EU AI Act: what brands need to know about AI regulation

The EU's AI regulation is no longer something to plan for later. It has been in force since August 2024. Since February 2025, it has banned certain practices. And since 2 August 2026, its transparency obligations have applied directly to brands that use AI to produce content, personalise the experience or automate their e-commerce operations.

For marketing, product and digital teams, the question has moved on from ‘should we pay attention?’ to ‘where do we start?’ Here is what the AI Act actually requires and what it means for your product data.

What is the EU AI Act, and who does it apply to?

Regulation (EU) 2024/1689 was adopted by the European Parliament on 13 March 2024, published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It takes a risk-based approach: the more an AI system can affect people's safety, health or fundamental rights, the stricter the obligations. It has since been amended by the Digital Omnibus on AI, in force since 27 July 2026, which adjusts its timeline.

The regulation applies to anyone who develops, distributes, imports or deploys an AI system on the EU market, including providers based outside the EU when the system's output is used in the EU. That covers UK brands selling to EU customers for their EU-facing activity. In other words, if your brand uses an AI tool to enrich product listings, power personalised recommendations or generate marketing content, the AI Act applies to you, even if you didn't build the technology yourself. The text distinguishes two roles: the provider, which develops an AI system or markets it under its own name, and the deployer, which uses it in its business. A brand using an off-the-shelf AI tool is a deployer; if it launches its own assistant under its own name, it may also become a provider.

Four risk levels: where do brands sit?

The AI Act sorts AI systems into four categories. Knowing which one you fall into determines your actual obligations.

Unacceptable risk: practices banned since February 2025

Since 2 February 2025, certain practices have been banned: social scoring, behavioural manipulation and real-time remote biometric identification in public spaces (with some exceptions). From 2 December 2026, the Digital Omnibus adds two new bans, targeting systems that generate non-consensual intimate images or child sexual abuse material. These bans target the most intrusive uses and have no direct link with standard marketing practice, but they draw a clear red line.

High risk: strict obligations, later deadlines

High-risk systems cover sensitive areas such as recruitment, credit, health and justice. The Digital Omnibus, published in the Official Journal on 24 July 2026, pushed their obligations back: stand-alone systems listed in Annex III, originally due to comply by 2 August 2026, now have until 2 December 2027, and AI built into regulated products (Annex I) until 2 August 2028. For brands, this mainly affects automated HR tools and some credit systems, not standard marketing tools.

Limited risk: where e-commerce brands sit

This is where most marketing uses of AI sit: chatbots, content generators, personalisation tools, product recommendations. For these systems, the AI Act mainly imposes transparency obligations, set out in Article 50 and applicable since 2 August 2026.

In practice: tell users when they are dealing with an AI, and make AI-generated or manipulated content identifiable.

Minimal risk: no specific obligations

Spam filters, data sorting tools and recommendation systems with no impact on fundamental rights fall into this category. There are no regulatory obligations, but good practice still applies.

The timeline after the Digital Omnibus

The AI Act applies in stages. Here is the timeline as amended by the Digital Omnibus, in force since 27 July 2026:

• 1 August 2024: Regulation enters into force
• 2 February 2025: Bans (unacceptable risk) and AI literacy
• 2 August 2025: Obligations for general-purpose AI (GPAI) models
• 2 August 2026: General application, including transparency obligations (Article 50)
• 2 December 2026: Content marking for generative AI systems already on the market before 2 August 2026, and new bans
• 2 December 2027: High-risk obligations, Annex III
• 2 August 2028: High-risk obligations, Annex I (regulated products)

What the AI Act requires of brands in 2026

Transparency on AI-generated content

This is the most visible obligation for marketing and e-commerce teams. Since 2 August 2026, providers of generative AI tools have had to mark the content they produce (text, images, audio, video) in a machine-readable format, such as metadata or watermarking. Tools already on the market before that date have until 2 December 2026. To help businesses comply, the European Commission published a code of practice on marking and labelling AI-generated content on 10 June 2026, followed by its guidelines on Article 50 on 20 July 2026.

For brands, the obligation is about visible labelling. As a deployer, you must disclose deepfakes: images, video or audio generated or manipulated by AI that resemble real people, objects or places and could pass as authentic. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless a person has reviewed it and takes editorial responsibility for it.

In practice, sort your uses: a retouched product visual or an AI-generated model may count as a deepfake if it looks real; a customer service chatbot falls under the disclosure duty; an AI-written product description does not need a visible label under the AI Act, but it must stay accurate under consumer protection law. Also check that your tools keep the marking on the content they generate.

Telling users when they interact with AI

If your site offers an AI-powered chatbot or shopping assistant, users must know they are talking to an AI, unless it is obvious. Breaching the Article 50 transparency obligations can lead to fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher (the lower amount applies to SMEs). Each EU member state enforces these rules through its own market surveillance authorities, and the regulation has applied directly since 2 August 2026.

AI literacy for your teams

Since February 2025, providers and deployers have had to look after the AI literacy of the people who use AI systems on their behalf. The Digital Omnibus rewrote this obligation: since 27 July 2026, you must take measures to support the development of AI literacy, without having to guarantee a specific level for each person. No certified training is required: document the measures you take as part of your internal governance.

Why product data quality is becoming a compliance issue

This is the point brands least expect: the AI Act creates a direct link between regulatory compliance and the quality of the data fed into AI systems.

Inaccurate or non-compliant product information can spread quickly and at scale, with a direct impact on customer trust and on a business's regulatory exposure.

If you use AI to generate product descriptions, power recommendation engines or personalise the experience, the reliability of the output depends directly on the quality of the input data. Without a clean product data repository (PIM), algorithms lack reliable material to work with. An AI project almost always starts with a data project.

The governance features of a PIM (validation rules, approval workflows, completeness scoring, version history and auditability) act as a genuine safety net. They help you make sure the product data exposed to AI engines has been checked, approved and enriched, combining automation with human oversight.

In other words, a well-structured PIM becomes compliance infrastructure for AI as well as a productivity tool.

Conclusion

Regulating AI-generated content marks a new stage in e-commerce maturity. It pushes brands to move from opportunistic experimentation to a structured, governed and sustainable approach. The businesses that succeed will use AI intelligently, based on reliable product data, within a clear and controlled framework.

The AI Act sets a framework that separates brands that have structured their data management from those that haven't. For teams that have invested in a centralised product data repository, compliance builds on solid foundations. For the rest, it exposes the gaps in their data governance.