not only in terms and conditions.
- For AI-generated creative, apply the three-part realism test from Section 4 rather than assuming a blanket labeling rule.
- Confirm none of your targeting or profiling touches credit, insurance, employment, or essential-services eligibility — if it does, the Annex III high-risk timeline (Dec 2, 2027) applies and needs earlier preparation, not later.
- Document whatever you find, even briefly — given that over half of surveyed teams have done nothing yet, a basic written record already puts you ahead of the median.
What the evidence doesn’t yet support
A few limits worth stating plainly. Guidance on how Article 5’s prohibition on “manipulative” ad techniques applies to specific ad-tech practices — like behavioral-signal-based offer timing — is still developing, and reasonable legal interpretations differ; a general claim that any form of personalized offer timing is prohibited would overstate what’s currently settled. The 2027 high-risk deadline was already pushed back once, from August 2026 to December 2027, so treating that date as fixed rather than subject to further political negotiation would also overstate current certainty. And Deloitte’s readiness survey covers German respondents specifically — extending that exact percentage to “European marketers” generally isn’t something the underlying data supports.
Frequently Asked Questions
Does the EU AI Act apply to ad targeting and personalization?
Only in specific cases. General audience targeting and personalization is not automatically classified as high-risk. High-risk classification under Annex III applies specifically to AI used for credit scoring, insurance risk-pricing, and similar eligibility decisions, with obligations applying from December 2, 2027.
What do we actually need to do about our chatbot right now?
Confirm it discloses it’s an AI system at the point someone starts interacting with it, not only somewhere in your terms and conditions. This obligation, under Article 50, has already been in effect since August 2, 2026.
Does every AI-generated ad image need a label?
No. Labeling is only required when the content meets a three-part test: appreciable realism, depiction of a real or plausible person or object, and content that would appear authentic to the viewer. Minor edits like color correction don’t trigger this requirement.