How the EU’s AI Act will impact marketers

The new law places guardrails around the use of some AI systems deemed by EU authorities to pose a potential threat to citizens’ privacy or safety. It was passed in March of this year, at the crest of a wave of AI fervor that had been rolling over the world since the release of OpenAI’s ChatGPT in late 2022.

The marketing industry has been especially keen in its embrace of AI during this period. Many major ad agencies and brand marketing teams have adopted AI in some capacity over the past year and a half, whether in an effort to improve audience-targeting capabilities, generate synthetic media in a marketing campaign or interface with customers via sleek new chatbots.

That enthusiasm has been tempered by a glint of worry related to the speed at which the technology is evolving. Marketing leaders responded to a proposed six-month pause on AI research last year with mixed emotions, acknowledging the need to proceed carefully while also voicing concerns about a potential chilling effect that such a moratorium could have on progress.

Generally speaking, however, excitement has eclipsed anxiety when it comes to the ad industry’s use of AI. Today’s news, then, should matter to marketers – even if they’re not the ones being specifically targeted by the new law.

The good news is that the regulation probably won’t have a noticeable impact on the daily operations of most marketing professionals. The law primarily concerns AI developers, or “providers,“ while its mandates around the use or deployment of AI systems are less stringent. For example, an ad agency that launches an ad campaign that incorporates GPT-4o would be considered a “deployer,” and would therefore be exempt from most restrictions under the law.

“It's very important to keep in mind that the obligations of the AI Act apply [mostly] to the AI providers,” says Thomas Regnier, a spokesperson for the European Commission – the EU’s executive arm. “For marketing companies and all the other citizens, we want them to be able to use all the potential benefits of AI, but in the end the obligations to comply with the legislation is not really for the ones using these AI systems – it’s for the ones placing them on the market.”

The law applies to all AI developers with products or services active in the EU, regardless of where the companies themselves are based.

Deployers aren’t completely off the hook, though. As OpenAI noted in a company blog post yesterday, the boundary between the two categories is somewhat porous. “Although the majority of obligations under the AI Act fall on providers rather than deployers, it’s important to note that a deployer that integrates an AI model into their own AI system can become a provider under the Act, such as by using their own trademark on an AI system or modifying the AI system in ways that weren’t intended by the provider.”

The AI Act also explicitly states that deployers using AI to generate deepfake audio, images or video “shall disclose that the content has been artificially generated or manipulated.”

Most ad agencies fall under the category of deployers, as they are not developing their own AI systems, but using third-party programs like those launched by OpenAI, Anthropic and Google.

Even within the broader group of providers, only a narrow segment will be forced to take any kind of action under the Act. The vast majority of AI systems currently operating in the EU – around 85%, as Regnier recently told The Drum – will not fall under the Act’s purview, simply because they’ve been deemed to pose a minimal public safety risk. EU regulators aren’t that worried, for example, about your AI-powered email spam filter.

The regulation is mainly concerned with systems that gather and process personally sensitive information. “Such high-risk AI systems include for example AI systems used for recruitment, or to assess whether somebody is entitled to get a loan, or to run autonomous robots,” the Commission wrote in a press release published today. These systems will be subject to close human oversight and the adoption of specific cybersecurity measures.

The AI Act also imposes transparency measures on AI chatbots like ChatGPT – which must disclose to users that they’re interacting with a machine. Within these systems, deepfakes must also be clearly labeled as such.

The Commission says it will ban systems deemed to pose an “unacceptable risk” to citizens’ rights, including “certain applications of predictive policing” and employers’ use of emotion recognition software.

Although the AI Act was given final approval by European lawmakers and officially goes into effect today, the enforcement period has not yet begun.

The majority of rules within the law will apply starting on August 2. “However,“ the Commission wrote, “prohibitions of AI systems deemed to present an unacceptable risk will already apply after six months, while the rules for so-called General-Purpose AI models” – those capable of performing a broad array of tasks that can be integrated into many different applications – “will apply after 12 months.”

Marketers would do well to take note of this schedule, according to Enza Iannopollo, a principal analyst at Forrester specializing in data privacy. “Understanding the enforcement timeline will help marketers and their organizations prioritize their efforts,” she says. “Marketers should reach out to their colleagues in legal, compliance and IT to get started on the classification of their AI and genAI projects now. “

For more on the latest happenings in AI, web3 and other cutting-edge technologies, sign up for The Emerging Tech Briefing newsletter.