EU AI Act and advertising: which rules apply to ad targeting, AI-generated creative and agents

The table maps each provision that can touch an advertising workflow. "Relevance" is our reading of where the rule meets ad tech; it is not a legal conclusion about any system. Article references are to Regulation (EU) 2024/1689 (EUR-Lex) as amended by Regulation (EU) 2026/1744 (EUR-Lex).

What the law says. Article 5(1)(a) bans AI that uses subliminal, manipulative or deceptive techniques to distort behaviour. The test is met only where the person takes a decision "that they would not have otherwise taken" and significant harm results or is reasonably likely. Article 5(1)(b) applies a similar test to people made vulnerable by age, disability or a specific social or economic situation (AI Act, Article 5). Both tests need several conditions at once, so personalisation alone does not meet them. Recital 29 says lawful advertising practices are not "in themselves" harmful manipulation.

What the Commission has said. The Guidelines on prohibited AI practices give advertising examples on both sides of the line. Paragraph 133 says AI personalisation "based on user preferences" is not inherently manipulative when it avoids subliminal, deceptive or exploitative techniques. Paragraph 110 describes a model that targets predatory financial products at people in low-income postcodes as exploitation of a social or economic situation. Paragraph 129 calls hidden emotion recognition used to raise prices at a moment of weakness manipulation (Commission Guidelines, C(2025) 5052). The guidelines are not binding; the Court of Justice has the final word.

Scenario. A lender's DSP campaign scores users on signs of money stress and serves short-term loan ads at night. Under paragraph 110, those facts point toward Article 5(1)(b). The same lender running contextual ads beside personal finance articles raises none of those facts. The outcome turns on the target group, the technique and the harm, not on the use of AI as such.

What practitioners do. Privacy teams commonly record, per model, which signals it uses and whether any feature acts as a proxy for vulnerability. That is a practice, not a legal requirement.

What the law says. Article 50 splits the work. Providers of generative systems must mark outputs as artificially generated in a machine-readable, detectable way (Article 50(2)). Deployers who publish a deep fake must disclose it (Article 50(4)). For "evidently artistic, creative, satirical, fictional or analogous" work, disclosure may be limited so it does not spoil the work (AI Act, Article 50).

The information must reach people "at the latest at the time of the first interaction or exposure" (Article 50(5)). The rules apply from 2 August 2026, with a grace period to 2 December 2026 for marking by systems already on the market (Regulation (EU) 2026/1744, Article 1(39)).

What the Commission has said. The Article 50 guidelines, published on 20 July 2026, use many ad examples (Commission, Guidelines on Article 50). Their list of deep fakes includes an AI video of a celebrity influencer in an ad, and an AI image that makes a product look better than it is. Their list of non-deep-fakes includes talking mice in a cheese campaign, and a real car on an AI background that does not mislead about the car (Guidelines, English PDF). Colour correction or re-scaling in product ads is "likely to have only a minor impact" on perceived authenticity.

The same guidelines answer the "who is the deployer" question for agencies. An advertising company that uses AI under its authority is the deployer, while a brand that only commissions an agency, without control over its use of AI, "is not a deployer" (paragraph 14). Outputs used only in closed production workflows, such as advertising production, need marking only at the final output stage (Guidelines, English PDF).

The code of practice. The Code of Practice on Transparency of AI-generated Content has two sections: marking and detection for providers, and labelling for deployers. The Commission found it adequate for Articles 50(2), (4) and (5) on 8 July 2026, and the AI Board followed the next day (Commission opinion, 9 July 2026). Signing is voluntary. The Commission says adherence "does not constitute conclusive evidence of compliance". Named deployer signatories include Bulgari, Getty Images and Lufthansa (Commission, 31 July 2026).

Example. A retailer's DCO system generates a lifestyle image with a synthetic model wearing a real jacket. The image tool's provider marks the file. If the image could pass as a real photo of a real person, the retailer, as deployer, faces the Article 50(4) disclosure question. For creative pipelines in practice, see our guide to dynamic creative optimization strategies.

What the law says. Since 2 August 2025, providers of general-purpose AI models must keep technical documentation and give downstream providers the information they need. They must also adopt a copyright policy and publish a summary of training content (AI Act, Articles 53 and 113). Models already on the market before that date have until 2 August 2027 (Article 111(3)). These duties fall on model makers, not on the ad tech firm that calls a model through an API.

What the Commission has said. The GPAI Code of Practice was published on 10 July 2025, and the guidelines on the scope of GPAI obligations on 18 July 2025 (Commission, GPAI Code of Practice; Commission, GPAI guidelines). The AI Office enforces the GPAI rules directly.

Why it matters for advertising. A vendor that builds a creative tool on a large model becomes a provider of an AI system in its own right. Under Article 53(1)(b) of the AI Act, the model provider must give it documentation on capabilities and limits. That documentation is the starting point for its own Article 50 marking work.

