The EU’s risk-based AI rulebook is taking effect in stages, with delayed high-risk requirements but transparency duties that already reshape synthetic media, ad-tech and marketing supply chains.
The European Union’s Artificial Intelligence Act is now the bloc’s central rulebook for AI, but its practical effect is still being shaped by staggered deadlines, later amendments and slow-moving standards work. Formally Regulation (EU) 2024/1689, it takes a risk-based approach: the most harmful uses are banned, higher-risk systems face extensive compliance duties, and lower-risk tools are left largely alone. The law also reaches providers outside Europe if their AI is placed on the EU market or its output is used there, giving the regime a genuinely extraterritorial reach.
At its core, the Act is designed to regulate outcomes rather than the technical architecture of a model. It defines an AI system as software that infers how to produce predictions, content, recommendations or decisions, and then sorts uses into tiers according to the harm they can cause. A limited group of practices is prohibited outright, including manipulative techniques, social scoring, certain forms of biometric identification and some forms of emotion recognition. Systems used in employment, education, credit, insurance, law enforcement and other sensitive domains may be treated as high risk, triggering obligations covering data governance, documentation, human oversight, accuracy, robustness and cybersecurity.
The transparency rules are narrower but commercially important. Chatbots must disclose that users are interacting with a machine, while synthetic audio, image and text systems have to mark generated material in ways that are visible to recipients or machine readable where required. Those duties matter well beyond consumer-facing products because they apply wherever AI-generated content is used to inform the public, including in digital advertising. In parallel, general-purpose AI models carry their own obligations on technical documentation, copyright policy and summaries of training data, with stricter duties for systems deemed to carry systemic risk.
The legislative path to this point has been lengthy. The Commission unveiled its white paper on AI in February 2020 and proposed the Act in April 2021, before the European Parliament and the Council eventually struck a deal in December 2023. Parliament adopted the text in March 2024, the Council followed in May, and the regulation entered into force on 1 August 2024. The phasing of application then became a political issue of its own, with industry groups and major European companies later urging delays, only for the Commission to insist that the timetable would hold.
That timetable has since been adjusted by the Digital Omnibus on AI, which pushed back some of the most demanding high-risk obligations while leaving the general application date and transparency provisions in place. Under the latest schedule, the core transparency duties still began on 2 August 2026, while the main Annex III high-risk obligations were deferred to 2 December 2027 and the Annex I product-safety route to 2 August 2028. Existing generative systems were given a separate marking deadline of 2 December 2026, when new bans on AI tools producing non-consensual intimate imagery and child sexual abuse material also take effect.
For marketers and ad-tech groups, the most immediate concern is not that every optimisation tool has become high risk, but that the Act now sits across the whole supply chain. Most bid management, ranking and creative-generation tools remain outside the highest tier. Even so, the law reaches synthetic spokespeople, AI-generated deepfakes, credit-related targeting and systems that cross into profiling or vulnerability exploitation. Enforcement is also becoming more visible: the Commission has begun consulting on procedural rules for the AI Office, and it has started sending requests for information to model providers as it tests its new supervisory powers.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
