What really matters starting in August
On August 2, 2026, a requirement of the EU AI Act takes effect that many marketing departments still haven’t prioritized. Article 4 obliges companies to ensure that every employee who works with AI systems has sufficient AI competence. Not sometime later. From that date.
At the same time, Germany’s Federal Network Agency will begin issuing fines under the EU AI Act framework in August. Penalties can reach up to €35 million or 7% of global annual turnover, whichever is higher.
To date, 78% of organisations have not implemented serious compliance measures. This is not an abstract risk — it is a concrete gap in everyday operations. Marketing teams are particularly exposed: they are often the first home for AI tools in an organisation and, at the same time, the function with the least structured governance.
We are not writing to create fear. We are writing because, over the past months, we have seen that well-built agentic systems offer a real advantage on this issue. And because it helps to separate compliance and governance at the start.
What changes concretely from August?
Which EU AI Act requirements apply from August 2, 2026?
Three requirements become relevant from the deadline:
Article 4: Mandatory AI competence. Companies must ensure that all employees who deploy or oversee AI possess the knowledge needed to use these systems safely and responsibly. This includes marketing teams that work daily with tools such as ChatGPT, Claude, or Midjourney.
Article 50: Labelling requirement for AI-generated content. Synthetic text, images, and video produced with an intent to influence must be labelled as AI-generated. For marketing teams that use AI in content production, this creates a direct operational requirement.
KRITIS registration requirement (July 17, 2026). The number of affected organisations rises from roughly 4,500 to about 30,000. Many mid-sized companies are caught by this for the first time.
- Article 4: Mandatory AI competence Companies must ensure that all employees who deploy or oversee AI possess the knowledge needed to use these systems safely and responsibly. This includes marketing teams that work daily with tools such as ChatGPT, Claude, or Midjourney.
- Article 50: Labelling requirement for AI-generated content Synthetic text, images, and video produced with an intent to influence must be labelled as AI-generated. For marketing teams that use AI in content production, this creates a direct operational requirement.
- KRITIS registration requirement (July 17, 2026) The number of affected organisations rises from roughly 4,500 to about 30,000. Many mid-sized companies are caught by this for the first time.
How high is the compliance risk for AI tools in marketing?
Higher than most assume. The LARA study ran 3,000 tests across leading language models. The result: even the most privacy-aligned model achieved only a 54% GDPR-compliance rate. For certain providers, violations of forbidden actions occurred in more than 80% of tests.
According to Check Point, 52% of knowledge workers use unauthorised AI tools in daily work. 64.5% of activity on private AI accounts serves business purposes. And 90% of leaders believe they have oversight.
These are not niche figures. They reflect the reality for most marketing teams in Germany.
- 54% – GDPR-compliance rate of the best-tested model
- >80% – violations of forbidden actions for certain providers
- 52% – knowledge workers using unauthorised AI tools
Compliance versus governance: the important difference
I often hear the two used interchangeably. That’s understandable — but costly.
Compliance answers: What must we not do? It is reactive. It emerges from external pressure, regulation, and the risk of fines. Compliance is necessary. But compliance alone does not create a functioning AI system.
Governance answers: Who is responsible for what the system does, and how do we ensure our AI systems act consistently, traceably, and correctly? Governance is the internal architecture. It determines whether an organisation is controlled by its AI systems or in control of them.
McKinsey’s State of AI Trust 2026 quantifies the difference: organisations with clearly defined governance roles — AI-specific responsibilities and audit processes — achieve a maturity score of 2.6. Without ownership, the score is 1.8. This is not a statistical footnote; it is a scale effect.
Compliance buys you time. Governance enables growth.
The structural advantage of agentic systems
This is the part that has occupied us most in recent months.
In traditional organisations, every regulatory change triggered the same sequence: roll out new training, publish policies, hope people read and understand them and then apply them. We all know the pattern: policy, page 7; read by 30%; remembered by 10%; implemented by fewer.
In an agentic organisation, it works differently.
