The EU AI Act for Marketers: What Applies to You

For most marketers, the EU AI Act comes down to two articles: Article 4 (train your people) and Article 50 (disclose certain AI-generated content). If your team uses AI tools at work, the Act treats you as a "deployer". Deep fakes must be disclosed. AI-generated text published to inform the public on matters of public interest must be disclosed too, unless a human reviews it and someone holds editorial responsibility.

Method: every quote below comes from Regulation (EU) 2024/1689 as published in the Official Journal, read in full on 31 October 2026 (CET) ([EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)). We have not reflected later amendments or Commission guidance, so check for those before you rely on this. This is not legal advice. Opinions are marked "Our view".

On this page

• Am I a "deployer" under the AI Act?
• What does Article 4 (AI literacy) ask for?
• What must marketers disclose under Article 50?
• When does all this apply?
• What are the fines?
• Does the AI Act change how I do GEO?
• A one-page checklist
• From MentionX data: why accuracy matters more than volume
• Worked example: Ledgerline checks its AI Act exposure
• How do you build an AI tool register?
• What should AI-literacy training cover?
• How do disclosure duties affect content workflows?
• Who should own AI Act questions in marketing?
• How does the AI Act interact with consumer law?
• What should you do this quarter?
• Common questions
• Sources

Checked on 31 October 2026. "Our view" marks MentionX opinion. Ledgerline is a fictional company used for illustration.

Am I a "deployer" under the AI Act?

Probably. The Act defines a deployer as "a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity" (EU AI Act, Art. 3(4)).

A marketing team using a writing assistant, an image generator or a chatbot on its site is using AI systems "under its authority". The companies that build those tools are "providers", and they carry most of the heavier obligations.

Fictional example: a SaaS company that puts a vendor's chatbot on its pricing page is a deployer of that system. If it builds and sells its own assistant, it is also a provider.

What does Article 4 (AI literacy) ask for?

Article 4 reads: "Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf" (EU AI Act, Art. 4). It adds that this should take into account "their technical knowledge, experience, education and training and the context the AI systems are to be used in".

The Act doesn't prescribe a course or certificate. Our view: document what you do. Keep a short internal guide covering the tools you use, what they get wrong and when output needs review, and record who has read it. Contractors and agencies that run AI tools for you are "persons... on their behalf", so include them.

What must marketers disclose under Article 50?

Article 50 has four content rules. Two apply to deployers, which is where most marketing sits.

All quotes are from (EU AI Act, Art. 50). Article 50(3) covers emotion recognition and biometric categorisation, which few marketing teams use.

What counts as a deep fake?

The Act defines a deep fake as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (EU AI Act, Art. 3(60)).

Fictional example: a realistic AI video of your real CEO announcing a product that she never recorded would meet that definition. A clearly stylised example of a fictional mascot probably would not, because it wouldn't "falsely appear... to be authentic".

There is a softer rule for creative work. Where content "forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme", disclosure is limited to "the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work" (EU AI Act, Art. 50(4)).

Do AI-written blog posts need a label?

Only some, and there's an exemption. The text duty covers text "published with the purpose of informing the public on matters of public interest". It "shall not apply... where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content" (EU AI Act, Art. 50(4)).

Our view: most product marketing isn't "matters of public interest", but industry news, research summaries and policy commentary might be. The safer path is the exemption. Have a named editor review AI-assisted text before publishing, and keep a record that they did. That's also good GEO practice, because unreviewed AI text is where factual errors creep in.

How and when must the disclosure appear?

"The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" (EU AI Act, Art. 50(5)). A disclosure buried in a footer that nobody sees before watching the video is hard to square with "at the latest at the time of the first... exposure".

When does all this apply?

Article 113 sets the dates. The Regulation "shall apply from 2 August 2026", with exceptions:

Source: (EU AI Act, Art. 113). As of the date we read the text, Article 50 duties are therefore already live, and AI literacy has applied since February 2025.

What are the fines?

Article 99(4) sets fines for breaching listed obligations, including "(g) transparency obligations for providers and deployers pursuant to Article 50". The cap is "up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher" (EU AI Act, Art. 99(4)). Prohibited practices under Article 5 carry up to EUR 35,000,000 or 7% (EU AI Act, Art. 99(3)). Member States set the detailed penalty rules (EU AI Act, Art. 99(1)).

Does the AI Act change how I do GEO?

Not much directly. Optimising content so AI engines cite it isn't regulated by the AI Act. The overlaps are:

• Synthetic media in campaigns. Disclose deep fakes.
• Chatbots on your site. The provider must make it clear people are talking to AI, unless it's obvious. Check that your vendor does this.
• AI-assisted publishing. Keep human editorial review, which also protects accuracy.
• Training-data opt-outs. Article 53(1)(c) requires general-purpose model providers to respect rights reservations under the Copyright Directive. See our guide on blocking or allowing AI crawlers.

Manipulative content is also governed by consumer law, which predates the AI Act. Our GEO ethics guide covers that.

