AI governance used to be a boardroom buzzword. It is now a deadline-driven operating problem for marketing teams – and the first hard date is December 2, 2026.
Under the EU AI Act, that is when new prohibitions and the generative-output marking rules arrive. The real weight comes later: high-risk obligations for standalone Annex III systems move to December 2, 2027, and for AI embedded in regulated products to August 2, 2028 after the EU’s Digital Omnibus pushed back the original dates.
For performance marketers, this is not legal noise. Annex III touches the targeting of job ads and credit and insurance pricing, while Article 5’s ban on manipulative or exploitative AI sits uncomfortably close to persuasion optimisation.
The gap: adoption outruns control
DigiCert’s May 2026 survey of 1,001 IT and security decision-makers found 78% had already suffered an AI-related security incident or vulnerability, but only 64% had an inventory of their AI systems. The same poll found 90% had discussed AI governance at board level, yet only half had both a budget and a formal programme.
That is the governance gap in one paragraph: boards are talking, tools are spreading, and nobody has counted what is live. WSJ Intelligence and Code and Theory found 25% of executives at large US firms said no one is accountable for AI orchestration – while the average organisation runs 183 AI tools.
What a working programme looks like
You do not need a 40-page policy. You need four controls in sequence:
- Inventory every built, bought and SaaS-delivered AI tool, including shadow AI.
- Classify each by potential harm, from minimal-risk tools to anything touching consumers, budgets or regulated audiences.
- Assign one owner with authority to approve use cases and data flows.
- Monitor outputs, vendor updates and drift after deployment.
Ad tech already shows what that looks like. Fluency, which manages $3 billion in annual media spend, keeps large language models away from live budget execution and lets only deterministic agents that follow advertiser-set rules spend. PubMatic adds execution-point guardrails, and Yahoo DSP ships agents with audit trails and human approval.
Pick a framework and steal its structure
Three references cover most programmes. The voluntary NIST AI Risk Management Framework uses four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 gives a certifiable Plan-Do-Check-Act management system. The EU AI Act is the binding one, with fines up to €35 million or 7% of global turnover for prohibited practices, and lower tiers of €15 million or 3% for most breaches.
Divergence is already here: Meta declined to sign the EU’s General-Purpose AI Code of Practice, with chief global affairs officer Joel Kaplan saying Europe is ‘heading down the wrong path on AI.’ For marketers the most important enforcement twist is that the AI Office can impose periodic penalties of up to 5% of average daily turnover on very large online platforms – the main ad-selling platforms included.
What to do this quarter
Start with the inventory, because if you cannot list the tool, you cannot govern it. Then use the IAB’s transparency framework as a lightweight disclosure layer where AI could mislead consumers about authenticity or identity before regulators make disclosure mandatory.
Source: PPC Land
