The EU AI Act, formally Regulation (EU) 2024/1689, has moved from policy project to daily compliance question for digital marketers. After the Digital Omnibus rewrite in mid-2026, the rulebook kept its general application date of August 2, 2026, but pushed the two high-risk deadlines further out. For most advertisers, though, the immediate issue is narrower: synthetic ads and AI-generated content now carry a labelling duty with a real fine attached.
The 2026 timetable, in plain terms
The Act sorts AI by risk rather than technology. Prohibited practices such as social scoring, exploitative manipulation and most real-time biometric identification in public spaces have been banned since February 2, 2025. Article 50 transparency duties went live on August 2, 2026: chatbots must disclose they are machines, generative outputs must be machine-readable, and deepfakes must be labelled.
Here is the schedule that matters right now:
- Prohibited practices: in force since February 2, 2025.
- Article 50 transparency and general application: live since August 2, 2026.
- Existing generative systems on the EU market: marking deadline December 2, 2026.
- Annex III high-risk obligations: deferred to December 2, 2027.
- Annex I high-risk obligations: deferred to August 2, 2028.
Fines are tiered: up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, 15 million euros or 3% for most other breaches, and 7.5 million euros or 1% for incorrect information.
Where the AI Act actually bites marketers
Most marketing AI, such as bid optimisation and copy generation, sits outside the high-risk list. Three routes pull the Act into an ad team’s workflow. First, any marketer or agency publishing an AI-generated deepfake, including a synthetic spokesperson, must disclose it. The Commission’s July 2026 guidelines explicitly deny commercial advertising the lighter regime available to artistic works. Second, the supply chain: ad platforms are treated as providers, advertisers as deployers, and since July 2026 the AI Office has exclusive supervision over ranking, creative and bidding systems inside very large platforms. Third, the boundary zone: candidate filtering, credit scoring, and personalisation that exploits vulnerabilities inch into high-risk or prohibited territory.
Thierry Breton, then internal market commissioner, captured the ambition when the Act was agreed: “Historic! The EU becomes the very first continent to set clear rules for the use of AI.” For marketing teams, that clarity now looks like compliance checklists.
What to do before the next deadline
Treat every synthetic face, voice or scene as a disclosure event, not an afterthought. Run a pre-flight check before media goes live: if an asset is AI-generated or a deepfake, label it in line with Article 50. Map which tools in your stack count as providers or high-risk deployers. Keep credit scoring, candidate filtering and vulnerability-based personalisation quarantined from ordinary performance marketing experiments.
Do not wait for national regulators to align. As of April 2026, only Denmark, Finland and Italy had national AI laws in force, according to Cullen International, and Germany’s BVDW has flagged jurisdictional conflicts. The first harmonised standard, EN 18286 on quality management, was not referenced until October 14, 2026, so standards and enforcement are still catching up with the law.
The open loop
On October 12, 2026, the Commission opened a consultation on procedural rules that would restart the five-year limitation clock for fines after certain investigative steps. Two days later, the AI Office sent requests for information to OpenAI and Anthropic after incidents involving AI agents. Requests are not findings of breach, but they signal where scrutiny is heading. December 2, 2026 is the next fixed date: the labelling catch-up for legacy generative systems and new bans on non-consensual intimate imagery and child sexual abuse material take effect.
Source: PPC Land
