The EU AI Act: What UK digital marketing teams need to know

It’s difficult to keep up with the fast-moving world of AI. It can be equally tricky to ensure your website is compliant with all the legal and regulatory obligations around regulations like GDPR. With the new EU AI act coming into force, you need to cover both these bases, with a requirement to be transparent about the use of AI on your website to your visitors.

In headlines and emails, you may have seen something about needing to act now with the EU AI At coming into force. This is correct, but there is no need to panic, as nobody is being marched to jail or receiving heavy fines just yet. But it will require some amendments to your data privacy statement and marking out where AI is being used. In this post we’re going to explore what the Act means for UK digital marketing teams and the associated action they need to take.

What is the EU AI Act?

The EU AI act is the world’s first – and currently the most extensive – regulation of AI. Like GDPR, it will impact UK businesses that deal with the EU or websites that intentionally have visitors from the EU, so it will impact many UK businesses. At its core it establishes a requirement to be transparent about the use of AI (a section known as article 50) in terms of both systems and also AI-generated content. 
It also categorises AI systems into four categories relating to their level of risk (unacceptable, high, limited and minimal), and sets rules for each category accordingly.

Like GDPR, there will be potentially huge fines for violations, however these apply more to higher risk categories. For digital marketing teams AI which is being used for marketing purposes would be categorised as “limited” use, but here any potential fines later down the line would be less excessive.

Act timeline

The EU AI Act came into law in May 2024, however different aspects of it are being introduced at different times. For example, in August 2025 some significant obligations came in for the large AI providers like Anthropic. However, for UK digital marketing teams the key date to consider is August 2, 2026. This is where obligations for limited-risk systems come into force, and that does cover Ai being used in marketing.  However, while this does mean you should act now there is no reason to panic, as practice regulators are not going to start dishing out fines for a considerable period.

What are the requirements of the act?

• In a nutshell, assuming you are just using AI for marketing purposes (“limited use”) then:
• If you are using a chatbot, you need to let users know they are talking to AI
• If you are using AI systems, for example for personalisation, optimisation or similar, you need to let users know that this is happening.
• If your content is AI-generated (and arguably AI-assisted too), then you need to let users know this is the case
• You also need to ensure that any AI-generated content is tagged in a way that a machine can also know it is AI-generated. 

Action #1: Review and modify your privacy policy

One of the critical requirements is to update your privacy policy so it addresses the disclosure requirements stipulated in the Act. While you’re there it could be beneficial to review your privacy policy anyway if it has been gathering dust for a while. 
The act requires you to address how AI is being used in any marketing processes and their scope including, as well as the use of AI in content generation.

Obviously, you’ll need to get this reviewed by a legal professional or expert, but it could potentially just be a paragraph. So, it is likely this will need to cover:

• Any AI-driven or supported personalisation or optimisation. So, if you are using Sitecore or Optimizely, for example, it is likely that AI is being applied.
• Any use of AI tools in generating content and that covers research, writing, images and so on. If your team may be using generative AI, then it may be better to have a statement that covers everything.
• If you are using a chatbot on your sit
• Any AI-powered recommendation tools that might be used in your online shop or product catalogue.

One element to watch for is if your site performs any kind of role which could count it as a “high-risk” system as this will require a different set of obligations, including bias testing and human oversight. High risk systems often have AI embedded which have significant impact on an individual, for example a recruitment algorithm or a credit score. It is very unlikely your website will be performing these kinds of functions, although you might provide a link to a higher risk system. 

Action #2: Label AI-generated content

The Act requires organisations to disclose when has been AI-generated or even AI-assisted. This means adding a label to elements such as pages, blog posts, product descriptions and even emails. Some organisations are understandingly a little concerned they will be “found out”, but it depends on the type of content involved. There will be a lot more acceptance as time goes on for say AI-generated product descriptions, probably less so for blog posts that are attributed to an individual. Here it can pay to add a note to say that any AI-generated content was reviewed by the marketing team, to allay any fears around accuracy, for example.  

Action #3 Label your chatbot

Most chatbots are quite obviously chatbots and may already have a disclaimer about errors and AI hallucinations. Make sure there is a label that makes it clear that AI is in use. Again, ask an expert or legal resource to check any wording.

Action #4 Ensure AI-generated content is detectable by machines

Any AI-generated content should have mark-up, metadata or watermarks that are machine-readable so it can tell that a piece of content is AI-generated. This counts for videos, images, audio and text. Here, the burden is actually on providers such as OpenAI and Anthropic to embedding machine-readable marks when the text is generated. Recently, Anthropic released details of their text watermark.  However, marketing teams need to ensure the watermark is still intact if the text is AI-generated. 

Want to discuss the EU AI Act? Get in touch!

The EU AI Act isn’t another GDPR, and the governance burden is much lighter than that. However, it does require current action by website teams in most substantial UK businesses. If you’d like to discuss what you need to do, then get in touch.  

Please note -  this post does not constitute advice and if you want to ensure you are compliant with the EU AI Act, then please consult a legal professional.
And for clarity, no we did not use AI to generate this post. However, we did use AI to confirm some of the details of the Act, which we then reviewed.