The EU AI Act is already partially in force, and most marketing teams don’t realize they’re in scope. Here’s what advertisers actually need to know and…
Here’s something that will probably surprise you: part of the EU AI Act is already in force. Not “coming soon.” Already active. And if your marketing team uses ChatGPT, Midjourney, or an AI-powered ad platform, there’s a very good chance you’re already inside its scope without knowing it.
I get why this flies under the radar. Most coverage of the Europe Artificial Intelligence Act comes from law firms writing for other lawyers, or from marketing blogs doing a surface-level “here’s what’s coming” roundup that never touches your actual stack. Neither camp tells you what this means for the Meta Advantage+ campaign you launched last week.
So that’s what I want to do here: translate the legal risk tiers into the tools you actually use, map out what’s urgent versus what’s future planning, and hand you a practical checklist you can run against your stack this week.
Quick direct answer, since I know some of you are skimming: does the Act apply if you just use AI tools rather than build them? Yes. Using ChatGPT, Midjourney, or any AI ad platform makes you a “deployer” under the Act, and the AI literacy obligation (Article 4) has applied to deployers of every size since February 2025.
Strip away the legal density and the AI Act is fairly simple in its logic: it’s the world’s first comprehensive AI regulation (you can read the full text in Regulation (EU) 2024/1689 on EUR-Lex), and it’s risk-based rather than technology-based. It doesn’t ban AI. It regulates how AI is used, based on the potential harm of that specific use case.
That distinction matters more than people give it credit for. The same generative AI model can sit in a “low risk, just disclose it” category when used for ad copy, and in a much heavier category when used for, say, credit scoring. The regulation follows the use case, not the underlying technology.
If this framing feels familiar, it should. The Act’s territorial reach mirrors GDPR almost exactly: if you serve users or customers inside the EU, you’re in scope, regardless of where your company is headquartered. A Shopify brand running out of Austin selling to French customers doesn’t get a pass because the servers, the team, and the incorporation are all US-based.
Once you accept you’re in scope, the next question is how much scope. That’s where the four-tier risk pyramid comes in: Unacceptable, High, Limited, and Minimal risk. Most marketing and martech tools live in the bottom two tiers. Not all of them, though, and that’s precisely where marketers get caught off guard.
Let’s clear up the scope question definitively, because this is where most of the confusion lives.
If your company is based in the EU, you’re automatically in scope, full stop, regardless of headcount or revenue. No exceptions for being a small or scaling brand.
If you’re based outside the EU (the US, the UK, wherever), you’re still in scope the moment you target or serve EU users. Running EU-facing Meta or Google Ads campaigns, shipping to EU customers, or having an agency execute EU market strategy on your behalf all count. Extraterritorial reach, exactly like GDPR.
And here’s the detail that trips up scaling DTC brands specifically: being small doesn’t exempt you from the AI literacy duty. A $2M revenue Shopify brand with a two-person marketing team has the exact same Article 4 obligation as an enterprise with a dedicated legal department. The obligation is proportionate to risk and role, not company size.
Compliance deadlines rarely arrive all at once, and the AI Act follows that same staggered logic (the European Commission’s official regulatory framework page lays out each phase in detail). Knowing what’s already active versus what’s still on the horizon is the difference between a genuine compliance gap and a planning item on next quarter’s roadmap.
February 2025 is the date almost nobody talks about, and it’s the one that matters most right now. This is when prohibited practices became illegal outright, and when the AI literacy obligation came into force. If your team hasn’t done anything about literacy yet, you’re not “getting ahead of a deadline.” You’re behind one.
August 2025 brought obligations for General Purpose AI (GPAI) models, the foundation models behind tools like GPT, Gemini, and the models powering ad platforms. These obligations land primarily on the vendors (OpenAI, Google, Meta), but they have downstream implications for you as a deployer, since vendors are now required to be more transparent about how their models work and what data trained them.
August 2026 is the date most enterprise compliance teams are circling, because this is when the bulk of high-risk system obligations become enforceable. If any part of your stack touches genuinely high-risk categories (which, for most DTC marketers, is unlikely but worth ruling out), this is your real deadline.
August 2027 closes out the phase-in for high-risk AI embedded inside regulated products, like medical devices or industrial machinery. Honestly, for most eCommerce marketers this one is background noise, but I’m including it for completeness.
Here’s the section that actually answers “where does my stack land?”
The good news first: most generative AI copy and image tools, most chatbots, and most recommendation engines sit in Minimal or Limited risk. That means transparency obligations, not bans and not heavy documentation burdens. You disclose, you label, you move on with your campaign.
What does “transparency obligation” actually mean in practice? It means disclosing when content is AI-generated, particularly synthetic imagery used in ads. Users need to be told clearly when they’re interacting with a chatbot rather than a human. And synthetic or manipulated media needs to be labeled where a reasonable user might otherwise assume it’s authentic. None of this requires abandoning the tools. It requires being upfront about using them.