What the law says. High-risk status depends on the use, not the technique. Article 6(2) points to the eight areas in Annex III. Article 6(3) then removes systems that pose no significant risk, for example those that only perform a "narrow procedural task". Its last sentence brings profiling back in: an Annex III system that profiles people is always high-risk (AI Act, Article 6 and Annex III). Ordinary product or brand targeting sits outside all eight areas, so the Article 6(3) profiling rule does not reach it.

Four Annex III entries come close to advertising. The table quotes them.

Source for all rows: AI Act, Annex III.

What the Commission has said. The Commission published draft guidelines on high-risk classification and ran a targeted consultation until 23 July 2026. On 9 November 2026 its page still described them as a draft (Commission, high-risk guidelines). The first harmonised standard, EN 18286:2026 on quality management, was referenced in the Official Journal through Implementing Decision (EU) 2026/2274 (Commission, 19 October 2026).

What changes the answer. A bank that targets mortgage ads with a lookalike model is outside Annex III if the model only chooses who sees an ad. If the same model also screens who receives a firm credit offer, it may evaluate creditworthiness under point 5(b) of Annex III.

Regulation (EU) 2026/1744 was adopted on 8 July 2026, published on 24 July 2026 and entered into force on the third day after publication (EUR-Lex). The Commission dates its entry into force to 27 July 2026 and the political agreement to 7 May 2026 (European Commission).

Sources: Regulation (EU) 2026/1744, Article 1; Regulation (EU) 2024/1689, Articles 4 and 113.

Nothing in the amendment changed the Article 50 date or the Article 5 bans that already applied. Our ad tech regulation calendar lists these dates next to the other 2027 deadlines.

What the law says. The Act has no chapter on agents. An agent that talks to a person, such as a buying assistant inside a DSP, falls under Article 50(1). The person must be told they are dealing with AI, unless that is obvious (AI Act, Article 50(1)). An agent that generates images or text for publication brings in Article 50(2) and (4).

What the Commission has said. The Article 50 guidelines exclude from marking outputs "exclusively communicated from machine to machine", naming "agent-to-agent communication" as an example (Guidelines, English PDF). A buyer agent sending a bid request to a seller agent therefore produces no output that needs a label under that reading.

What is still open. No guidance we found addresses who is the deployer when one company's agent acts for another company's budget. Our pages on agentic advertising and AI agents in media buying describe the systems in production.

GDPR. Article 2(7) of the AI Act, as replaced in 2026, says the Act "shall not affect" the GDPR or the ePrivacy Directive (Regulation (EU) 2026/1744, Article 1(2)). Profiling for ads still needs a legal basis under the GDPR. People keep the right to object to profiling for direct marketing (Article 21(2)) and not to be subject to solely automated decisions with legal or "similarly significant" effects (Article 22(1)) (GDPR). Consent signals in the bidstream are covered in our guide to GDPR, ePrivacy and RTB consent.

DSA. Online platforms may not show ads based on profiling with special-category data (Article 26(3)). They may not show profiling-based ads to users they know with reasonable certainty are minors (Article 28(2)). Both have applied since 17 February 2024 (DSA, Regulation (EU) 2022/2065). The AI Act adds to these rules; it does not replace them. Our DSA advertising transparency page covers the platform side.

Political advertising. Regulation (EU) 2024/900 has applied since 10 October 2025. Its Article 18 permits online political ad targeting only with data collected from the person, separate explicit consent, and no profiling with special-category data (Regulation (EU) 2024/900). The Commission's guidelines on prohibited practices note that the AI Act complements it (paragraph 142).

The pending GDPR reform. The Digital Omnibus would amend the GDPR and the cookie rules. It is a separate file from the AI amendments and has no final text; see our Digital Omnibus tracker.

The research found no published enforcement decision under Article 5 or Article 50 involving advertising. Readers who need the wider compliance picture can start at the ad tech compliance hub.

1. Regulation (EU) 2024/1689 (AI Act), Official Journal L, 12 July 2024: Articles 2, 3(60), 4, 5, 6, 50, 53, 99, 111, 113, Recital 29, Annex III. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI), adopted 8 July 2026, Official Journal L, 24 July 2026. EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
3. European Commission, "AI Act" policy page (checked 9 November 2026). https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
4. European Commission, Commission Guidelines on prohibited artificial intelligence practices, C(2025) 5052 final (content approved 4 February 2025). https://ec.europa.eu/newsroom/dae/redirection/document/112367
5. European Commission, Guidelines on transparency obligations for providers and deployers of AI systems (page published 20 July 2026). https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems
6. European Commission, Guidelines on the implementation of the transparency obligations under Article 50, English PDF, C(2026) 7702 final. https://ec.europa.eu/newsroom/dae/redirection/document/131215
7. European Commission, "Commission publishes Code of Practice on marking and labelling AI-generated content" (10 June 2026). https://digital-strategy.ec.europa.eu/en/news/commission-publishes-code-practice-marking-and-labelling-ai-generated-content
8. European Commission, Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content (9 July 2026). https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-code-practice-transparency-ai-generated-content
9. European Commission, "Strong backing for the Code of Practice on Transparency of AI-generated Content" (31 July 2026). https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content
10. European Commission, General-Purpose AI Code of Practice (published 10 July 2025). https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai