Quick Takeaways
- EU AI Act for marketers: transparency rules already apply.
- Chatbots must say they are AI at first contact.
- AI-written ads sit outside the AI text rule, with exceptions.
- An AI avatar of your CEO needs a deepfake label.
- Lead scoring and personalization are not on the high-risk list.
- Transparency breaches can cost up to €15m or 3%.
Table of Contents
The EU AI Act for marketers is no longer a future problem. Since 2 August 2026, any chatbot that talks to your EU buyers has to make clear it is AI, unless that is already obvious, and the Digital Omnibus passed this summer did not delay that rule. That is a design decision for whoever builds the bot, and a credibility issue for the brand behind it.
But most of what marketing teams hear about the Act points the wrong way. Lead scoring, personalization and segmentation are often described as regulated, high-risk activities. They are not. Typical marketing tools are not high-risk AI under the Act, and most AI-written ad copy needs no disclosure label at all. Teams that over-read the rules spend effort on the wrong controls, while the duties that already apply go unhandled.
So this guide separates what applies now from what does not. It covers your role as a provider or deployer, the precise transparency duties for chatbots, deepfakes and text, where the real high-risk edge cases sit, what the literacy duty asks, and a six-step checklist your team can work through this quarter, with the EU source behind each point.
This post is for educational purposes only and does not constitute legal advice.
What Does the EU AI Act Require of Marketers Right Now?
Today, the Article 5 bans, the literacy duty, the general-purpose AI (GPAI) rules, penalties and almost all of Article 50’s transparency rules apply. High-risk obligations do not.
What Already Applies
Regulation (EU) 2024/1689 has been in force since 1 August 2024 and phases in:
- 2 February 2025: Article 5 prohibited practices and Article 4 literacy.
- 2 August 2025: GPAI rules, governance and penalties.
- 2 August 2026: general application, including Article 50.
This guide is one part of our wider look at privacy-safe AI in marketing.
What the Digital Omnibus Changed, and What It Did Not
The Digital Omnibus on AI is law: Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Providers of generative AI on the market before 2 August 2026 get until 2 December 2026 for machine-readable marking. Chatbot disclosure and deployer deepfake labeling were not delayed, and Article 4 now asks organizations to “take measures to support” literacy.
Does It Apply If You Are Outside the EU?
Often, yes, which is why the EU AI Act for marketers matters well beyond Europe. The Act reaches non-EU providers and deployers whose AI output is used in the EU. A non-EU deployer is caught when it can foresee EU distribution, including posting on the global internet.
Are You a Provider or a Deployer of Your Marketing AI?
The first question the EU AI Act for marketers asks is your role, which decides your transparency duty.
When You Are a Provider
If you build a chatbot in-house under your own name, you are its provider and own the Article 50(1) disclosure duty.
When You Are a Deployer
If you use AI tools to create content, you are a deployer, and the Article 50(4) deepfake duty is yours.
What Does Article 50 Transparency Mean for Your Marketing Content?
Disclosure in specific situations, not a label on everything AI touches. The Commission’s guidelines on AI transparency obligations, adopted 20 July 2026, set out the detail.
Chatbots and AI Agents Must Say They Are AI
Users must know they are dealing with AI, unless that is obvious, so make every buyer-facing chatbot or AI agent say so at first interaction. For agents that act on your data, see governing AI agents that touch customer data.
Deepfakes Need a Label
Deployers must disclose deepfake images, audio and video. The guidelines’ examples:
- Deepfake: an AI avatar of your CEO, or an AI celebrity or influencer in an ad.
- Deepfake: an AI product image that misleads about the real product.
- Not a deepfake: an AI background behind a real product that does not mislead.
The AI Text Rule Is Narrow
The text duty covers only text published to inform the public on matters of public interest, and not where a human reviewed it under someone’s editorial responsibility. Ads and product descriptions are out of scope unless they make health, safety or sustainability claims.
No Retroactive Labeling, and an Optional EU Icon
Content published before 2 August 2026 needs no retroactive label. The voluntary Code of Practice on Transparency of AI-generated Content, finalized 10 June 2026, includes EU labeling icons you can adopt.
Is Your Marketing AI High-Risk? Usually Not
This is where the EU AI Act for marketers is most often over-read: typical marketing tools are not high-risk AI.
