The EU AI Act Hits Marketing Teams: A Practical Compliance Checklist
Transparency obligations for synthetic content and chatbots now touch everyday campaign work. Here's what a small marketing team actually has to do — without hiring a legal department.
Key takeaways
- ✓Chatbots and AI assistants must make their non-human nature clear to users.
- ✓Realistic synthetic images, audio, and video need machine-readable and user-visible disclosure.
- ✓GDPR still governs the data you feed models — consent, minimisation, and lawful basis do not disappear.
- ✓Keep an internal register of AI tools, use cases, data flows, and human review steps; it makes any audit trivial.
Which obligations actually apply to marketing
Marketing rarely touches the high-risk categories the Act is most concerned with. What it does touch constantly is the transparency tier: conversational interfaces, synthetic media, and content that could mislead a person about whether a human made it.
In practice that means three habits. Label your bots. Label your synthetic media. Keep a record of what you use, where, and who checks it.
The checklist for a small team
- ●Add a clear 'you are chatting with an AI assistant' notice to every automated chat entry point, plus a route to a human.
- ●Apply provenance metadata and a visible label to photoreal AI-generated or AI-altered images, audio, and video.
- ●Maintain an AI use register: tool, purpose, data categories, model provider, human reviewer.
- ●Document a human-in-the-loop step for anything customer-facing or claim-bearing.
- ●Update your privacy notice to describe AI-assisted processing and profiling in plain language.
Where GDPR is still the bigger constraint
For most marketing teams the sharper risk is not the AI Act but the data protection basics underneath it: pushing customer data into third-party tools without a lawful basis or a processing agreement, using special-category inferences for targeting, or building profiles beyond what people were told.
Before adding any AI tool to the stack, answer two questions in writing: what personal data enters it, and what contractual and legal basis covers that transfer. If either answer is unclear, do not connect it to your customer records.
What good looks like in practice
- ●A one-page internal AI policy every team member has actually read.
- ●Disclosure applied consistently rather than case by case.
- ●Prompt, model, and source records kept for published creative.
- ●An annual review of the tool register with dead tools disconnected and access revoked.
Frequently asked questions
Do I have to label every AI-assisted marketing asset?+
No. The obligation targets realistic synthetic or manipulated media that could mislead people about authenticity. AI-assisted drafting of ordinary copy does not require a public label, though internal records are still good practice.
Does the EU AI Act apply to a non-EU business?+
It can, where AI output is provided to or affects people in the EU. Territorial reach works similarly to GDPR, so market-facing use in the EU is generally in scope.
What is the fastest way to become defensibly compliant?+
Write the AI use register, add chatbot and synthetic media disclosures, and document a human review step for customer-facing output. Those three items cover most of what an auditor asks a marketing team for.
Sources
- [1]Regulatory framework on artificial intelligence — European Commission
- [2]Automated decision-making and profiling guidance — UK Information Commissioner's Office (ICO)
- [3]Content credentials and provenance standard — Coalition for Content Provenance and Authenticity (C2PA)