A shop uses AI for product descriptions and a support chat. Must every line be labelled, and can campaigns continue? Start with the system’s purpose: who interacts with people, what is published and which data is processed?
TL;DR: The AI Act does not require ordinary advertising campaigns to stop. Duties depend on the system, company role and use. Separate bot notices, technical marking by generator providers, deepfake disclosure and privacy requirements. There is no single rule demanding the same visible label on everything involving AI.
This practical overview is current to 28 September 2026. It helps prepare a review of a specific process; complex uses need an appropriate legal assessment. Canem Errant reviews technical integrations and data flows rather than certifying the lawfulness of every AI application.
What Does the AI Act Regulate, and When Does It Apply?
Regulation (EU) 2024/1689 distributes duties among participants. Providers develop or supply a system under their own name; deployers use it professionally. A business developing its own system can hold both roles. Neither business size nor product name alone determines its obligations.
The current timetable already reflects Digital Omnibus on AI:
- 1 August 2024: the AI Act entered into force.
- 2 February 2025: general provisions, AI literacy and prohibitions.
- 2 August 2025: duties for general-purpose model providers and governance.
- 2 August 2026: Article 50 transparency and most remaining provisions.
- 2 December 2026: a particular Article 50(2) transition for certain generators supplied before 2 August 2026, plus specific new prohibitions.
- 2 December 2027: high-risk requirements for Annex III systems.
- 2 August 2028: high-risk requirements for regulated Annex I products.
A high-risk deadline does not postpone all transparency requirements. Check the particular system’s transitional rules. Sources: current Commission timetable, Bundesnetzagentur on the amendments.
Some individual article pages warn that their wording has not yet been updated for Digital Omnibus. Do not derive new deadlines from an outdated text.
How Do You Assess a Marketing Use?
Four groups help with orientation. A product description cannot replace examination of its actual purpose.
| Group | What to Check |
|---|---|
| Prohibited practices | Does the use meet a specific prohibition, such as certain manipulative practices or prohibited social scoring? |
| High risk | Is it an Annex III purpose or regulated Annex I product case, such as particular credit, employment or biometric applications? |
| Transparency duties | Is there direct AI interaction, synthetic content, a deepfake or another specific case? |
| Ordinary tasks | Drafts, test hypotheses and bid optimisation are normally not listed high-risk purposes by themselves. |
A specific prohibition covers AI used to infer emotions in the workplace, with an exception for medical or safety purposes. For insurance, Annex III lists risk assessment and pricing for natural persons in life and health insurance. This does not automatically make every insurance marketing use high risk. Sources: Article 5: prohibitions, Annex III: listed purposes.
Ordinary B2B lead prioritisation is not automatically high risk. Profiling natural persons has particular significance for systems already covered by Annex III; it does not make all marketing profiling high risk. Article 6: criteria.
Describe the decision and its impact. Sorting enquiries by response deadline differs from refusing credit. If human review is a safeguard, it must be meaningful. Automatically approving every output does not reliably reduce the risk.
Four Areas Affecting Advertisers
1. Synthetic Images, Video, Voice and Text
Article 50 separates duties by role: generator providers must make outputs technically identifiable; deployers must disclose deepfakes. Text published to inform on matters of public interest has a separate rule, with an exception involving human review or editorial control and responsibility. Not every advertising draft therefore needs the same visible label.
Deepfakes can represent people, objects, places or events as if they were authentic. Not every AI image is automatically a deepfake. Assess realistic avatars, voices and staged events through the specific material and presentation. RTR: current transparency guidance.
Keep provenance information, check rights and permissions, and arrange required notices before publication. Platform rules and restrictions on misleading advertising also apply. An AI label does not make a false product claim acceptable.
2. A Bot on the Website
Article 50(1) addresses the provider of a system that directly interacts with people, unless its AI nature is already obvious. A website operator should check whether the actual interface gives a clear, accessible notice at the first interaction.
One possible notice is: “You are speaking with an AI assistant. Choose the team contact option if you would like to speak to a person.” This is a plain example, not a prescribed universal form. Test mobile display, accessibility, staff handoff and incorrect answers.
A conventional menu of fixed answers is not automatically an AI system. Collecting contact data still needs assessment. Article 50.
3. Advantage+, Performance Max and Advertising Decisions
Using a platform algorithm does not make every campaign a general-purpose AI model. Distinguish the model provider, system provider and advertiser using a ready-made feature. The platform’s duties do not remove your responsibility for ads, data and the offer.
Record the feature, optimisation goal, limits and owner. That helps review spending and unexpected changes. For implementation, see Performance Max for e-commerce and B2B.
4. Profiling and Personal Data
Sensitive information is not ordinary personalisation material. GDPR governs personal data processing; the DSA separately prohibits platforms from serving advertising based on profiling using special categories of data. These are independent requirements. Commission: DSA and advertising.
