The EU AI Act for marketing: which deadline applies when

On 2 August 2026 the 24 month transition period for the central obligations of the AI Act came to an end. Two things changed that day. First, the transparency obligations under Article 50(1) became applicable, meaning the disclosure duties for chatbots, deepfakes and emotion recognition. Second, national market surveillance began, which is what makes the penalty framework of the regulation practically reachable.

What that does not mean is that audits started on a broad front that day. Supervisory structures in Germany are still being built, and the national implementing act that formally designates the Bundesnetzagentur had not been adopted at the editorial cut-off of this guide. Anyone who concludes from that that nothing is happening is confusing the moment of the first audit with the moment an obligation comes into being. The obligation exists whether or not it is checked, and a breach remains a breach even if it surfaces later.

For marketing teams the practical consequence is narrow and concrete. If you run a chatbot with an AI backend on your website, you need a recognisable notice at the point of contact itself. A line in the privacy policy is not enough, because that covers the data protection side rather than the transparency obligation of the AI Act. If you produce photorealistic depictions of real people, you need clear labelling. Both are craft, not a legal opinion.

In the public debate August 2026 is the date everyone writes about. For marketing, December 2026 is the more important one, because that is when the obligation that genuinely reaches into every image and video workflow takes effect.

Machine-readable labelling under Article 50(2). Providers of generative systems must ensure that their outputs are marked in a machine-readable format as artificially generated or manipulated. The Digital Omnibus Regulation differentiated the scope of this obligation according to when a system entered the market. For deployers the practical consequence is one thing above all: the metadata your tool supplies must not be lost inside your production chain. That is exactly what happens in practice all the time, because image editing, compression and content management systems strip metadata as a matter of routine.

Two new prohibited practices under Article 5. The Digital Omnibus Regulation adds AI systems that generate non-consensual intimate imagery and systems that generate child sexual abuse material to the list of prohibitions. Both sit in the highest penalty tier at up to 35 million euro. For legitimate marketing this is not a change of behaviour, but it is a signal about where enforcement is aimed: at generative imaging.

Anyone who checks today whether their image pipeline preserves provenance metadata has until December to repair it. Anyone who starts in November checks under time pressure. The check itself takes a few hours.

Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal of the European Union on 24 July and entered into force on 27 July 2026. It amends more than 40 articles of the AI Act. The reason was sober: the harmonised technical standards, without which a conformity assessment is not practically feasible, were not available in time.

High-risk deadlines postponed. Standalone systems under Annex III apply from 2 December 2027, product-embedded systems under Annex I from 2 August 2028. Neither affects marketing directly in most cases, but both touch adjacent areas such as AI supported recruitment or credit assessment.

The definition of high-risk was narrowed. Systems that support users, automate workflows or serve quality control now count as high-risk only where their failure or malfunction can actually create risks to health or safety. A number of previously covered applications fall out of scope.

Article 4 was recast, not deleted. The original wording required organisations to ensure a sufficient level of AI literacy. That is an obligation of result. The new wording requires them to support the development of that literacy, without having to guarantee a particular level for every individual. The obligation has applied since 2 February 2025 and continues to apply; what has eased is the pressure to evidence the outcome of individual training. The practical advice barely changes: a documented, role-appropriate training concept remains the simplest way to be able to answer questions in an audit, and it has operational value independently of the legal position.

The EU AI Office gained its own powers. Investigation, inspection and enforcement now sit there as well, which makes it effectively a market surveillance authority in its own right. For mid-sized companies the national authority remains the first point of contact, but the old rule of thumb that the AI Office is only concerned with the large model providers no longer holds.

Relief for small mid-caps. The privileges previously reserved for SMEs, including simplified technical documentation and the adjusted penalty ceilings under Article 99(6), were extended to companies with fewer than 750 employees and less than 150 million euro in annual turnover or less than 129 million euro in balance sheet total.

What the Digital Omnibus did not postpone are the transparency obligations under Article 50(1). The headline that the EU has delayed its AI rules does not translate into a reprieve for marketing and customer communication.

The EU AI Act distinguishes several roles, of which two matter in practice for mid-sized marketing teams: provider and deployer. Getting the classification right determines which obligations reach you and how extensive your setup has to be.

A provider is anyone who develops an AI system, or has it developed, and places it on the market under their own name or trade mark. That means OpenAI, Anthropic, Google and Microsoft, but also European providers such as Aleph Alpha or DeepL. The provider obligations are extensive: technical documentation, conformity assessment, marking for high-risk systems, risk management, data quality requirements.

A deployer is anyone who uses an AI system under their own authority. That covers most mid-sized companies using ChatGPT, Claude, Midjourney or sector-specific tools. Deployer obligations are considerably lighter by comparison, but they are not nil. What reaches you: AI literacy in the team under Article 4, in force since February 2025; transparency obligations towards users under Article 50, in force since August 2026; and for high-risk applications additionally human oversight, log retention and risk management.

An important special rule: if you substantially modify an AI system, place it on the market under your own brand, or put it to a purpose other than the one intended by the provider, you become a provider yourself. A practical example: you take a model API, build your own customer service bot around it with your logo, and resell it as your own product. That switches your role, and the considerably stricter provider obligations apply.

Concretely: most mid-sized companies are deployers only. Their compliance rests on three blocks, namely an AI inventory, a risk classification of the systems in use, and implementation of the transparency obligations at the relevant touchpoints. Those three blocks form the basis of the setup described in the next chapter.

Since early 2026 offers for AI Act compliance at low three-figure prices have been appearing in growing numbers. Standardised templates, automated checklists, generated assessments. Such offers are not inherently dubious, they simply solve a different problem from the one you have.

What templates cannot do is the classification. A mid-sized company with two chatbots has different obligations from one with twelve AI tools across sales. The risk classification is the core of the documentation, and it depends on the specific purpose of use, not on the tool category. A template cannot make that distinction, because it does not know your purpose.

What templates equally cannot do is the metadata check. Whether your image pipeline preserves provenance information or discards it on export cannot be derived from a questionnaire. Someone has to trace it through your actual workflow.

The honest comparison is therefore not EUR 499 against EUR 2,500. It is a template against an inventory. For a company with a single chatbot and no generative image production, the template may genuinely be enough. If that describes you, do not buy an audit.

If your company develops or places on the market high-risk AI systems under Annex III, for instance in recruitment, credit assessment or critical infrastructure, and you are the provider of those systems, you need specialist compliance advice with its own technical auditors and access to notified bodies. That is not our core business, and 2 December 2027 is your relevant date, not December 2026.

If you need a legally binding opinion, for instance because proceedings are already under way or a cease and desist letter has arrived, that belongs with a law firm. We assess setups and implement them; we do not provide legal advice.

If what you want is documentation that looks good in an audit without anything changing in your practice, we are the wrong address. A classification that does not reflect actual use is worse in an audit than none at all, because it demonstrates that the question was asked and answered incorrectly.

What we are good at: marketing applications at mid-sized clients with limited or minimal risk. Chatbots, generative image and text tools, personalisation, AI assisted newsletters. That is the area where the bulk of marketing AI use actually sits.