EU AI Act and Online Marketing: What Changes for Advertisers in Austria in 2026

TL;DR: The EU AI Act barely affects 90% of SMEs in online marketing — standard ads, bid optimization, and A/B testing fall under “Minimal Risk” with no reporting obligations. What changes: AI-generated content needs disclosure labels, chatbots need an AI tag, and automated profiling decisions for sensitive categories face stricter rules (Source: Canem Errant, 2026).

A Vienna-based e-commerce founder called us last week. His question: “Do I have to shut down my Meta Ads because the AI Act is coming?” Short answer: No. Longer answer: The AI Act isn’t an apocalypse for online marketing. It’s a regulation that primarily targets Big Tech — not your Shopify store.

But “don’t panic” doesn’t mean “do nothing.” If you use AI-generated product descriptions, a chatbot on your website, or automated targeting decisions, there are concrete action steps. Not many. But ignoring them isn’t an option.

Here’s the practical guide — what’s really changing, what isn’t, and what you can do this week.

What Is the EU AI Act — and When Does It Apply?

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive law regulating artificial intelligence. It entered into force on August 1, 2024, with phased application:

• February 2025: Ban on AI systems with “unacceptable risk” (subliminal manipulation, social scoring)
• August 2025: Transparency obligations for General-Purpose AI (GPAI) like GPT-4, Gemini, Claude
• August 2026: Full application of all rules, including high-risk AI systems
• August 2027: Transitional periods for certain embedded AI systems expire

The AI Act follows a risk-based approach — the higher the risk, the stricter the rules. For most online marketers, this means: minimal impact. But there are gray areas you should know about.

Which Risk Category Applies to Your Marketing?

The AI Act classifies AI applications into four risk tiers. Here’s where typical marketing tools land:

Risk Level	Example	Marketing Impact	Action Required
Unacceptable	Subliminal manipulation, social scoring, workplace emotion recognition	Banned	Don’t use
High Risk	Credit scoring for targeting (potentially), biometric identification	Heavy regulation	Legal assessment needed
Limited Risk	Chatbots, AI-generated ad content (deepfakes, AI voices, AI images)	Disclosure required	Label AI content
Minimal Risk	A/B testing, recommendation engines, bid optimization, Google Ads Smart Bidding	No specific requirements	Business as usual

Source: EU AI Act, Regulation (EU) 2024/1689, Articles 6, 50, 52.

The critical insight: your normal Meta Ads, Google Ads, and email marketing campaigns fall under “Minimal Risk.” No reporting, no certification, no registration. The algorithm optimizing your bids isn’t “High Risk” — it optimizes auctions, not life chances.

What Specifically Changes for Advertisers?

Four areas that affect online marketers in the DACH region:

1. AI-Generated Ad Content: Disclosure Requirements. If you use AI to create images, videos, or voices for ads — particularly deepfakes, synthetic voices, or AI-generated personas — these must be labeled as AI-generated (Art. 50 AI Act). This doesn’t apply to AI-assisted text generation (e.g., ChatGPT for ad copy), but primarily to visual and auditory content simulating real people.

2. Website Chatbots: AI Label. Every chatbot that processes natural language must inform the user they’re interacting with an AI — not a human (Art. 50(1) AI Act). A simple notice like “This chat is powered by AI” is sufficient. What’s not affected: rule-based FAQ bots that don’t use AI.

3. Performance Max / Advantage+: Transparency. Automated decision systems in advertising — like Meta’s Advantage+ or Google’s PMax — are classified as GPAI applications. The transparency requirement here falls primarily on Meta and Google, not on you as the advertiser. However: you should be able to document which AI tools you use and how automated decisions are made. For practical PMax campaign implications, see our Performance Max guide.

4. Profiling for Targeting: Sensitive Categories. The AI Act tightens rules for AI-based profiling on sensitive categories — religion, health, sexual orientation, political opinion. Standard targeting by interests, demographics, or purchasing behavior is not affected. But: anyone using AI for credit scoring or insurance scoring to make targeting decisions is potentially in high-risk territory.

For existing data privacy rules in the context of online advertising — GDPR, Austrian TKG 2021, consent requirements — see our data privacy guide.

Who Enforces This in Austria and Germany?

Austria: The Data Protection Authority (DSB) is expected to serve as the national supervisory authority, supplemented by a yet-to-be-designated AI-specific body. Jurisdictional responsibilities are currently being defined at the national level.

Germany: The BfDI (Federal Commissioner for Data Protection) at the federal level, supplemented by state authorities. The Federal Network Agency (BNetzA) has been named as the coordinating body for the AI Act. Additional enforcement power lies with state data protection commissioners — which can lead to fragmented oversight in practice.