Solely automated decisions with legal or similarly significant effects require a separate Article 22 GDPR assessment. Suggesting an email subject differs from automatically refusing an important service. Commission: automated decisions.
Check fields, legal basis, retention, contracts and access. Advertising measurement also depends on the choice path: cookie banner audit. The full requirements of GDPR and Austria’s TKG extend beyond AI rules.
Responsibilities in Austria, Germany and Switzerland
Austria: RTR’s AI Service Desk provides information. Its FAQ reports at the review date that national implementation of AI Act responsibilities has not yet taken place. Do not simply appoint the DSB as the sole AI regulator. Data protection and AI market surveillance must be distinguished. RTR FAQ.
Germany: Bundesnetzagentur describes a central role and a surveillance structure with sectoral areas. Check the competent body and current implementation status for the specific use. Data protection authorities do not automatically replace all AI surveillance. Bundesnetzagentur: market surveillance.
Switzerland: A non-EU address does not exclude applicability. Article 2 covers third-country providers and deployers in certain cases, including use of system output in the Union. Examine the company’s role and the application’s EU connection. Article 2: scope.
Include the function, role, data and consequences when asking a specialist. This allows a concrete response. Recheck national responsibilities before an actual proceeding.
Six Ordinary Tasks: What Can Continue?
These activities do not by themselves make marketing a high-risk system:
- Meta Ads: ordinary campaigns within applicable rules.
- Smart Bidding: bid optimisation for a defined advertising task.
- Email: drafting and permissible personalisation.
- A/B tests: hypotheses reviewed and tested by a team.
- Product recommendations: ordinary recommendations, not automatically a credit decision.
- Copy and SEO drafts: responsibility for facts, rights and published statements remains.
This is not an exemption from all duties. Purpose, data and execution still matter. The team needs appropriate AI literacy and an understanding of limitations. For workflows, see AI agents in marketing.
Two Teaching Scenarios
Vienna Shop: Product Descriptions and Support Chat
The editor checks product properties, prices, delivery and language in AI drafts. Separately, the team tests the bot notice and staff handoff. Synthetic images are assessed for deepfake characteristics and misrepresentation of the product.
The review includes chat data, provider and retention. One label does not cover the entire system. Effort depends on the integration; this is a teaching scenario, not a documented client case or a promise of a solution in minutes.
DACH Agency: Hypotheses and Advertising Variants
A model proposes copy and test hypotheses. An employee checks facts, rights and offer limitations before testing. The system is not given unrestricted access to the CRM or advertising budget.
Drafting alone does not normally establish a high-risk purpose. Developing a system or changing its purpose can alter roles and duties, however. Process controls remain useful when special high-risk documentation is not required.
Three Actions for This Week
List your systems. Record the owner, purpose, role, data, provider, users and consequences of errors. Highlight bots, synthetic media and autonomous decisions. Check the team’s competence for its tasks.
Test notices in interfaces and ads. Open the bot on a phone and examine the first interaction. Review realistic AI media and public-interest text. Assign each duty to the correct role.
Write rules for content and data. Who reviews and publishes, which fields can the model receive, and who can stop it? Reassess after a tool or purpose change. An annual reminder cannot replace a review triggered by changes.
A suitable starting point is a short technical inventory with disputed uses referred to a lawyer. A faster option checks the public bot and finished media first. A more cautious option limits autonomous actions pending assessment, at the cost of more manual work. Effort and price depend on the systems, not a universal “15-minute compliance” exercise.
Further sources: Article 99, RTR: sanctions.
Frequently Asked Questions
Must I Stop Ordinary Facebook Ads?
No. The AI Act does not require standard campaigns to stop. Review the ads, data and enabled AI features. Platform responsibilities do not remove your own duties.
Must Every AI Text Have a Visible Label?
Article 50 does not require the same visible label on every advertising draft. Separate generator duties from public-interest publications and their exceptions. Platform rules and other laws also need consideration.
What Sanctions Are Possible?
Article 99 sets maximums: €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for specified duty violations including transparency, and €7.5 million or 1% for incorrect information supplied to authorities. Businesses generally face the higher limit; SMEs, including startups, have a limit based on the lower amount. The actual sanction depends on circumstances; a warning first is not guaranteed. Article 99, RTR: sanctions.
How Does the AI Act Differ from GDPR?
The AI Act regulates AI systems and participant roles; GDPR regulates personal data. Both can apply to the same bot. An application without a high-risk classification does not automatically have permission to send customer data to a model.
Does It Apply to a Swiss Company?
Yes, in cases covered by Article 2. Examine market placement, company role and use of output in the Union. Advertising in DACH alone does not answer that assessment.
Which data do your advertising integrations transfer? Discuss a technical review with Canem Errant. Diagnosis and implementation are agreed separately; legal assessment of an AI use requires an appropriate specialist.
