EU AI Act for AI providers in marketing & advertising

This guide maps the EU AI Act (Regulation (EU) 2024/1689, as amended by the 2026 Digital Omnibus) to the AI systems AI providers actually run in marketing & advertising: which uses are high-risk, which only carry transparency duties, and what is due by when. It reflects the post-Omnibus dates — the high-risk regime now applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), while Article 50 transparency has applied since 2 August 2026.

Are you the provider?

You are a provider if you develop an AI system (or have one developed) and place it on the market or put it into service under your own name or trade mark — including SaaS companies shipping AI features built on third-party models (Article 3(3)).

Providers carry the heaviest obligations: for high-risk systems the full Chapter III regime (risk management, data governance, technical documentation, conformity assessment, CE marking, registration), and for generative systems the Article 50(2) machine-readable marking duty. If your organisation also acts as a deployer, read the companion guide for AI deployers in marketing & advertising too — many companies are both.

Typical AI uses in marketing & advertising

• AI-generated ad creatives, images and video
• synthetic voice-overs and avatar spokespersons
• personalised copywriting at scale
• social-media content pipelines

High-risk triggers in marketing & advertising

Typical AI uses in this industry do not fall into the Annex III high-risk categories — the practical workload is the Article 50 transparency tier below. Re-check if you expand into employment screening, credit, education scoring or other Annex III contexts, and remember Article 6(3) edge cases cut both ways.

Transparency duties (Article 50) — since 2 August 2026

• Synthetic ad media must carry machine-readable marking from the generating system's provider (Article 50(2)).
• Realistic synthetic depictions of people — avatar spokespersons, cloned voices, staged 'testimonials' — are deep fakes requiring a visible disclosure by the deployer (Article 50(4)).
• Manipulative techniques that materially distort behaviour and cause significant harm cross into the Article 5 prohibition.

Your timeline (post-Digital-Omnibus)

• 2 February 2025 — prohibitions (Article 5) and AI literacy (Article 4) apply. Already in force.
• 2 August 2025 — GPAI model rules (Chapter V) apply.
• 2 August 2026 — general application: Article 50 transparency, governance, penalties. In force.
• 2 December 2026 — Article 50(2) marking grace period ends for systems on the market before 2 August 2026; new Omnibus prohibitions apply.
• 2 December 2027 — high-risk obligations for Annex III systems (moved from 2 August 2026 by the Digital Omnibus).
• 2 August 2028 — high-risk obligations for AI embedded in Annex I regulated products (moved from 2 August 2027).

Penalties

Prohibited practices: up to €35,000,000 or 7% of worldwide annual turnover (Article 99(3)). High-risk and transparency breaches: up to €15,000,000 or 3% (Article 99(4)), whichever is higher. See what you actually risk in practice.

Next step: get your specific list

The fastest way to turn this into your own obligation list is the free 3-minute EU AI Act risk self-assessment — risk tier, obligations with article references, personalised timeline and penalty exposure. If your exposure is chatbots or AI-generated content, the Article 50 checker goes clause by clause.

← All role & industry guides