What Is and Is Not on the High-Risk List
Personalization, B2B lead scoring, segmentation, content generation and chatbots are not in Annex III. The edge cases that are: AI used to place targeted job ads or screen candidates, credit scoring of individuals, and life and health insurance pricing, with obligations from 2 December 2027.
Where the Manipulation Ban Draws the Line
Article 5 bans manipulative techniques and exploiting vulnerabilities that cause significant harm, but Recital 29 says legitimate advertising is not manipulative in itself. The guidelines on prohibited AI practices call preference-based ad personalization “not inherently manipulative.” Hidden emotion recognition used to push higher prices at vulnerable moments is the counter-example. If you review for dark patterns in data collection, add emotion inference.
What Does AI Literacy Mean for a Marketing Team?
Practical training, not a certificate. The Commission’s AI literacy questions and answers confirm there is no mandatory format. Tell staff who write advertising text with AI about risks such as hallucination, and keep a simple training record. National authorities enforce from August 2026.
What Are the Penalties, and Where Does GDPR Fit?
Fines Under Article 99
Unchanged by the Omnibus, enforced by Member States, and for SMEs, whichever amount is lower:
- Article 5 breaches: up to €35m or 7% of worldwide turnover.
- Most other duties, including Article 50: up to €15m or 3%.
- Misleading information to authorities: up to €7.5m or 1%.
GDPR Still Applies Alongside the Act
GDPR still applies, and its Article 22 applies independently. See also data privacy vs. data security in the age of AI.
A Six-Step Checklist for the EU AI Act for Marketers
1. Inventory Your AI Tools and Your Role in Each
Mark whether you are a provider or deployer for each tool. An AI data governance framework gives that inventory an owner, and our guide to writing an AI use policy for marketing covers the policy itself.
2. Make Every Buyer-Facing Chatbot Disclose It Is AI
Disclose at the first interaction, not in a footer.
3. Set a Synthetic-Media Labeling Rule
Use the guideline examples to define a deepfake, and adopt the EU icon if useful.
4. Keep and Document Human Editorial Review
Name who reviews AI-drafted content and holds editorial responsibility, and record each review.
5. Run Light Literacy Training and Keep a Record
Brief AI users on hallucination, using examples such as these practical AI use cases for Eloqua and Marketo teams.
6. Optional: Run a Red-Flag Check
Flag emotion inference or vulnerability targeting, and escalate AI used in recruitment marketing or credit decisions.
Conclusion
EU AI rules ask for less than their reputation suggests, but they still apply today. Chatbots must disclose, deepfakes need labels, and AI users need training, while lead scoring stays off the high-risk list. To map your AI tools against these rules, contact us.
About 4Thought Marketing
We're a B2B marketing automation and AI consultancy with a thing for getting complex tech to actually work. Since 2008, we've helped hundreds of organizations across financial services, technology, manufacturing, and real estate get more from Eloqua, Marketo, and their CRM integrations. We serve our clients across marketing automation strategy, lead lifecycle, AI, compliance, preference management, and more. Explore our services or get in touch.
Frequently Asked Questions
Do marketers have to label all AI-generated marketing material?
No. Disclosure covers AI chatbots, deepfake images, audio and video, and AI text published to inform the public on matters of public interest. Ads and product descriptions are out of scope unless they make health, safety or sustainability claims.
Is AI lead scoring high-risk under the EU AI Act?
No. B2B lead scoring, personalization and segmentation are not on the Annex III list. Credit scoring of individuals is, so check whether any scoring you support feeds credit decisions.
Did the Digital Omnibus delay the transparency rules?
No. Regulation (EU) 2026/1744 delayed high-risk obligations to December 2027 and August 2028. Chatbot disclosure and deployer deepfake labeling have applied since 2 August 2026.
Does the EU AI Act for marketers apply to US companies?
It can. The Act reaches non-EU providers and deployers whose AI output is used in the EU, including content posted on the global internet where EU distribution is foreseeable.
Do staff need a certificate to meet the literacy duty?
No. There is no certificate and no mandatory format. Practical training plus a simple record of who was trained is a sensible approach for most marketing teams.
What are the fines for breaking the transparency rules?
Up to €15m or 3% of worldwide turnover, the tier for most duties including Article 50. The €35m or 7% tier applies to Article 5 prohibited practices. SMEs pay whichever is lower, which still makes AI Act compliance worth planning for.
