An EU AI Act implementation checklist is a list of the concrete steps a company takes to move its AI tools from informal experiments to documented, compliant production use. For most marketing and communications teams, that means four things: knowing which AI systems you run, classifying their risk, meeting transparency duties for generated content, and keeping records that show who approved what and when.
The Act is the European Union’s horizontal regulation for artificial intelligence. It applies to providers who build AI systems and to deployers who use them, and it reaches companies outside the EU when their AI output is used inside it. A Turkish agency running campaigns for a German retailer is therefore in scope, even if no server sits in Europe.
Why does a pilot need a checklist at all?
Pilots tend to be informal. Someone on the content team signs up for an image generator, a strategist pastes customer feedback into a chatbot, and a social media manager tests an AI voice for a reel. None of this is written down, and that is where the trouble starts.
When a pilot becomes a process, the regulation expects you to show your reasoning. Regulators, clients and journalists will ask the same question: who decided this tool was acceptable, and on what basis? A checklist turns that answer into a document instead of a memory.
Step one: build an inventory of every AI system in use
You cannot classify what you have not listed. Start with a simple spreadsheet and fill it in with every team, not only IT. Shadow tools are common in marketing because many of them are cheap, browser-based and bought on a personal card.
- Tool name, vendor and the plan or licence in use
- The team and named owner responsible for it
- What goes in (briefs, customer data, images of people) and what comes out
- Whether the output reaches the public, a client or only internal staff
- Where the vendor processes data, and whether a data processing agreement exists
Expect the first pass to miss things. In a typical mid-sized team, a second round of interviews turns up browser extensions, AI features inside existing software such as design suites and CRM platforms, and freelancer tools nobody approved.
How do you sort tools into the Act’s risk tiers?
The regulation works in layers. A small set of practices is prohibited outright, such as manipulative techniques that exploit vulnerabilities or certain forms of social scoring. A defined list of high-risk uses, including AI in recruitment, credit decisions and access to essential services, carries heavy obligations. Below that sit transparency obligations and general-purpose AI model rules.
Most marketing work falls into the transparency layer. Writing assistants, image generators, chatbots and synthetic voices are not high-risk by default. The exception is when a marketing tool drifts into a listed area. An AI that screens job applicants for an employer brand campaign is a recruitment system, and the label “marketing” does not change that.
Questions to ask for each tool
- Does it make or shape a decision about a person’s access to work, credit, education or services?
- Does it interact directly with people who may not know they are talking to a machine?
- Does it produce images, audio or video that look real?
- Does it use biometric data, including face or voice matching?
Transparency duties: labels, disclosures and deepfakes
The Act requires that people are told when they are interacting with an AI system, unless it is obvious from context. For a website chatbot, a short line such as “You are chatting with an automated assistant” at the start of the conversation is the usual answer.
Generated or manipulated images, audio and video that resemble real people, places or events must be disclosed as artificially generated. Providers of generative systems are expected to mark output in a machine-readable way, which is why standards such as C2PA content credentials are gaining ground. Deployers still carry their own duty to disclose deepfakes, with lighter treatment for clearly artistic or satirical work.
For PR teams this has a practical edge. A synthetic spokesperson video, a cloned executive voice or a “photo” of an event that never happened all need a visible disclosure. Put the rule in the brand guidelines rather than leaving it to each designer.
What should vendor contracts and records contain?
Deployers depend on vendors for much of the evidence. When you renew or sign an AI tool contract, ask for the vendor’s documentation on intended use, known limitations, data handling and how output marking works. General-purpose model providers have their own documentation duties under the Act, and their summaries help you fill your own records.
Keep a short decision log for each production tool. It does not need to be long. One page per system with the risk classification, the reasoning, the approver, the date and the review interval is enough to answer most questions from a client’s compliance team.
Staff literacy and human oversight
The Act asks organisations to make sure staff who use AI have a sufficient level of AI literacy for their role. In practice that means short, role-specific training: what the tool can and cannot do, where it tends to make mistakes, what data must never be pasted in, and how to escalate a problem.
Human oversight matters most where output goes public without editing. Set a rule that every AI-generated press release, ad claim or statistic is checked by a named person before publication. Hallucinated facts in a press release are a reputational risk long before they are a legal one.
How Alien Road applies the EU AI Act in client work
In a typical engagement, the work starts with a discovery workshop where each client team walks through the AI tools it uses for content, ads, social and customer service. We turn that into the inventory described above and flag anything that touches a listed high-risk area or produces realistic synthetic media.
Setup follows: disclosure wording for chatbots and synthetic content, a labelling rule in the brand guidelines, and a one-page decision record per tool. For campaigns that use generated visuals, we add content credentials at export where the design tools support it. Measurement and reporting come last, with a quarterly review that checks whether new tools have appeared and whether any use has moved into a stricter tier. Legal sign-off stays with the client’s counsel; our role is to make the marketing side documented and easy to audit.
Where to start this week
Pick one afternoon and run the inventory with three teams: content, social and customer service. Do not classify anything yet, just list. Next week, mark each tool with a single tag: public-facing synthetic media, chatbot, internal only, or possible high-risk.
Then write the disclosure lines. Two sentences for the chatbot and one line for generated media will cover most of your public exposure. The remaining steps, from vendor documentation to training, are easier once that first map exists, and the obligations phase in over time, so a steady monthly review beats a rushed project the week before a deadline.
Keep reading: PR Services · Digital PR