That said, there are grey zones marketers consistently underestimate, and this is where I’d focus your attention. Emotion recognition used in ad creative testing or optimization, certain forms of biometric categorization for targeting, and personalization techniques that lean into manipulative “dark pattern” territory (exploiting vulnerabilities like age, disability, or financial hardship to nudge purchases) can tip out of Limited risk entirely.
Why does this matter if the platform itself isn’t classified as high-risk? Because risk classification under the Act often follows the specific use, not just the tool. A platform can be low-risk in general and still produce a high-risk (or outright prohibited) outcome depending on how a specific feature gets deployed. If your creative team is running facial-expression-based ad testing to infer emotional response, that specific application deserves a second look, even if the underlying software is a mainstream martech vendor.
For completeness, here’s what’s explicitly banned outright: social scoring systems, manipulative techniques that exploit vulnerabilities, and real-time biometric identification in public spaces. Most DTC marketers will never come near these in daily operations, but it’s worth formally ruling them out rather than assuming.
This is the section I most want you to walk away remembering, because it’s the most actionable and the most overlooked requirement in the entire regulation.
Article 4 requires that companies ensure staff and anyone operating AI systems have “adequate AI literacy” relative to their role. Not a certification. Not a law degree. A working understanding of what the tool does, how it can fail, and when a human needs to step in.
Here’s the part that should get your attention: this isn’t a future deadline you’re planning around. It’s been in force since February 2025. Which means most marketing teams using AI tools daily are, right now, technically non-compliant without realizing it.
And critically, this applies even if your team isn’t building anything. You don’t need to train a model to trigger this obligation. Simply using ChatGPT for ad copy, Midjourney for creative concepts, or an AI-powered ad platform for audience targeting triggers the duty to train your staff on how these tools function, where they tend to fail, and what risks they carry.
It’s understanding what the tool is actually doing under the hood (even at a basic level), knowing its common failure modes (hallucinated claims in AI-written copy, biased outputs in AI-generated imagery, biases baked into predictive audience models), knowing when a human needs to review output before it goes live, and understanding the basic data-handling implications of feeding customer information into third-party AI tools.
If you’re a scaling DTC brand wondering where to start, start here. Building AI literacy across your team is low-cost, fast to implement, and directly satisfies a legal obligation, unlike a full governance overhaul that takes months. If you want a structured framework for this rather than building it from scratch, our team at Midsummer Agency runs AI consulting engagements specifically designed to get marketing teams literate and compliant without slowing down campaign output.
Theory is fine, but let’s ground this in the tools sitting in your actual tech stack right now.
AI-generated ad creative and copy (Meta Advantage+, Google Performance Max, Midjourney) generally sits in Limited risk. The practical requirement is transparency labeling, particularly for synthetic imagery that could be mistaken for a real photograph. This isn’t a reason to stop using these tools; it’s a reason to build a disclosure habit into your creative workflow.
Chatbots and conversational AI on your Shopify storefront carry a specific transparency requirement: customers must be clearly told they’re talking to a bot, not a human agent. If your customer service widget doesn’t disclose this today, that’s your fastest fix. It’s a one-line UI update, not a project.
Predictive audiences, lookalike modeling, and dynamic pricing algorithms generally sit in Limited or Minimal risk, but there’s a genuine flag to watch: if AI is used to infer sensitive characteristics (health status, ethnicity, sexual orientation) for targeting purposes, even indirectly through proxy data, that use case can shade into higher-risk scoring behavior. Most out-of-the-box lookalike audience tools don’t do this explicitly, but custom-built predictive models sometimes do without the team realizing it.
AI-powered personalization and recommendation engines, whether that’s product recommendations, email send-time optimization, or on-site merchandising, mostly sit in Minimal risk. Still, it’s worth pulling your vendor’s own documentation to see how they classify their risk tier. If you’re exploring how far these tools can push performance metrics like AOV, we’ve covered practical applications in our piece on the best AI tools to increase AOV.
The takeaway across all four categories is consistent: the overwhelming majority of common marketing use cases require disclosure and documentation, not abandonment. Nobody’s asking you to turn off Performance Max.
This is the part law firm content never gives you: a working table you can actually run against your stack this week.
