Communication in the age of the AI Act

Since August 2, 2026, Article 50’s transparency obligations have been in effect, and authorities can exercise oversight and impose penalties. For those working in communication and marketing, what matters is the use case rather than the tools.

There is a question anyone working in communication should ask before opening the regulation: what does the system do, and at which stage of the work? The same model can organize sources, respond to a customer, produce synthetic content, or influence a decision concerning a person. The applicable rules change depending on the audience, the task performed, the degree of autonomy, and the resulting effects.

This is the shift in perspective that the AI Act requires of the sector. It is not a list of technologies to authorize or prohibit, but an assessment by function. And it has a very concrete consequence: governance becomes part of editorial work.

The dates that matter

From August 2, 2026, the regulation takes full effect: Article 50’s transparency obligations apply, as do the oversight and enforcement powers of national authorities and the European Commission. For high-risk systems, however, the AI Omnibus has allowed more time: the main deadlines move to December 2, 2027, for cases listed in Annex III, and August 2, 2028, for systems integrated into products.

Meanwhile, adoption is accelerating. European businesses using at least one AI technology increased from 13.5% in 2024 to 20% in 2025; in Italy, from 8.2% to 16.4%. And 34.7% of EU businesses adopting at least one AI technology use it for marketing or sales. In other words, the issue is already part of business processes.

Four categories of use cases

Function, audience, data processed, degree of autonomy, and consequences determine the applicable framework: the same tool can present different risk profiles depending on its use. Applying the rules to marketing and communication functions reveals four groups.

The first covers summarization, translation, ideation, and editing under professional oversight. The second concerns chatbots, deepfakes, and texts in the public interest under the conditions established by Article 50. The third covers candidate selection or assessment and the other cases in Annex III, with rules applying from December 2, 2027. The fourth includes practices prohibited by Article 5, including social scoring and certain forms of harmful manipulation.

Classification begins with three elements: what the system does, whom it involves, and what consequences it produces.

The same activity, different profiles

This is where the rules become tangible. Using AI to write or adapt copy, job advertisements, and corporate content is employer branding. Using it to publish targeted job advertisements or segment candidates is a different matter. Screening applications or evaluating people is a case expressly covered by Annex III.

The same applies in politics: preparing, translating, or revising materials under editorial responsibility is not equivalent to using systems intended to influence the outcome of elections or referendums, or voting behavior. Purely administrative or logistical tools whose outputs do not directly reach people remain excluded.

The Article 6(3) filter provides some latitude: high-risk classification may be excluded when a system does not present a significant risk and performs limited, preparatory, or supporting tasks without materially affecting the decision. However, profiling natural persons always remains high-risk.

For communicators, the point is that creativity remains only one part of the process: targeting, selection, evaluation, and direct influence change the regulatory scope.

Transparency: two levels, one supply chain

Article 50 assigns different obligations to providers and deployers and identifies three relevant situations for communication, marketing, and PR: direct interaction with AI systems, deepfakes, and publication of texts on matters of public interest. Users must be informed that they are interacting with AI unless the context makes this obvious; the artificial or manipulated nature of images, audio, and video must be clearly disclosed; for texts, disclosure depends on human review or editorial control and responsibility for publication.

The Code of Practice published in 2026 translates this into two levels: marking, which is machine-readable and consists of provenance, watermarking, metadata, and detection by design; and labeling, which is visible to people and consists of labels, disclosure, context, and clarity within the channel. The first helps identify the content’s origin; the second makes it understandable when audiences encounter it.

The penalties establish what is at stake: up to €15 million or 3% of worldwide annual turnover, with the higher of the two applying to companies and the lower to SMEs and startups, under Article 99.

Human review must leave a trace

For texts published to inform people about matters of public interest, the Commission distinguishes formal checks from substantive examination. Spell-checking, style corrections, and procedural steps remain formal checks. Substantive review requires expertise in the subject, verification of sources, and a real ability to intervene in the content. Editorial control, in turn, gives a person or entity the authority to approve, modify, or reject the text. In Italy, moreover, works created with the assistance of AI tools can qualify for protection when the result remains an expression of the author’s intellectual work.

Risk often enters before the output: uploaded data, protected materials, vendor terms, and workflow security shape the risk profile alongside the final result. Data governance remains a separate layer from disclosure.

Three steps to bring governance into the workflow

Useful governance makes three decisions clear: how we are using AI, what oversight accompanies the process, and who takes final responsibility. This translates into the following three steps.

• Map the uses (tools, vendors, and actual use cases)
• Control the process (input rules, sources, fact-checking, human review, and approval)
• Document the decisions (essential policies, roles, AI literacy, and tracking)

Uniform rules for every case dilute oversight and responsibility. When this approach becomes part of editorial routines, compliance and content quality move in the same direction.

Authors

Elias Secchi

Head of Strategy And Innovation

Andrea Johan Di Matteo

Consultant – Digital, Social & Content

Fabrizia Argano

Senior Consultant – Digital, Social & Content