Given that 98% of organizations are putting more budget into AI, I’m going to guess your team’s already shipping copy, visuals, and localized campaigns with generative tools.
The EU AI Act’s latest rules could affect how you use and disclose AI. If you’re wondering how this plays out in your daily workflow, I’ve got you.
This guide’s for marketing and creative teams (not lawyers), so we’ll skip the legal jargon with a practical EU AI Act checklist you can start using today.
First, let’s quickly clarify what the EU AI Act is.
What is the EU AI Act?
The EU AI Act is the world’s first regulatory framework for how AI can and can’t be used. It was formally passed in parliament back in March 2024, and rolled out in phases, with most of its rules coming into force in August 2026.
The Act sorts AI systems into a risk register with four categories – unacceptable, high risk, limited risk, and minimal risk. The higher the risk, the stricter the rules. Healthcare, recruitment, credit scoring, law enforcement, critical infrastructure, and safety components in products like medical devices all sit in the high-risk category, and it applies to companies outside the EU too if their campaigns reach EU audiences.
Which EU AI Act rules are most relevant to marketing and creative teams?
While marketing isn’t considered a high risk system, that doesn’t mean marketers are off the hook, there are still transparency rules to follow.
The biggest impact comes from Article 50, which is about informing users when they’re interacting with AI or looking at AI-generated content. Any manipulated image, audio, or video that counts as a deepfake needs a clear label, unless it’s obviously artistic or satirical.
The rule is narrower for AI-generated text. You only need to label it if it informs the public on a matter of public interest, and a genuine human review from a qualified person can exempt you. A quick proofread doesn’t count.
Other rules, including GDPR, consumer protection, copyright, and advertising standards, apply to AI-assisted marketing alongside the EU AI Act.
This article gives a detailed breakdown of what the EU AI Act means for brands.
EU AI Act compliance checklist for marketing and creative teams
Now for the practical part. Here’s an eight-step checklist to keep your content compliant with the EU AI Act.
1. Create an inventory of the AI tools you use
Start with a simple list of every AI tool touching your content including copywriting assistants, image generators, video tools, translation and localization software, research tools, and anything used in campaign production.
For each one, note what it’s used for, who owns it, what data goes in, and how much the output usually gets reworked. A brand compliance software platform can help keep this list current as tools come and go.
2. Understand the risk level and your role
Most marketing and creative teams are users, or “deployers,” of AI tools someone else built, rather than providers of AI systems. That distinction matters, deployers carry lighter obligations than providers, though the exact split still depends on the system’s intended purpose and how you’re using it.
Moving from using AI tools to the development of an in-house model puts you in different territory. Providers of high-risk AI systems need a lot more including a risk management system, a quality management system, technical documentation before launch, and registration in the EU’s public database. Most marketing teams won’t hit this bar, but it’s worth knowing where it sits.
The matrix below gives you a quick read on common content types, though it’s not legal advice, so run disclosures past legal too.
Here’s how to read it:
- Low (green) – no visible AI label expected
- Check (orange) – a visible label is only needed if the piece shows a real person or covers a public-interest topic
- High (red) – a visible label is very likely required, unless a subject matter expert has thoroughly reviewed the content before publishing
Tip: Turn this into a running list of your AI use cases and their risk level, so you’re not deciding the same thing every time.
3. Avoid prohibited AI practices
A small number of AI uses are banned outright as prohibited practices under Article 5 of the EU AI Act. For marketers, this includes subliminal techniques that manipulate someone below their awareness, and AI that exploits a person’s age, disability, or economic situation to distort their decisions.
The concern is around serious incidents of bypassing someone’s judgment, not ordinary personalization like an ad based on browsing history or past purchases.
Other violations in the EU database include social scoring and biometric identification.
4. Check how data and personal information are used
Look at what your team feeds into AI tools: customer data, unreleased campaign creative, copyrighted assets, personal information. Once it leaves your systems, you’re relying on the vendor’s terms for how it’s stored and used.
The EU AI Act sits on top of GDPR, not instead of it. If personal data goes into a prompt, you’re still responsible for how it’s processed, whichever tool you use.
Note: If your organization builds or fine-tunes its own models, data governance and data quality become your job too, keeping training data relevant, accurate, and free of gaps or bias.
