Navigating the EU AI Act: Implications for Direct Marketing

The EU AI Act (Regulation (EU) 2024/1689) applies to AI used in marketing, but not in the way many summaries suggest. The Digital Omnibus on AI, given final approval by the Council of the EU on 29 June 2026, moved the compliance deadline for high-risk systems to 2 December 2027. The rules that matter for marketing teams are the ones already in force, or arriving on 2 August 2026 — and none of them is the high-risk regime.

Direct marketing is not a high-risk use. Annex III lists eight areas: biometrics, critical infrastructure, education and vocational training, employment, access to essential private and public services, law enforcement, migration and border control, and the administration of justice and democratic processes. Marketing and advertising do not appear. Nor does the AI Act contain any consent requirement for marketing AI: consent is a concept of the GDPR and the e-privacy rules, and those laws continue to decide whether you may contact someone and on what data.

What the AI Act does require of marketers is narrower and already live. Since 2 February 2025, Article 5 prohibits AI that uses subliminal, manipulative or deceptive techniques to materially distort behaviour in a way that causes significant harm, and AI that exploits a person’s vulnerabilities due to age, disability or a specific social or economic situation. Targeting models and persuasion tools need to be checked against both. From 2 August 2026, Article 50 requires that people are told when they are interacting with an AI system such as a chatbot, and that deep-fake image, audio and video content is disclosed as artificially generated. Article 4, as amended by the omnibus, requires providers and deployers to take measures to support AI literacy among the staff who operate these systems.

Automated decision-making and human review are governed by the GDPR, not the AI Act. Where a marketing decision produces a legal or similarly significant effect on someone — differential pricing of credit or insurance, for example — Article 22 GDPR applies, with its right to human intervention. Most personalisation and segmentation falls below that threshold, but the right to object to direct marketing under Article 21 GDPR is absolute and applies to AI-driven campaigns exactly as it does to any other.

The sensible step is an inventory: list every AI system used in marketing, including AI features inside the SaaS tools you already pay for, and classify each against Articles 5 and 50 and against your existing GDPR obligations. That exercise is short for most marketing teams, and it is what an auditor or a large customer will eventually ask to see.

For businesses outside the EU that market into it, Privacy Core Services offers EU representative services under Article 27 GDPR, and can help you work out which of the AI Act’s obligations actually apply to your marketing stack.