Disclaimer: This article is for general information only and does not constitute legal advice. The EU AI Act and related guidance may change, so businesses should seek professional legal advice before making compliance decisions. Information is based on official EU AI Act and European Commission guidance, including the AI Act Service Desk.
The EU AI Act: A Guide for CMOs and CRM Teams
The EU AI Act is now in force. It’s the world’s first major AI law, and as of 2 August 2026, the core rules are live and being enforced. If your business touches EU customers in any way – sells to them, markets to them, holds their data – this law applies to you, whether or not you’re based in the EU.
For CMOs and CRM teams, that matters because AI is now woven into almost every part of the marketing stack: chatbots, personalisation engines, lead scoring, generative copy and creative, sentiment analysis, next-best-action recommendations.
The Act doesn’t ban AI. It simply sets different rules depending on how AI is used and how risky it is.
That’s important because the headlines about the EU “cracking down on AI” don’t tell you what it means for your business. A CV-screening tool and an email subject-line generator may both use AI, but they face very different rules.
Most organisations are still figuring this out, as over 50% say they’re unclear on what the EU AI Act actually requires or how to categorise their AI use cases by risk. Which means your clarity and proactive strategy will set you apart.
This guide focuses on what marketing and CRM teams need to know, what’s risky, what isn’t, and what EU businesses need to consider.
What is the EU AI Act?
The EU AI Act sorts AI uses into four risk levels – banned, high-risk, limited-risk, and no-risk – and regulates each one differently. Most marketing and CRM AI sits in the low-risk categories.
Key dates: what’s already law and what’s coming
The Act didn’t arrive all at once, it’s phasing in over several years. Here’s where things stand:
- February 2025: Bans on prohibited practices (manipulative AI, social scoring, untargeted facial-recognition scraping) took effect.
- August 2025: Rules for general-purpose AI models (the models behind tools like ChatGPT and Claude) came into force. This obligation sits mainly with the AI providers, not with businesses using the tools.
- August 2026 (now in force): Transparency rules took effect – this is the tier most relevant to marketing: chatbot disclosure, labelling of AI-generated content, and disclosure of synthetic media.
- December 2027: Rules for high-risk AI systems become enforceable, including conformity assessments, human oversight, and documentation requirements.
If your marketing stack includes a chatbot, generative content tools, or AI-generated media, the rules that apply to you are already live, not years away.
EU AI Act risks for CRM teams and marketers
Research from McKinsey found that many EU businesses are using AI but still aren’t confident about managing the risks. Around 8 in 10 said unclear rules were their biggest challenge, while 7 in 10 found the rules too complicated.
Less than 1 in 10 said they had fully met the Act’s requirements, and almost half hadn’t set aside a budget for compliance.
So, what should CRM and marketing teams be aware of?
- Undisclosed chatbots: If customers talk to a bot, they need to know it’s a bot. This is already law.
- AI that exploits emotions to manipulate: Using detected stress, vulnerability, or addiction patterns to push a sale is banned. Normal personalisation is fine. Targeting someone’s panic is not.
- Scoring that gates essential services: Standard lead scoring is fine. If your model effectively decides someone’s access to credit, insurance, or a job, it’s high-risk and comes with heavy compliance duties.
- Undisclosed AI-generated media: AI images, video, or voice that could pass as real need a label. AI-written email copy doesn’t need one.
- Facial recognition tied to customer data: Scraping faces to build recognition databases is banned outright.
What’s generally low risk
- Writing marketing copy with AI: fine
- Personalisation, segmentation, churn prediction: fine
- Lead scoring for sales prioritisation: fine
- Using ChatGPT, Claude, or similar tools: the heavy compliance sits with the AI provider, not you
The EU AI Act and how this fits with GDPR
If you already run a GDPR-compliant CRM platform, you’re ahead – but the two laws aren’t the same thing and don’t replace each other.
GDPR governs the personal data your AI systems use: what you collect, how you store it, and what rights customers have over it. The AI Act governs the AI system itself – how it’s built, how risky its use case is, and what you need to disclose about how it works.
In practice, this means a personalisation engine can be fully GDPR-compliant on the data side and still need a chatbot disclosure or content label under the AI Act. Treat them as two separate checklists that both apply to the same tools, not one law superseding the other.
What CRM teams should do with the new EU AI Act
- Check every AI-facing customer touchpoint discloses its AI
- Label any AI-generated images, video, or voice used in campaigns
- Check nothing in your stack infers emotional vulnerability to drive sales
- Confirm your lead scoring doesn’t function as a credit/eligibility decision
- Ask vendors where their compliance ends and yours begins
The EU AI Act: What it means if you’re in the UK
Brexit doesn’t exempt you. The Act applies based on where the AI’s effects land, not where your business is registered – the same logic as GDPR.
The UK takes a lighter approach: Instead of one AI law, the UK uses existing regulators such as the ICO, FCA and CMA to oversee AI.
For UK marketers: If you work with EU customers or target people in the EU, the EU AI Act may apply. If you’re UK-only, the immediate legal risk is lower, but following good practices like transparency and avoiding manipulative targeting is still recommended.
Ready to get AI Act-ready?
Navigating AI compliance while keeping your marketing moving isn’t easy to do alone. That’s where we come in, as your CRM agency, we’ll help you build campaigns, chatbots, and customer journeys that are both effective and compliant.
Get in touch with us to see how we can support your team.
We look forward to hearing from you!
FAQ’s – The EU AI Act
Does the EU AI Act apply to UK businesses?
Yes, if you have EU customers, process EU data, or your AI system’s output affects people in the EU. UK-only businesses fall outside the EU Act but are still subject to the UK’s own AI principles.
Is AI-powered personalisation banned under the EU AI Act?
No. Personalisation, segmentation, and lead scoring are low-risk activities and remain unrestricted. The Act targets manipulation of vulnerability, not personalisation itself.
Do chatbots need to disclose they’re AI?
Yes. This has been a legal requirement since August 2026 for any AI system interacting directly with customers.
What’s the penalty for an undisclosed AI chatbot or unlabelled AI content?
This falls under the transparency-obligation tier, which carries fines of up to €15 million or 3% of global annual turnover. You can read more about the penalties on the official website.
Does GDPR still apply if I’m compliant with the AI Act?
Yes. The two laws cover different things – GDPR governs personal data, the AI Act governs the AI system and both apply simultaneously.
References and sources
- EU AI Act (Regulation 2024/1689) – Official legal text.
- European Commission – AI regulatory framework – Official EU guidance.
- AI Act Service Desk — Official EU compliance guidance.
- Artificial Intelligence Act – Independent AI Act explainer.
- McKinsey & Company – The European Union AI Act: Time to Start Preparing – 2024 research on AI Act readiness.
Last checked and updated: August 2026. Penalty figures, dates, and requirements referenced in this article reflect the Act’s text and Commission guidance as of that date and should be independently verified before being relied upon for compliance decisions.