When a requirement changes — for example, the labelling requirement for AI-generated content — a single file changes in a well-built system: the context file of the relevant agent. From the next run, every agent that produces content follows that requirement. Not because it was trained on it, but because the rule is embedded in the system.
This is not an abstract benefit. It is why governance in agentic systems becomes a prerequisite for construction rather than an additional burden.
What does that look like in everyday marketing?
Imagine an agent that drafts social media posts. Its context file currently contains tone, target audience, banned terms, and maximum length.
From August 2, it will also contain: AI-generated content must be labelled as such. Use this label.
That’s a two-line addition. No training. No workshop. No hoping everyone understood it. The agent enforces the requirement in every iteration.
By contrast, if you communicate the requirement via training, you can realistically expect an effectiveness rate of perhaps 60–70% — and only if employees completed the training, remember it, and think of it at the moment of content creation.
This is not an argument against people. It is an argument for clearly structured systems.
What does that look like in everyday marketing?
Imagine an agent that drafts social media posts. Its context file currently contains tone, target audience, banned terms, and maximum length.
From August 2, it will also contain: AI-generated content must be labelled as such. Use this label.
That’s a two-line addition. No training. No workshop. No hoping everyone understood it. The agent enforces the requirement in every iteration.
By contrast, if you communicate the requirement via training, you can realistically expect an effectiveness rate of perhaps 60–70% — and only if employees completed the training, remember it, and think of it at the moment of content creation.
What marketing teams should do now
We do not recommend a rushed compliance sprint. We recommend four operational steps you can implement immediately.
1. Create an AI inventory. Which tools are in use? Which are officially approved, and which run in the shadows? This is not a bureaucratic exercise; it is the foundation for everything else.
2. Define a sanctioned stack. Specify which models and workflows are permitted for which purposes. Not as a blacklist, but as a guidance framework. Teams perform better when they know what is allowed.
3. Extend context files for AI agents with compliance requirements. If you already use agents, embed the new requirements directly: labelling of AI-generated content, data protection constraints, tone and brand rules.
4. Make a clear ownership decision. Who in your marketing organisation is responsible for what your AI systems decide? This question is uncomfortable. But it is the only one that prevents compliance from becoming detached from reality.
Governance is not a burden. It is the architecture
The EU AI Act forces a choice for marketing teams.
Option one: treat compliance as a checklist. Book literacy training, tick the box, carry on as before. That is an answer — but not one that will be sufficient in two years.
Option two: use the deadline to reconsider your AI architecture. Ask which agents are in use, who controls them, which rules are embedded, and where responsibility sits.
We have seen teams that ask these questions early not only become more compliant. They build better systems. Systems that grow with regulatory requirements instead of failing because of them.
This is the structural advantage well-built agentic organisations have over teams that still treat AI as a tool rather than as a system. August 2 is a good moment to ask that question.
Frequently asked questions on EU AI Act compliance in marketing (FAQ)
What must marketing teams have prepared by August 2, 2026?
Essential elements are demonstrable AI competence among employees, clear responsibilities, and processes for labelling synthetic content. A documented inventory of tools and agents in use and defined approvals for their operation are also helpful.
How do I pragmatically implement the labelling requirement for AI-generated content?
Choose a single label and embed it directly in production workflows — ideally in the context files of the responsible agents. This ensures the label is applied automatically without relying on manual steps.
Is a training program enough to be compliant?
Training is necessary but not sufficient. Without clear governance structures, everyday application remains patchy and difficult to audit.
What belongs in a marketing agent’s context file?
Alongside tone, audience, and style rules, include binding requirements on data protection, prohibited content, and label formats. Changes to requirements can then be made centrally and take effect immediately.
How do I deal with shadow IT and unauthorised AI tools?
Create transparency first, then define approved alternatives. A sanctioned stack with clear purposes reduces risk and simplifies control.
Who should own AI systems in marketing?
Appoint a clearly accountable role to oversee agent decisions and keep processes auditable. Without ownership, compliance and operational practice will not align.
Interested?
Let's find out together how we can implement these approaches in your organization.
Schedule a conversation now