Most AI governance advice is written for organisations with a legal department, and it stopped being adequate on 2 August 2026 — the day the EU AI Act's transparency obligations started applying, with penalties attached and specific guidance on what counts as advertising.
Search this topic and you get frameworks. Establish principles. Form a centre of excellence. Ensure responsible use. Almost all of it is vendor-authored, enterprise-shaped and carefully non-specific — which is comfortable to read and impossible to act on if you're a team of six with no compliance function.
There are now dates, thresholds and worked examples. So here's the version with those in it.
This is a practitioner's summary, not legal advice. If your AI use touches regulated claims, real people's likenesses or EU audiences at scale, take proper counsel.
What changed on 2 August 2026
Article 50 of the EU AI Act sets transparency obligations and applies from that date. It is not limited to systems classified as high-risk — it applies to anyone using generative AI in the four situations it covers, and it reaches organisations outside the EU whose content reaches EU audiences.
Penalties run up to €15 million or 3% of worldwide annual turnover. The Commission adopted its final guidelines on 20 July 2026, less than two weeks before the obligations began to apply.
| Situation | Who it lands on | Your likely exposure |
|---|---|---|
| Direct interaction with an AI system | People must be told they're talking to AI | Site chatbots, AI-handled social replies |
| Marking of synthetic content | Providers must mark output machine-readably | Mostly your tool vendors, not you |
| Emotion recognition, biometric categorisation | Deployers must inform people | Rare in marketing; audit if you use it |
| Deepfakes and public-interest text | Deployers must disclose to the person | This is the one that catches marketers |
Two timing details worth knowing. Content generated before 2 August 2026 does not need labelling retroactively. And the marking obligation on providers of systems already on the market before that date carries a transitional period to 2 December 2026 — but that runway covers the provider-side marking obligation only, not the deployer-side disclosure duties, which applied immediately.
"Deepfake" is broader than you think
This is the part that should change what your team does this month, and it's absent from essentially all the governance content currently ranking for this topic.
The Commission's final guidelines give examples of what constitutes a deepfake requiring disclosure. They include AI-generated marketing content that makes a product appear different from reality, digital replicas of real people, and de-aging effects applied to actors.
Advertising can be treated as creative work with a reduced disclosure regime — but only in narrow circumstances, and the guidelines classify most advertising examples as not qualifying for that lighter treatment.
The working assumption to adopt If you used AI to make a product look better than it is, or to reproduce a real person's face or voice, treat it as requiring visible disclosure — and treat the creative carve-out as something you'd need advice to rely on, not a default.
A second point often missed: a machine-readable watermark is not sufficient. The provider's marking obligation and the deployer's disclosure obligation are separate. As the deployer, you must disclose to a person at first exposure at the latest, clearly and perceivably without special tools — a visible or audible label. You cannot rely on metadata your generation tool embedded. The guidance also expects that disclosure to meet applicable accessibility requirements, which is the same standard discussed in web accessibility requirements marketers should know.
Practically, this is most acute for synthetic imagery and video, which is where the state of AI-generated video in marketing has been heading anyway. If you're producing brand assets this way, the labelling question needs answering before the asset ships, not after — a brand and creative decision as much as a legal one.
Runpod
Rent NVIDIA GPUs by the second for AI training, inference and serverless workloads.
Best for: Developers and ML engineers needing affordable, on-demand cloud GPUs
The exemption that covers most of your writing
Good news for anyone anxious about their blog.
The text obligation applies to AI-generated text published to inform the public on matters of public interest — which most commercial content isn't. And even within that scope, there's an exemption where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication.
This is also where a real AI content QA process earns its keep — it converts a compliance posture into an actual practice, and it's the same discipline that keeps output from drifting into the sameness problem.
Tier by consequence, not by tool
The commonest governance mistake is writing rules about tools. Tools change monthly; consequences don't.
Three tiers, defined by what happens if the output is wrong:
- Tier 1 — internal only. Brainstorms, summaries, first drafts, meeting notes, research starting points. Nobody outside sees it. No approval, no logging, no policy beyond the prompt rules below. Governing this tier is how teams kill their own AI adoption.
- Tier 2 — published, low stakes. Social captions, blog drafts, internal-facing pages, ad copy variants. Named human reviewer, factual claims verified, logged. No pre-approval. A good content brief does most of the quality work here before review ever starts.
- Tier 3 — high consequence. Anything with a synthetic likeness, a regulated claim, a statistic used as proof, a product representation, or an EU-facing deepfake. Pre-approval, disclosure decision recorded, second reviewer.
The value of this structure is that Tier 3 stays small. If more than a fraction of your output lands in Tier 3, either your definitions are too broad or your AI use genuinely is high-risk — and both are worth knowing.
Approve a little, log a lot
Approval workflows are where good governance intentions go to become bottlenecks. A queue that adds three days to every social post gets routed around within a fortnight, and then you have no governance at all plus a false sense that you do.
The workable split:
- Pre-approval for Tier 3 only. Small enough volume that a same-day turnaround is realistic.
- Logging for Tier 2. Which tool, who reviewed, what was verified. A shared sheet is sufficient — the point is retrievability if someone asks six months later, not ceremony.
- Nothing for Tier 1, beyond the prompt rules.
Log at the point of publishing rather than at the point of generating. People will not log a prompt; they will tick a field in the workflow they're already using. Governance that requires a separate ritual doesn't survive a busy week — the same reason the workflow thinking in building an AI workflow that saves time insists on fitting existing habits rather than replacing them.
The highest-risk output is a plausible number
Everything above concerns disclosure. This concerns accuracy, and it's where most teams will actually get burned.
Generative models produce statistics that are formatted correctly, attributed confidently and completely fabricated. Marketing content is unusually dense in exactly that kind of claim — market sizes, percentages, growth rates, survey findings. And a fabricated statistic in a published piece is worse than a fabricated sentence, because it gets cited onward and because it's precisely the thing a regulator or a journalist can check.
The rule that works: no number ships without a named source the reviewer opened. Not a source the model cited — a source a person clicked. Models invent citations as fluently as they invent figures, and a plausible-looking reference is not verification.
This applies with extra force to anything you'd class as a claim about your own product, where the disclosure question in tightening ad disclosure rules meets the accuracy question head-on.
What must never go into a prompt
The shortest and most useful section of any AI policy, and the one most teams skip.
- Client-confidential material in any tool without a contract covering it. Agencies especially — this is a client-contract exposure long before it's a regulatory one.
- Personal data about customers, employees or anyone else, unless the tool and the lawful basis are both established.
- Unpublished commercial information — pricing, roadmaps, results, contract terms.
- Anything you'd be uncomfortable seeing in a training set. This is a blunt heuristic and a good one.
Pair that with an approved-tool list, and revisit it quarterly. Most teams have more AI tools in use than anyone has counted, because adoption happens individually — and a governance policy that doesn't know what's actually being used is governing an imaginary team. The prompt practices your team develops are worth sharing internally for the same reason: consistency is easier to govern than improvisation.
Agency and vendor contracts
Easily overlooked and specifically flagged in the guidance around Article 50: check that your creative agency and vendor contracts require flagging of AI-generated content and allocate labelling obligations along the supply chain.
The scenario to avoid is simple. Your agency uses a synthetic model in an asset, doesn't tell you, and you publish it into an EU market. The disclosure obligation sits with the deployer — you — regardless of who generated the content.
Three clauses worth having: disclosure of AI use in delivered work, a warranty on rights and provenance of generated assets, and an obligation to apply required labelling. If you're on the agency side of that conversation, it's part of the same repricing and repositioning discussed in how agencies are pricing AI-assisted work.
Rights and provenance deserve their own attention beyond contract language, and the position is genuinely unsettled — where the copyright rules stand in 2026 covers it separately.
