The EU AI Act is the European Union’s regulation on artificial intelligence, which entered into force in 2024 and applies in stages. It sorts AI systems by risk, bans some practices outright, sets strict duties for high-risk uses and adds transparency rules for chatbots and synthetic content. For marketing and PR teams, the main obligations are disclosure, AI literacy and avoiding prohibited manipulative techniques.
Many marketers assume the Act is a matter for software vendors. Partly true: the heaviest duties fall on providers of high-risk systems and general-purpose AI models. But companies that use AI, called deployers in the Act, also carry duties, and the Act reaches businesses outside the EU when their AI systems or outputs are used in the EU. A Turkish agency running campaigns for EU audiences is in scope for those parts.
How does the Act classify AI risk?
The Act uses four broad tiers. Understanding where marketing tools fall saves a lot of worry.
- Unacceptable risk: banned practices, including manipulative techniques that materially distort behaviour and cause significant harm, and exploiting vulnerabilities such as age.
- High risk: uses listed in the Act, such as AI in hiring, credit scoring and access to essential services, with conformity and documentation duties.
- Limited risk: systems with transparency duties, such as chatbots and generators of synthetic content.
- Minimal risk: most other uses, such as spam filters or content recommendations, with no new specific duties.
Most marketing AI, including copywriting assistants, image generators, ad optimisation and analytics, sits in the limited or minimal tiers. The exceptions to watch are AI in recruitment marketing, where screening tools may be high risk, and personalisation that crosses into manipulation of vulnerable groups.
What transparency duties affect marketers?
Two duties matter most. People must be told when they are interacting with an AI system, such as a chatbot, unless it is obvious from context. And deployers who publish deepfakes, meaning AI-generated or manipulated images, audio or video that resemble real people, places or events, must disclose that the content is artificial, with some allowances for clearly artistic or satirical work.
Text generated by AI and published to inform the public on matters of public interest also carries a disclosure duty, unless it has gone through human editorial review and someone holds editorial responsibility. For PR teams writing press materials with AI help, a documented human review step is therefore worth keeping.
Providers of generative systems must also mark outputs in a machine-readable way where technically feasible, which is one reason standards such as C2PA Content Credentials and watermarking are spreading.
When do the rules apply?
The Act applies in phases. Prohibitions and AI literacy obligations came first, followed by rules for general-purpose AI models, then most other obligations including transparency duties. The European Commission has also discussed adjustments to some timelines. Because dates and guidance continue to be refined, check the Commission’s AI Act pages or legal advice for the current schedule rather than relying on a blog post, including this one.
What is the AI literacy duty?
Providers and deployers must take measures to ensure a sufficient level of AI literacy among staff who operate or use AI systems on their behalf. The Act does not prescribe a course or certificate. In practice, this means people using AI tools should understand what the tools do, their limits and the company’s rules for using them.
For a marketing team, a short internal guide and a training session, refreshed when tools change, is a reasonable starting point. Keep a record of who attended. If a regulator or client asks, you can show what was done.
Which governance rules should marketing teams set first?
Start with an inventory and a few clear rules. Governance does not need to be heavy to be useful.
- AI inventory: list every AI tool in use, its purpose and who owns it.
- Disclosure standard: agreed labels for chatbots, synthetic images, avatars and voice clones.
- Human review rule for public-facing text, especially press releases and public interest content.
- Prohibited uses list: no deceptive deepfakes of real people, no targeting based on vulnerabilities.
- Vendor checks: ask providers about their AI Act compliance and output marking.
- Training record for AI literacy.
The inventory is often the most revealing step. Teams usually discover more tools than expected, including AI features switched on by default inside existing software.
What are the limits of the Act for marketers?
The Act does not replace other laws. GDPR still governs personal data in AI tools, consumer protection law still governs misleading advertising, and copyright questions around training data and outputs are handled largely outside the Act. A campaign can comply with the AI Act and still break GDPR.
The Act also leaves room for interpretation, and guidance from the Commission and national authorities continues to appear. Expect your rules to need updating.
Contracts are a practical lever too. When agencies or freelancers produce content with AI on your behalf, add a clause requiring them to follow your disclosure standard and to tell you which tools they used. That keeps your inventory accurate without extra audits.
How Alien Road applies the EU AI Act
In a typical engagement, discovery starts with an AI inventory across the client’s marketing, PR and customer service work, including tools the agency itself uses on their behalf. We note each tool’s tier and any disclosure duty.
Setup means agreeing a disclosure standard per channel, adding a documented human review step for press and public content, keeping Content Credentials on generated media where tools support it and running a short AI literacy session for the client team. Legal interpretation stays with the client’s counsel; our role is operational.
Reporting includes a quarterly inventory update and a log of disclosure decisions, so the client has a record ready if a partner, platform or authority asks.
Where to start this week
Create a simple spreadsheet with four columns: tool, purpose, owner, and whether its output reaches the public. Ask each team member to add every AI tool they use. That list is your first compliance document.
Then mark every row where output reaches the public and decide its disclosure label. You will have covered the duties most likely to affect a marketing team before any lawyer bills an hour.
Keep reading: PR Services · Digital PR