A one-page checklist

1. List every AI tool the marketing team and its agencies use.
2. Write a short AI-literacy guide and record who has read it (Art. 4).
3. Flag any realistic synthetic image, audio or video of real people, places or events, and add a visible disclosure at first exposure (Art. 50(4)–(5)).
4. Name an editor responsible for AI-assisted public-interest text, and log their reviews (Art. 50(4)).
5. Confirm that site chatbot vendors disclose the AI interaction (Art. 50(1)).
6. Recheck the Official Journal for amendments before each campaign cycle.

From MentionX data: why accuracy matters more than volume

Method. Read-only aggregate queries over MentionX scans from 22 August to 29 October 2026 (UTC): 2,217 engine runs (2,154 completed) across 18 anonymised projects and six engines.

The AI Act is about how AI systems are built and used, not about how brands appear in AI answers. Still, the data shows why careful, accurate content matters. Brand mentions vary widely by engine, and some engines rarely link to sources:

Buyers asking comparison questions see brands named far more often than those asking about problems:

Our view: when engines name brands this often in comparison answers, what they say about you needs to be accurate. Clear, checked facts on your own site serve both compliance and visibility. Mass-produced, unreviewed AI content does neither.

Limits. A convenience sample of mostly B2B software projects, run through engine APIs, which can behave differently from the consumer apps. Perplexity, Copilot and DeepSeek figures come from a single day (26 October 2026), so treat them as a snapshot, not a trend.

Worked example: Ledgerline checks its AI Act exposure

Ledgerline is a fictional accounts-payable tool. Figures are illustrative.

Ledgerline's marketing team uses a writing assistant for drafts, an image tool for blog illustrations and a chatbot on its pricing page. The team lists each tool and asks the same three questions for each one: did we build it, do we use it under our authority, and does its output reach the public?

All three tools are bought in, so Ledgerline is a deployer. The chatbot must make clear to visitors that they're talking to an AI system, although that duty sits with the provider's design as well as Ledgerline's set-up. The image tool produces illustrations, not realistic depictions of real people, so the deepfake label isn't triggered, but the team adds captions anyway. Every blog draft is reviewed and signed by a named editor, which keeps human editorial responsibility in place. The team writes this down on one page and books a short AI-literacy session for everyone who uses the tools.

How do you build an AI tool register?

Start with a spreadsheet. List every AI tool the marketing team uses, including features inside tools you already pay for, such as writing assistants built into a design or email platform. For each one, record the supplier, the people who use it, what it produces, where that output goes and who reviews it before it's published.

Then mark which outputs reach the public. Internal drafts, research summaries and brainstorming notes carry less risk than chatbots on your site or images in ads. The register is the base for your literacy training, your disclosure decisions and any later legal review. Review it every quarter, because new AI features appear inside existing tools all the time.

What should AI-literacy training cover?

Article 4 asks deployers to take measures to ensure a sufficient level of AI literacy for staff dealing with AI systems, taking into account their knowledge, the context and the people affected. It doesn't set a syllabus. A practical session for marketers can cover what the tools can and can't do, how they get facts wrong, when outputs must be checked, how to handle personal data in prompts, and which uses need a label. Keep a record of who attended and when. Our view: a short, repeated session beats a long one-off course, because the tools change quickly.

How do disclosure duties affect content workflows?

The practical change is in review. If a piece of text is generated with AI and published to inform the public on matters of public interest, it needs a disclosure unless it has gone through human review or editorial control and someone holds editorial responsibility. Most brand marketing content isn't about matters of public interest in that sense, but naming an editor for every piece is good practice anyway. It also keeps quality up, which matters for AI visibility.

Deepfakes are different. Realistic images, audio or video that show real people, places or events as if they were real must be labelled as artificially generated or manipulated. Creative or satirical work gets lighter treatment, but the disclosure still has to appear in a way that doesn't spoil the work. If your team makes synthetic video of a spokesperson, plan the label from the start.

Who should own AI Act questions in marketing?

Pick one person. In a small team, that's often the head of content or marketing operations, working with legal. Their job is to keep the tool register, run the training, check new tools before they're adopted and escalate anything unusual. They don't need to be a lawyer, but they need a clear route to one. Write the owner's name at the top of the register.

How does the AI Act interact with consumer law?

The AI Act sits alongside existing rules. Unfair commercial practices law still bans misleading claims, fake reviews and hidden advertising, whether a human or a tool wrote them. Data protection law still applies to personal data in prompts and outputs. For GEO work, consumer law is usually the bigger risk: a fabricated review or a false claim on a comparison page is unlawful regardless of how it was made.

What should you do this quarter?

Build the register, name an owner, run one literacy session and add an editor sign-off step to your content workflow. Then check your site chatbot and any synthetic media against the transparency duties. This isn't legal advice; take the register to your legal team and ask them to confirm the gaps.

Common questions

Does the AI Act apply to companies outside the EU? It can, if AI outputs are used in the EU. Ask a lawyer about your own case.

Do I need to label every AI-assisted blog post? Not always. Human review and editorial responsibility change the position for text. Check the current guidance.

Is GEO itself regulated by the AI Act? No. GEO is a marketing practice. The rules on misleading content come mainly from consumer law.

Sources

All accessed 31 Oct 2026; pages may have changed since.

• European Union, Regulation (EU) 2024/1689 (AI Act) (Official Journal, 12 Jul 2024)