The EU AI Act Costs and ROI: How to Budget and Measure It

The Act classifies AI systems by risk. Prohibited practices are banned; high-risk systems, such as those used in hiring or credit scoring, face strict obligations; limited-risk systems carry transparency duties; and minimal-risk uses face few direct requirements. Most marketing AI, including copy drafting, audience analysis and ad optimisation, sits in the lower tiers.

The obligations that touch marketing most often are transparency rules: telling people when they talk to a chatbot, disclosing realistic synthetic media and, for certain public-interest text, disclosing AI generation unless a human reviewed it. Teams that also use AI in recruitment marketing or screening should check those uses carefully, since employment is a high-risk area.

Budgeting is easier when the work is split into concrete items. For a mid-sized marketing or PR team, expect these lines:

• Tool inventory: staff time to list every AI tool and feature in use, with data flows.
• Classification: deciding the risk tier for each use, with legal input for unclear cases.
• Disclosure work: editing chatbot greetings, adding labels to synthetic media templates and updating content guidelines.
• Vendor due diligence: requesting documentation and contract updates from AI vendors.
• Training: short sessions for staff on disclosure rules and approved tools.
• Ongoing review: quarterly updates as tools and guidance change.

Most of these are internal hours rather than purchases. External spend usually goes to legal review and, where needed, a consultant to run the first inventory.

There is no reliable published benchmark for marketing teams, and invented figures would mislead. A practical way to budget is to estimate hours. Count tools, count people who use them and estimate time per task. For example, a team with fifteen AI-enabled tools might plan a few days for the inventory, a day or two for classification with counsel, and a recurring half-day each quarter for updates.

Then add legal fees for the cases counsel needs to review, and a small allowance for tool changes if a vendor cannot meet your requirements. Switching a tool mid-year has its own cost in retraining and migrated templates, so include it rather than assuming it will not happen. Companies already running GDPR processes can often extend existing records of processing, which reduces the effort considerably. Keep the estimate in the same sheet as the inventory, so hours and tools can be reviewed together each quarter.

Compliance return is partly avoided cost and partly gained speed. Measures that can be tracked:

• Number of AI tools with complete documentation, rising toward all tools in use.
• Time from vendor request to approval, which should fall once a standard checklist exists.
• Content incidents, such as platform labels applied unexpectedly or takedowns over undisclosed synthetic media.
• Client questionnaires answered without delay, important for agencies and B2B suppliers.
• Staff confidence, checked through a short survey after training.

Penalties under the Act can be significant, with maximum fines set as fixed sums or a share of global turnover depending on the breach. The purpose of measuring is not to multiply that by a guessed probability, but to show the work is done and current.

The less visible cost of ignoring the Act is friction. Procurement teams at larger clients increasingly ask suppliers about AI use. A team that cannot answer loses time on every tender, and sometimes the tender itself. Agencies feel this most, because clients want assurance that the supplier’s AI use will not create obligations or reputational risk for them. A short AI use statement, kept current and backed by the register, answers most of these questions in one document and can be attached to proposals.

Overspending usually comes from treating every AI use as high risk. Buying an enterprise compliance platform for a marketing team that uses a handful of writing and design tools is rarely justified. Another source is repeated legal review of the same question because answers were not written down. A shared register with decisions and dates prevents that. Each entry should note the question, the answer, who gave it and when it should be reviewed again.

Underspending happens too. Teams sometimes skip vendor checks for AI features hidden inside larger platforms, such as CRM or ad tools, and only discover them when a client asks.