The one-page policy
For a team without a compliance function, this is the whole document. Anything longer will not be read.
- Owner. One named person. Not a committee.
- Approved tools. A list, reviewed quarterly.
- Never in a prompt. The four items above.
- Tiers. What's internal, what's published, what needs pre-approval.
- Disclosure triggers. Synthetic likeness, altered product representation, chatbot interaction. When in doubt, label.
- Claims rule. No number without a source the reviewer opened.
- Editorial responsibility. Every published piece has a named reviewer.
- Logging. Where it goes, and what it records.
- Review date. Because this will be out of date within a year.
Nine lines. A team can read that in two minutes and actually follow it, which is worth more than a forty-page framework nobody opens. If your organisation is large enough that roles need redefining around this, how AI-native teams are being redrawn is the wider picture — and brand trust in the age of AI-generated everything is the reason any of it matters commercially rather than just legally.
The short version
Article 50 of the EU AI Act has applied since 2 August 2026, reaches non-EU organisations whose content reaches EU audiences, and carries penalties up to €15 million or 3% of worldwide turnover. The Commission's guidelines treat AI-generated marketing that makes products look different from reality, digital replicas of real people, and de-aging as deepfakes requiring disclosure — and most advertising does not get the creative carve-out. A machine-readable watermark doesn't discharge your obligation as the publisher; a visible label does. Most written content is covered by the editorial responsibility exemption, provided a named human genuinely reviews it. Tier your policy by consequence rather than tool, pre-approve only the small high-risk set, log the rest at publish time, and never ship a number nobody opened the source for.
The whole thing fits on a page. It's the enterprise framework that doesn't survive contact with a marketing team.
Using AI across content and creative without a policy behind it?
We map where AI touches your output, what needs labelling, and what a workable approval flow looks like.
Map my AI exposure →Frequently asked questions
Do marketing teams have to disclose AI-generated content in the EU?
In specific situations, yes. Article 50 of the EU AI Act applied from 2 August 2026 and covers four cases: direct interaction with an AI system, marking of AI-generated synthetic content, emotion recognition and biometric categorisation, and deepfakes plus AI-generated text published to inform the public on matters of public interest. It reaches organisations outside the EU whose content reaches EU audiences, and penalties run up to EUR 15 million or 3% of worldwide annual turnover.
Does AI-generated advertising count as a deepfake under the EU AI Act?
Often, according to the Commission's final guidelines adopted on 20 July 2026. The examples given include AI-generated marketing content that makes a product appear different from reality, digital replicas of real people, and de-aging effects applied to actors. Advertising can in narrow circumstances be treated as creative work with reduced disclosure, but the guidelines classify most advertising examples as not qualifying for that lighter regime. Assume disclosure applies unless you have specific advice otherwise.
Does an AI-written blog post need a disclosure label?
Usually not, because of the editorial responsibility exemption. Article 50 exempts AI-generated text that has undergone human review or editorial control where a natural or legal person holds editorial responsibility for the publication. The obligation it exempts you from applies to text published to inform the public on matters of public interest, which most commercial content is not in any case. The practical requirement is that a named human genuinely reviews and takes responsibility — not that someone skims it.
Is a machine-readable watermark enough to meet the disclosure requirement?
Not for deployers publishing deepfake content. The marking obligation on providers and the disclosure obligation on deployers are separate. Deployers must disclose to a person at first exposure at the latest, in a clear and distinguishable way that is perceivable without any special tools — a visible or audible label. Relying on embedded metadata added by the tool that generated the content does not satisfy the deployer's own obligation.
What should a small marketing team's AI policy actually contain?
One page, not a framework. It should name who owns the policy, list the approved tools, set out what must never go into a prompt, define which small set of outputs requires pre-approval, state what everything else must log, and specify how AI-generated statistics and claims get verified. Teams without a legal department do not need a centre of excellence — they need a document short enough that people actually read it and specific enough that it answers real questions.
