The EU AI Act is the European Union’s law regulating artificial intelligence by level of risk. For most marketing and PR teams, its main effect is not a ban but a set of transparency duties: people must be told when they interact with a chatbot, and AI-generated or manipulated content that could pass as real, such as deepfakes, must be disclosed. It applies to companies outside the EU too when their AI systems or outputs are used in the EU market.
This guide explains the structure of the Act, which parts touch marketing, and how to prepare without overreacting. It is a general overview, not legal advice; check specifics with counsel.
What does the EU AI Act regulate?
The Act sorts AI systems into risk categories, each with different obligations.
- Unacceptable risk: practices that are banned outright, such as manipulative techniques that exploit vulnerabilities to cause harm, social scoring by public authorities and certain uses of biometric identification.
- High risk: systems used in areas such as hiring, credit scoring, education, critical infrastructure and law enforcement. These face strict requirements on data, documentation, human oversight and accuracy.
- Limited risk: systems with transparency duties, including chatbots and generators of synthetic content.
- Minimal risk: everything else, such as spam filters or most recommendation features, with no new obligations beyond voluntary codes.
There are also separate rules for general-purpose AI models, the large models behind tools like ChatGPT, Gemini and Claude. Those obligations fall mainly on the model providers, not on the marketers who use the tools.
When do the rules apply?
The Act entered into force in August 2024 and applies in stages. The bans on prohibited practices and AI literacy duties came first, in early 2025. Obligations for general-purpose AI model providers followed in August 2025. Most remaining rules, including the transparency duties relevant to marketing, are scheduled for August 2026, with some high-risk product rules later. The EU has discussed adjusting parts of the timeline, so check the current status before planning around a specific date.
Which parts matter most to marketing and PR?
Chatbot disclosure
If your website or app uses an AI chatbot or voice assistant to talk with customers, people must be informed that they are dealing with AI, unless it is obvious from the context. A short line at the start of the chat usually covers this.
Synthetic content and deepfakes
Those who deploy AI systems that generate or manipulate image, audio or video content resembling real people, objects, places or events, in a way that could appear authentic, must disclose that the content is artificial. Creative, satirical or artistic works get lighter treatment, but disclosure still applies in a way that does not spoil the work.
AI-generated text on public interest matters
Text generated by AI and published to inform the public on matters of public interest must be disclosed as AI-generated, unless it has undergone human review and someone holds editorial responsibility. For PR teams publishing news-style content, the human review and editorial ownership route is the practical one.
Machine-readable marking
Providers of generative AI systems must mark outputs in a machine-readable way, such as watermarks or metadata. Standards like C2PA Content Credentials are one route. Marketers should avoid stripping this metadata from assets.
Banned manipulation
The prohibition on manipulative or deceptive AI techniques that distort behaviour and cause significant harm is aimed at serious cases, not ordinary persuasion. Still, campaigns that use AI to target vulnerable groups, such as children or people in financial distress, deserve a careful review.
How does it relate to GDPR and other rules?
The AI Act does not replace GDPR. Personalisation, profiling and data used to train or run AI tools still fall under data protection law. Consumer protection rules, the Digital Services Act and advertising codes also continue to apply. For companies in Turkey serving EU audiences, KVKK applies at home and GDPR and the AI Act apply to the EU side.
A practical checklist for marketing teams
Most teams can prepare with a few concrete steps:
- Inventory: list every AI tool the team uses, what it produces and where outputs are published.
- Classify: mark which uses involve chatbots, synthetic people or voices, or public-interest text.
- Disclose: add clear labels for chatbots and realistic synthetic media; turn on platform AI labels on Meta, TikTok and YouTube.
- Keep metadata: preserve Content Credentials and watermarks on generated assets.
- Review: assign editorial responsibility for AI-assisted articles and press materials, with a named reviewer.
- Train: AI literacy is a duty for organisations that deploy AI; a short internal session and written guidelines help meet it.
- Vendors: ask tool providers how they meet their own obligations under the Act, especially for marking outputs.
- Document: keep a short record of decisions so you can show your reasoning later.
How Alien Road applies the EU AI Act in PR and marketing work
In a typical engagement for a client with EU audiences, the first step is an AI use inventory built with the client’s marketing, PR and customer service leads. Each use is mapped to the Act’s categories and to the client’s existing GDPR records, which often already list the same tools.
From that map, the team proposes labels and workflows. Chatbots on the client’s site get a disclosure line. Avatar or synthetic voice videos carry visible labels and keep platform AI tags on. AI-assisted press releases and thought leadership pieces go through a named editor whose approval is recorded, so the human review route is documented.
Reporting is simple: a quarterly review of the inventory, any new tools added, and a check that labels are still in place on live assets. When the client’s legal team issues guidance, the workflows are updated and staff are briefed.
What are common misunderstandings about the Act?
Several misreadings circulate in marketing circles:
- “All AI content must be labelled.” Not quite. The duty focuses on chatbots, realistic synthetic media and public-interest text without human editorial control.
- “It only affects EU companies.” It applies to anyone placing AI systems or outputs on the EU market.
- “Using ChatGPT makes us a high-risk provider.” Ordinary marketing use of general-purpose tools does not fall into the high-risk category.
- “Nothing applies until 2026.” Some duties, including AI literacy and the prohibitions, already apply.
Where to start this week
Make a list of every AI tool your team used in the last month and what each one produced. Mark the chatbot, synthetic media and published-article uses. For each one, write down who reviews it and whether a label is shown. That one-page inventory is the base for every other step, and it takes less than an hour.
Keep reading: PR Services · Digital PR