Published December 15, 2024 · By CampaignsLive · Industry
The EU AI Act was adopted in 2024 after several years of legislative drafting and political negotiation. It is the first comprehensive AI regulation enacted by a major economic bloc, and its provisions apply to any AI system deployed in the European Union — including AI systems used by brands and agencies that operate in EU markets, regardless of where the brand or the tooling vendor is headquartered.
The trade-press coverage has been thin on what the act actually requires of brand teams. This is a working translation, focused on the provisions that affect brand creative production specifically.
What the act covers
The EU AI Act takes a risk-based approach. AI systems are categorized into four risk tiers: unacceptable (banned outright), high-risk (heavily regulated), limited-risk (transparency obligations), and minimal-risk (no specific obligations beyond general law).
Most AI tooling that brand teams use day-to-day — image generation, copy generation, design assistance, performance creative variants — falls into either the limited-risk or minimal-risk categories. A few use cases fall into the high-risk category and carry significantly more substantive obligations. None of the typical brand-creative use cases sit in the unacceptable category.
The provisions that affect brand creative production directly are in two specific areas: transparency obligations for limited-risk systems, and obligations on the providers of general-purpose AI models.
The transparency obligations for AI-generated content
The act requires that AI-generated content shown to users be clearly disclosed as AI-generated, in machine-readable form and in a manner the user can perceive. The specific provisions:
Synthetic image, video, and audio content. Content that has been generated or manipulated by AI in a way that resembles real persons, objects, places, or events must be disclosed. The disclosure requirement applies to most generative AI image and video output used in commercial communications. Limited exceptions exist for art, satire, and certain narrow use cases.
Deepfakes. Content depicting identifiable individuals saying or doing things they did not say or do is subject to stricter disclosure. The category covers AI-generated talent imagery that depicts recognizable real people in fabricated scenarios.
AI-generated text on matters of public interest. Editorial AI text published to inform the public on matters of public interest must be disclosed. The provision targets news and public-communication contexts rather than brand-creative copy specifically.
Chatbots and conversational AI. AI systems that interact with users in conversation must disclose that they are AI rather than human. Brand customer-service deployments are squarely in scope.
The disclosure requirements apply to the entity deploying the AI system to the public — typically the brand or agency, not the tooling vendor. The compliance burden is therefore on the brand side, regardless of which tool was used to produce the output.
What brand teams have to actually do
Three operational changes follow from the transparency obligations.
Disclose AI-derived imagery in EU markets. Brand campaigns running in EU markets that include AI-generated or AI-augmented imagery must be marked as such in a manner perceptible to the audience. The specific format of the disclosure is not prescribed in detail; the operational pattern that has emerged is a label, watermark, or accompanying text indication. The exact placement varies by channel: a small text label on a digital ad, an end-card on a video, a disclosure in the metadata for social content.
Maintain provenance documentation. The brand has to be able to demonstrate, for any specific piece of content in question, whether AI was used and to what extent. The provenance documentation that production-grade AI tools maintain — model version, prompt, references, output, date — becomes a compliance asset rather than just an internal operational nicety.
Update talent contracts and rights documentation. The act’s deepfake provisions intersect with the SAG-AFTRA-style talent contract language already established through 2023. Brand contracts with talent must address AI scope explicitly; the EU act’s provisions make the language a compliance requirement rather than only a contractual preference.
What general-purpose AI providers have to do
The act imposes substantial obligations on the providers of general-purpose AI models — the labs and platforms behind ChatGPT, Midjourney, Stable Diffusion, and the rest. These obligations include transparency about training data, copyright compliance, model card documentation, and (for the largest models) systemic risk evaluation.
Brand teams do not have to enforce these obligations directly; the obligations fall on the AI providers. But the obligations do affect the choice of AI tool, because:
Tools whose providers are not compliant create downstream exposure. A brand using a tool whose provider does not meet the act’s transparency obligations may absorb reputational and procurement-side exposure even if the brand’s own use of the tool is compliant.
Provenance and attribution requirements upstream become available downstream. The model providers’ obligations to document training data, identify when content is AI-generated, and provide model cards create the upstream infrastructure that brand-side compliance work depends on. Brands using tools with clean upstream compliance have a meaningfully easier time meeting their own obligations than brands using tools without.
The practical effect is that brand-side procurement of AI tools, for any brand operating in EU markets, increasingly requires evaluating the tool’s compliance posture, not just its capability and cost.
The phasing and timeline
The EU AI Act’s obligations phase in over several years from its 2024 adoption.
- 2024 Q4: The Act formally entered into force. Initial publication and immediate effect for the unacceptable-risk provisions.
- 2025 H1: Prohibitions on the unacceptable-risk AI uses began applying. Most brand creative work is not in this category.
- 2025 H2 through 2026: Transparency obligations for limited-risk systems (including most generative AI use in commercial communications) phased in. By the end of 2026, the obligations covered in this piece are in full effect for most use cases.
- 2027 onward: High-risk system obligations and remaining provisions continue to phase in.
Most brand teams operating in EU markets are working toward full compliance through 2025 and 2026. The compliance work is concrete and ongoing; the procurement and contract changes that flow from it are happening in parallel.
What this means for tool selection
The procurement criteria for brand-side AI tooling, in any organization with EU market exposure, have changed in three specific ways since 2024.
Provider compliance posture is a line item. Tools whose providers can demonstrate clean compliance with the act’s provisions are preferred. Tools whose providers cannot are increasingly being deselected through procurement review, even if the tool’s capability is competitive.
Provenance and disclosure infrastructure is a requirement. Tools that maintain machine-readable provenance, support content credentials, and enable downstream disclosure are increasingly required for brand-creative production work. Tools that do not provide this infrastructure require the brand to build it externally, which most brands do not have the capacity to do.
Geographic deployment matters. Tools deployed only outside the EU, or tools whose terms of service explicitly exclude EU use, are not viable for brand teams running EU campaigns. The deployment geography of the tool itself has become a procurement consideration.
For the related discussion of how rights documentation became standard in brand-side production through 2024, see The SAG-AFTRA AI Clauses, Translated for Brand Teams. For the IP and ownership side, see Why Your Brand Should Own Its AI Creative.