Your marketing team started using a generative AI tool to write email subject lines, draft social posts, and personalize landing pages. The legal team found out six months later when a privacy regulator sent your general counsel a letter asking how your organization classifies AI systems that produce marketing content affecting European consumers. Your CMO does not have an answer. Your general counsel does not have a process. The marketing AI initiative is now frozen pending a compliance review that nobody on the marketing side knows how to scope.
This scenario is about to play out across every mid-size and enterprise marketing organization in the European Union, and the companies that prepared for it in 2026 will spend 2027 shipping AI features while their competitors are stuck in legal review.
What the AI Act actually requires of marketing AI
The EU AI Act does not treat all AI the same way. Marketing AI tools mostly fall into two categories. Limited risk systems that have transparency obligations, and high risk systems that need conformity assessments before deployment. The line between the two depends on what the system does, not how clever it is.
A generative AI tool that drafts subject lines for human review is limited risk. You have to disclose to recipients that some content is AI generated, but you do not need a conformity assessment. A tool that personalizes pricing in real time based on predicted willingness to pay is high risk. A tool that segments audiences and decides which customers see which offers based on protected characteristics or inferred sensitive attributes is high risk. A tool that automates outbound sales conversations with no human oversight and no opt-out path is high risk.
The trap is that the same underlying model can be limited risk in one deployment and high risk in another. A large language model is not regulated. What you do with it is.
What compliance looks like in practice
For limited risk systems, the practical requirements are disclosure and documentation. Tell customers when AI is producing the content they are seeing. Keep records of what the AI system was used for and when. Train your marketing team on what the disclosure requirement actually means.
For high risk systems, you need a conformity assessment before deployment. That means a documented risk assessment, a data governance process, human oversight mechanisms, accuracy and robustness testing, and a post-market monitoring plan. The conformity assessment does not have to be done by an external auditor for most marketing applications, but it does have to be done before the system goes live, and it has to be repeatable when the system changes.
The honest answer for most marketing teams today is that they cannot produce a conformity assessment for their AI tools because they do not have the documentation the assessment requires. The data inputs are not inventoried. The training or fine-tuning process is not documented. The oversight mechanisms are informal. The monitoring is whatever the vendor logs.
Three things to do before the next regulator letter
First, inventory every AI system your marketing organization is using, including the ones embedded in vendor platforms. If your email tool has an AI subject line generator, that is a system. If your CDP has an AI scoring model, that is a system. If your social tool has an AI content assistant, that is a system. Most marketing organizations discover they have ten times more AI in their stack than they thought.
Second, classify each system by deployment risk using the two categories above. Limited risk is most of what you have. High risk is a smaller list but requires more work. Knowing which is which tells you where to spend the next six months.
Third, for the high risk systems, do the conformity assessment work now while you still have time. Document the data inputs. Document the oversight mechanism. Document the monitoring. If a regulator asks in 2027, you want to be able to produce the package in a day, not start from scratch.
The AI Act is not going to ban your marketing AI. It is going to require you to prove you understand it. The companies that can produce that proof will keep shipping. The companies that cannot will spend 2027 answering questions instead of running campaigns.