5. Keep human oversight over AI-generated content
Publishing AI content straight from the source is asking for trouble. Every piece needs a human review for factual accuracy, brand consistency, bias, anything legally sensitive, and intellectual property risk before it goes live.
This kind of AI content governance is good practice anyway, but under the EU AI Act, it’s a must to avoid an AI disclaimer on written content.
The matrix below helps you decide and track who reviews what. Click the taps to adjust it for your team, then share it with legal, brand, and compliance.
Manage and track every approval with Filestage
Turn this matrix into a real workflow with Filestage. Route each piece to the right reviewers, keep all your versions in one place, and track every decision as it happens.
6. Document your AI use and keep it current
You’ve already got your tool list from step 1, this step is about the trail those tools leave behind, and keeping it current.
Documentation of compliance decisions and incidents is crucial under the EU AI Act. So you should be able to say how AI was involved and who checked any piece of content you publish. Keep audit trails your team can actually find, not scattered across email threads and personal notes.
Compliance isn’t a one-and-done job either. Vendor terms change, models get updated, and guidance keeps evolving. So it requires real time monitoring, ideally by a dedicated person. Some teams formalize this into an AI management system, a broader governance framework of policies for governing AI use company-wide.
7. Label AI-generated content when required
Article 50 requires certain AI-generated content to carry a label – deepfake-style images, video, and audio being the clearest cases. Text informing the public also needs to be labeled unless it’s been through a thorough human review.
Not every AI-assisted asset needs one, a product description drafted with AI and edited by a copywriter is different from a fully AI-generated video passed off as unedited footage. The checker below can help you work out which side you’re on.
Disclaimer: Under the EU AI Act, providers handle machine-readable marking (Art. 50(2)). Deployers must add a visible disclosure in two cases: deepfakes — content resembling a real person, object, place, entity, or event in a way that would falsely appear authentic (Art. 50(4); defined in Art. 3(60)) — and AI-generated text on matters of public interest (Art. 50(4)).
Only the text case can be waived, and only with documented human review by someone holding editorial responsibility. Deepfakes have no such waiver — the sole exceptions are law-enforcement authorization or content that’s evidently artistic, creative, satirical, or fictional.
8. Create a review and approval process for AI-generated content
This checklist works best inside your existing workflow, not bolted on as a final step before publishing.
Teams use content governance software like Filestage to collect feedback, manage versions, and document approvals. Filestage automatically records every decision as part of your System of Evidence, and every approval is logged as a documented human sign-off.
Note: Filestage supports your compliance workflow, but using it doesn’t make you compliant on its own. That comes down to the decisions your team makes at every step above.
Conclusion
Marketing compliance doesn’t mean piling extra steps onto every creative task, it means knowing where AI shows up in your workflow, when extra requirements kick in, and building the right checks into the review process you already run.
I hope this article helps you feel more prepared for AI governance. And if you’d like to govern all your content in one platform, try Filestage for free.
Frequently asked questions
When do marketing teams need to comply with the EU AI Act?
Most rules are already active for marketing within the European Union. The ban on manipulative AI practices started February 2025, and Article 50’s disclosure rules began August 2026, with a grace period to December 2026 for tools already in use.
Does the EU AI Act apply to AI-generated marketing content?
Yes, but not automatically at the highest risk level. Most marketing falls into lower-risk categories, though labeling still applies to deepfakes and public-interest text. Read the full guide on AI content governance for more info.
Do we have to label all AI-generated content?
No. Labeling mainly applies to deepfake-style video or images, and to public-facing text that no qualified person has reviewed. A genuine editorial review can exempt a piece.
Can marketing teams use ChatGPT and other generative AI tools under the EU AI Act?
Yes. The Act doesn’t ban generative AI tools. Some run on general-purpose AI models with their own obligations, mostly on the vendor’s side. Your job is knowing what a tool’s for, keeping human review before publishing, and following transparency rules.
Who is responsible for EU AI Act compliance in a marketing team?
Responsibility usually sits across marketing, legal, and compliance, with one named owner. Bigger organizations often fold this into an existing governance function instead of building something new.
How does the EU AI Act relate to GDPR for marketing teams?
They cover different ground but overlap a lot. GDPR governs personal data, including anything fed into an AI tool. The EU AI Act governs the AI systems themselves. You need to satisfy both.