Switzerland: Not an EU member, but the AI Act affects companies offering products or services in the EU (extraterritorial effect similar to the GDPR).

Key Takeaway: The supervisory structures for the AI Act are still being built across the DACH region. Don’t wait for final jurisdictional clarity — implement the disclosure requirements now. The rules already apply, even if enforcement is still ramping up (Source: Canem Errant, 2026).

What Do You NOT Need to Worry About?

Let’s be direct — these standard marketing activities are not a problem under the AI Act:

• Running Facebook/Meta Ads: Minimal risk. Meta’s algorithm is their responsibility.
• Google Ads Smart Bidding: Minimal risk. Bid optimization is not high-risk AI.
• Email marketing with personalization: Minimal risk. Even if AI generates the subject line.
• A/B testing with AI-generated hypotheses: Minimal risk. No reporting obligation.
• Product recommendations in your shop: Minimal risk. Recommendation engines are explicitly exempted.
• AI-assisted text generation: Limited risk regarding disclosure, but not high-risk.

The AI revolution in your marketing continues. The AI Act regulates abuse, not innovation. For more on using AI in marketing, see our agentic AI marketing guide.

What Does This Look Like in Practice — Two Scenarios?

Scenario 1: Vienna E-Commerce with AI Product Descriptions + Chatbot. A Vienna online shop uses GPT-4 for product descriptions and an AI chatbot for customer service. AI Act consequence: the chatbot must be labeled as AI (Art. 50) — a one-time effort of 30 minutes. The product descriptions fall under minimal risk, as long as no synthetic images simulate real people. No high-risk classification, no certification, no reporting obligation. Implementation effort: minimal.

Scenario 2: DACH Agency Using AI for A/B Testing Hypotheses. A performance marketing agency uses Claude to generate A/B testing hypotheses and ad copy variants. AI Act classification: Minimal risk. No reporting obligation, no labeling required, no documentation duty. The hypotheses are reviewed and implemented by humans — there’s no autonomous decision process. Business as usual.

What Can You Do This Week?

1. Audit your AI tools: List every AI application you use in marketing — chatbots, content generation, image generation, automated decision systems. Check which fall under “Limited Risk” and need labeling.

2. Add a chatbot label: If you have an AI chatbot on your website, add a notice: “This chat is powered by AI.” Effort: 15 minutes.

3. Document your AI content policy: Create an internal document (1 page is enough) recording: which AI tools you use, for what purposes, and how you handle quality control. This isn’t a legal requirement for minimal-risk use, but it positions you well for future audits.

Bottom Line: The AI Act is no reason to panic for 90% of SMEs in online marketing. Label your AI content, tag your chatbot, document your processes — and carry on. The real compliance challenges hit Big Tech, not your e-commerce shop. But ignorance doesn’t protect from penalties: inform yourself now, implement the basics, and review your processes annually.

Frequently Asked Questions

Does the AI Act affect my regular Facebook Ads?

No. Standard ads on Meta, Google, and other platforms fall under “Minimal Risk.” The algorithm delivering your ads is the platform’s responsibility — not yours. As long as you’re not using AI-generated deepfakes or synthetic voices in your ads, nothing changes operationally for you.

Do I need to label AI-generated ad copy?

Text-based AI generation (e.g., ChatGPT for ad copy) falls under minimal risk and currently requires no labeling. The disclosure obligation under Art. 50 AI Act primarily applies to content simulating real people — synthetic images, videos, voices (deepfakes). Pure text generation is not explicitly included.

What happens if I ignore the AI Act?

Sanctions are tiered by risk level. For unacceptable AI practices: up to €35M or 7% of global annual revenue. For violations of specific obligations (e.g., missing disclosure): up to €15M or 3% of revenue. For most SMEs, the real risks are significantly lower — the DSB and BNetzA are expected to start with warnings, not maximum penalties.

How does the AI Act differ from the GDPR?

The GDPR governs the handling of personal data. The AI Act governs the use of AI systems — regardless of whether personal data is processed. Both apply in parallel. In practice, this means: if your AI system processes personal data (e.g., a chatbot collecting customer data), you must comply with both regulations.

Does the AI Act apply to Swiss companies?

Not directly — Switzerland isn’t an EU member. But the AI Act has extraterritorial effect: if a Swiss company offers or deploys AI systems that affect people in the EU, the rules apply. It’s the same principle as the GDPR. Swiss brands advertising in the DACH region should treat the AI Act as an EU obligation.

---

Unsure whether your marketing AI meets the new rules? Our tracking and compliance team reviews your AI integrations and ensures labeling and documentation are in order. Request a consultation →