Why a law from Brussels reaches a marketing team in Singapore
The EU AI Act does not stop at the EU border, and that is by design. Article 2 sets the scope in two moves. Providers who place AI systems on the EU market are covered wherever they are established. And, the clause that matters for most marketing teams, the Act applies to providers and deployers located in a third country “where the output produced by the AI system is used in the Union” (Article 2(1)(c)). Headquarters is irrelevant. Where the output lands is the test.
In marketing operations, the reach is wider than most teams assume. A chatbot on your site that EU visitors can talk to produces output used in the Union. AI-generated creative in campaigns that EU users see produces output used in the Union. AI-assisted articles that EU readers open produce output used in the Union. For the five markets leapbuzz works across, Singapore, the US, Canada, Australia, and Malaysia, the common pattern is a regional business with no EU entity but plenty of EU traffic, EU customers, or EU partners. That pattern is in the conversation whether it wants to be or not.
Two calibrations before the checklist. First, in almost every marketing scenario you are the deployer, the party using an AI system under your own authority, not the provider who built it. Deployer duties are lighter and mostly about disclosure. Second, this post is marketing operations guidance, not legal advice. Scope questions with real money attached belong with counsel.
What actually starts on 2 August 2026
The Act phases in over five years, and the marketing-facing piece is the August 2026 tranche. Per the official implementation timeline, on 2 August 2026 “the remainder of the AI Act starts to apply, except Article 6(1)”, the high-risk classification rules, which follow a year later. The prohibitions and AI literacy duties have applied since February 2025, and the general-purpose model, governance, and penalty provisions since August 2025.
The transparency duties in Article 50, the ones that govern AI-generated content, chatbots, and deepfake-adjacent creative, stop being direction of travel and become enforceable law. Everything your team has been meaning to sort out about AI-generated assets now has a date attached.
Article 50, translated for a marketing team
Article 50 (official text: Regulation (EU) 2024/1689) carries four duties a marketing operation will actually meet. Most teams hit them in this order:
Chatbots must be visibly machines. People interacting with an AI system must be informed of it, unless that is obvious to a reasonably well-informed person. A clearly labelled AI assistant satisfies this. A chat widget doing its best to pass as a human named Rachel does not. The disclosure has to land at the first interaction.
Synthetic output must carry machine-readable marks. This is the tool vendor's duty, not yours. Your job is to buy tools that do it and check the marks survive your export pipeline.
Deepfake-adjacent content needs a visible disclosure. Deployers of image, audio, or video content that is artificially generated or manipulated must disclose that fact. Artistic, creative, and satirical work gets a gentler version: the disclosure still exists but must not hamper the enjoyment of the work. For campaign creative, the operating line is photorealism. If a viewer could mistake the asset for a photograph of something that happened, label it.
AI-written text that informs the public needs a disclosure, with one big exemption. Text published to inform the public on matters of public interest must be disclosed as AI-generated, unless it has undergone human review or editorial control and a person holds editorial responsibility.
Will the ad platforms handle EU AI Act compliance for you?
Whether or not an EU regulator ever looks at a mid-market advertiser in Kuala Lumpur, the platforms will get there first. The major ad and social platforms have spent the last two years building in synthetic-media labels, upload-time AI declarations, and provenance metadata. The generation tools are moving the same direction: embedded content credentials are becoming table stakes. The AI Office is explicitly chartered to encourage codes of practice for detecting and labelling synthetic content, which pushes the whole toolchain in the same direction. The floor is moving. Everyone on it moves with it.
This rhymes with a lesson from the measurement side, covered in the Privacy Sandbox wind-down post: what changes practice is rarely the statute reaching you directly. It is regulation reshaping what platforms and vendors require of everyone who uses them. Third-party cookies survived in Chrome, yet first-party data became mandatory anyway, because regulation and walled gardens moved the floor. Expect the same mechanic here. Upload-time enforcement and procurement questionnaires will make Article 50 posture a de facto requirement in markets the Act never formally reached.
If your campaigns are increasingly assembled by agents rather than people, the same duties follow the pipeline. The governance side of that is covered in the agentic marketing operations post: the escalation boundary you design for agent-produced work is the natural place to hang the disclosure and marking checks.
What does a mid-market marketing team need ready before 2 August 2026?
Four artefacts, and a mid-market team can produce all four in a fortnight without new tooling. Start with the vendor question, because the answer determines how much labelling work lands back on you. Ask each generation tool: does the output carry a machine-readable mark, and does it survive your export pipeline? From there, build the inventory of every place AI generates or edits customer-facing material. Map your EU exposure: which campaigns, pages, and bots reach people in the Union. Then write the disclosure standards: where labels go on deepfake-adjacent creative, and how the human editorial sign-off on AI-assisted text gets recorded.
Answer the five questions honestly and the checklist mostly writes itself.
1. Can people in the EU see output from your AI systems?
If EU residents can talk to your chatbot, see your AI-generated campaign assets, or read your AI-assisted pages, Article 2(1)(c) can put you in scope as a deployer even with zero EU entities, because the output is used in the Union. If you genuinely have no EU exposure and your funnels are geo-gated, you are mostly out of scope. Put a quarterly reminder on it anyway: exposure changes faster than legal reviews do.
2. Do you publish AI-generated text with no human editorial step?
Fully automated publishing of text that informs the public is exactly what the Article 50 text duty targets. Add a human review step, name an owner with editorial responsibility, and record the sign-off. With that in place the exemption applies and no label is required. Without it, you are choosing between labelling the content and being unable to show why you did not.
3. Do you produce photoreal AI images or video of people, places, or events?
This is the deepfake lane. Disclosure is the duty: the content must be identified as artificially generated or manipulated. Creative and satirical work gets a lighter treatment, but the obligation still exists. Build the label into the template now.
4. Does your site or funnel run an AI chatbot?
People must know they are talking to a machine unless it is already obvious to a reasonably well-informed person. A visible label at the top of the chat window, in the first message, or both, settles it. The disclosure must land at the first interaction, not three exchanges in.
5. Can your generation tools prove machine-readable marking?
Marking synthetic output in a machine-readable, detectable way is the tool provider's duty, but you inherit the problem if your vendor cannot answer it. Ask each vendor two questions: does the output carry a machine-readable mark, and does the mark survive your own export and compression pipeline? Test the second claim yourself. Metadata has a habit of dying in the handoff between tools.
Where this lands in the AI operating model
Teams in regulated verticals will recognise the shape of this work. Banking, insurance, and fintech marketers already run creative through compliance gates before anything ships, and the AI Act extends that muscle to content provenance rather than inventing a new discipline. Measurement, bidding, and attribution are untouched. What changes is that asset production gains a provenance step, the same way it once gained a brand-safety step.
In an AI strategy engagement this shows up as part of the AI operating model, not a side project. The inventory and exposure map become standing documents. The editorial sign-off becomes a workflow rule. The vendor marking question joins the tool-selection scorecard. An audit trail for all of it sits naturally with the analytics and insights layer. None of it is glamorous. All of it is cheaper than retrofitting under a deadline, and 2 August 2026 is a real one.