The EU AI Act vs Traditional Tools: What Changes for Marketing Teams

The regulation entered into force in August 2024 and applies in stages over several years. It sorts AI systems into categories: prohibited practices, high-risk systems, systems with specific transparency obligations, and minimal-risk systems. Separate rules cover general-purpose AI models, such as the large language models behind chat assistants.

For most marketing use, the relevant parts are the prohibited practices, the transparency rules and the general duty for organisations to ensure staff using AI have adequate AI literacy. High-risk categories mostly concern areas such as hiring, credit scoring, education and critical infrastructure, although some marketing-adjacent uses can come close, for example tools that profile people in sensitive ways.

This article is a practical overview, not legal advice. Application dates and guidance continue to develop, so confirm current obligations with a qualified lawyer for your situation.

The law reaches companies outside the EU when their AI systems are placed on the EU market or their outputs are used in the EU. A Turkish or US brand running AI-driven campaigns aimed at EU customers should assume it applies.

Areas where marketers should pay attention:

• Chatbots and virtual assistants: people should be told they are interacting with an AI system unless it is obvious.
• AI-generated or altered images, audio and video that could be mistaken for real (deepfakes) need disclosure.
• AI-generated text published to inform the public on matters of public interest has disclosure duties, with exceptions where there is human editorial control.
• Manipulative techniques that exploit vulnerabilities, such as age or disability, to distort behaviour in harmful ways are prohibited.
• Emotion recognition in workplaces and schools is restricted, which matters for some audience research tools.

Traditional tools, meaning rule-based software without machine learning at their core, fall largely outside the AI Act. A segmentation built on fixed rules in your CRM, an A/B test, or a scheduled newsletter does not need AI Act paperwork.

Staying traditional makes sense where:

• The task is simple and rules-based, so AI adds little.
• You need fully explainable decisions, such as eligibility for a regulated offer.
• The audience includes vulnerable groups and the risk of manipulation claims is high.
• Your team lacks the time to document, disclose and supervise AI output properly.

When switching to AI is reasonable

• The work is high-volume content or analysis with human review before publishing.
• Disclosure is easy to add, for example a label on an AI chat widget.
• The vendor provides clear documentation of how the system works and what data it uses.
• You can assign someone to own AI use policy and training.

The AI Act sits alongside the General Data Protection Regulation, not instead of it. If an AI tool processes personal data, GDPR rules on lawful basis, transparency, data minimisation and individual rights still apply. Automated decisions with legal or similarly significant effects already carry extra GDPR protections.

In marketing terms, that means a personalisation engine using customer histories must satisfy GDPR, and if it uses AI, the AI Act’s relevant provisions too. Vendor contracts should cover both.

Providers of AI systems and general-purpose models carry their own obligations, including technical documentation and, for general-purpose models, information for downstream users. As a buyer, ask vendors for documentation on intended use, known limitations, data handling and how they support your transparency duties.

A vendor that cannot answer basic questions about where data goes or how outputs are produced is a risk, regardless of regulation.

The Act asks providers and deployers of AI systems to take measures so that staff dealing with those systems have a sufficient level of AI literacy. The text does not prescribe a course or a certificate. For a marketing department, a reasonable reading is that people using AI tools understand what the tools do, where they make mistakes, and which rules apply to their outputs.

A short, documented session covers most of this: how generative models produce errors, why every fact needs checking, which uses require disclosure, and who to ask when unsure. Keep attendance records and a copy of the material. Repeat it when the team adopts a new kind of tool, such as video generation or an autonomous agent.

Freelancers and agencies working on your account count too. Ask them how they handle AI use, and include the expectation in contracts.

Documentation does not need to be heavy. One page per tool is enough for minimal-risk marketing uses: what the tool is, the vendor, what it is used for, what data goes in, who reviews outputs, and which disclosures apply. Update it when use changes.

That record helps beyond compliance. When a campaign goes wrong or a customer complains, you can show what the tool did and who signed off, which is far better than reconstructing events from memory.