The purpose here isn’t legal certainty (that’s what actual counsel is for on edge cases). It’s a fast internal audit tool that maps your common use cases to a risk tier and a concrete next action, so nothing quietly falls through the cracks during a busy scaling phase.
| Use Case | Risk Tier | Required Action | Suggested Owner |
|---|---|---|---|
| AI chatbot / conversational CX | Limited | Add clear “you’re talking to a bot” disclosure at conversation start | CX / Marketing lead |
| AI-generated ad imagery/copy | Limited | Label synthetic imagery where reasonably likely to be mistaken for real; document tool used | Creative / Paid Media |
| Predictive audiences / lookalikes | Minimal-Limited | Audit whether model infers sensitive characteristics; document data inputs | Marketing Ops |
| Emotion-based ad creative testing | Grey zone / potentially High | Legal review before deployment; consider alternative testing methods | Marketing + Legal |
| Product recommendation engine | Minimal | Review vendor’s own risk classification documentation | Marketing Ops |
| General AI tool usage (ChatGPT, Midjourney, etc.) | N/A (Article 4 applies regardless) | Deliver AI literacy training to any staff operating these tools | Leadership / HR + Marketing |
Run this as an internal exercise across every AI tool currently touching your marketing, ads, and customer experience stack, not just the obvious ones like your ad platform. Half the exposure I see in client audits comes from a “shadow AI” tool someone on the team started using without anyone flagging it for review.
And critically, assign clear ownership. During a scaling phase, “someone should probably look at this eventually” is how compliance gaps turn into actual fines. Whether that owner sits inside marketing ops, legal, or an external compliance partner, make sure it’s a name, not a department.
If you’ve already invested in GDPR compliance, I have good news and one important clarification.
The good news: your GDPR infrastructure, your data mapping, your consent management setup, your DPO relationship, is not wasted effort. It’s a strong foundation to build on.
The clarification: the AI Act doesn’t replace GDPR, it stacks on top of it (see the official GDPR overview for a refresher on the baseline obligations you’re already required to meet). GDPR governs how you collect, store, and consent to use personal data. The AI Act governs how AI systems behave and what they disclose about that behavior. These are related but distinct legal layers, and passing one doesn’t automatically satisfy the other.
Here’s a concrete example of how this plays out. A personalization engine can be fully GDPR-compliant, with proper consent flows and appropriate data minimization, and still fail AI Act transparency requirements if it never discloses to the user that AI is driving the recommendations they’re seeing. Two separate obligations, two separate audits.
I bring this up because I’ve seen teams assume “we already did our GDPR review, we’re covered.” You’re not. Think of GDPR as the hull of the ship and the AI Act as the rigging: both need to be sound, and checking one doesn’t tell you anything about the other.
Let’s talk numbers, factually and without the fear-mongering that dominates a lot of coverage on this topic.
The top tier is real: fines of up to €35 million or 7% of global annual turnover for violations involving prohibited practices. That’s the ceiling reserved for the most severe category, the outright bans we covered earlier (social scoring, manipulative exploitation, unlawful biometric surveillance).
Below that ceiling, there’s a tiered fine structure scaled to severity. High-risk system non-compliance and transparency failures (a missing chatbot disclosure, an unlabeled synthetic ad image) sit at lower tiers, proportionate to the actual violation.
For context relevant to a scaling $1M-$20M DTC brand: you’re not likely to hit the top fine tier over a missed chatbot disclosure. But the reputational and operational risk is real regardless of the fine amount. Platform-level enforcement, EU market access complications, and the operational cost of retrofitting compliance under regulatory pressure are all more disruptive to a scaling brand than most people assume.
Enforcement is still ramping up, which is precisely why now is the cheap moment to act. Fixing a gap during a calm quarter costs a fraction of what fixing it looks like once regulators (or a competitor’s complaint) put you under a spotlight.
If you take one thing from this article, let it be this: start with an inventory. List every AI tool currently touching marketing, ads, and customer experience, note the vendor, the specific use case, and what data flows through it. You can’t manage risk you haven’t mapped.
From there, do a round of vendor due diligence. Ask your AI tool providers directly how they classify their own risk tier under the Act and what compliance documentation or support they offer. Most serious vendors have already prepared an answer to this question; if yours hasn’t, that’s information too.
Then build a training cadence, and keep it lightweight. A quarterly session covering tool updates, known failure modes, and any new risks satisfies the spirit of Article 4 far better than a one-time onboarding document nobody rereads.
Here’s my honest take on all of this, coming from someone who spends most days building and deploying AI workflows for clients: compliance shouldn’t be treated as a bolt-on legal exercise, something you tack on after the fact to avoid a fine. Done right, it’s a natural byproduct of good AI governance. Teams that actually understand the tools they’re using (their strengths, their blind spots, when to double-check the output) don’t just stay compliant. They get better results from the same tools, because they’re not deploying AI blind. Think of it less like a legal hurdle and more like corner work in boxing: the fighters who train their footwork and their guard aren’t doing it because a rulebook demands it, they’re doing it because it’s how you actually win rounds without getting caught off balance.
If you want structured support building AI literacy and governance into your marketing workflow rather than piecing it together ad hoc, our team can help you map your stack, identify where you sit on the risk pyramid, and build training that fits how your team actually works. For teams building more complex internal AI workflows on top of this foundation, our AI automation practice can help you design systems that are compliant from the ground up rather than retrofitted later.
Ready to see where your AI stack actually stands? Reach out and let’s map your risk exposure together, or browse more AI-in-marketing breakdowns on our blog if you want to keep building your literacy before you talk to anyone.
