EU AI Act: What the AI Regulation Means for Sales and Marketing

Does the EU AI Act affect your sales team at all?

Your sales team has a language model draft its quote emails. On the website a chatbot answers the first questions. Marketing produces images for ads with an AI tool. Nobody in the business has ever developed an AI system. All of this nevertheless falls under the EU's AI regulation, known as the AI Act, officially Regulation (EU) 2024/1689.

The reason lies in the roles the law defines. A provider is whoever develops an AI system and places it on the market. A deployer is whoever uses an AI system professionally under their own authority. Most small and mid-sized businesses are deployers. Far fewer duties apply to them than to providers, but some do. The central question, then: which obligations under the AI Act apply to a business that uses AI in sales and marketing, and how do you sort them? To answer it, we first go through the structure and deadlines of the regulation, then the transparency obligations, the sensitive cases, and AI literacy, ask whether transparency costs revenue, and end with the AI use profile.

In a survey by Bitkom, Germany's digital industry association, of 603 companies with 20 or more employees in summer 2026, two thirds of the companies without AI named legal uncertainty as a barrier.

How is the AI Act structured?

The regulation sorts AI by risk. The greater the possible danger to people, the stricter the rules. The European Commission describes four levels.

In addition there are separate rules for general-purpose AI models, meaning the large language and image models behind many tools. These duties fall on the makers of the models. What matters for you as a user is that your provider meets them.

The typical applications in selling described in the comparison on AI in sales almost all sit in the two lower levels: drafts for emails, research, call notes. Things become critical in a few clearly identifiable places.

Which deadlines apply after the 2026 changes?

The regulation has been becoming applicable in stages since August 2024. In summer 2026 the EU changed the timetable. The amending regulation, often called the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and has applied since July 27, 2026.

The postponement takes time pressure out of the high-risk topic. The transparency obligations, which touch marketing and sales most often, were not postponed. On these the Commission has announced or published guidelines and a voluntary code of practice.

Which transparency obligations affect marketing and sales?

They are set out in Article 50 of the regulation. Four cases are of practical importance for smaller businesses. In two of them the main duty lies with the provider of the tool, in two with you as the deployer.

For day-to-day work this means: a language model that gives your sales team a draft which a person reads, changes, and sends under their own name does not, on current understanding, trigger a labeling duty. Automated sequences without human review are a different matter. If you hand follow-up emails and appointment scheduling entirely to a machine, as the guide on automating sales describes for routine tasks, you should answer the disclosure question deliberately.

Expert articles of the kind recommended in the guide on B2B content marketing stay on the safe side with human review and clear responsibility. An artificially generated customer video or a cloned voice should be labeled.

Where does it get delicate: prohibited practices and high-risk AI?

Three areas deserve particular attention in selling.

• Manipulation. AI systems are prohibited if they use subliminal or deliberately deceptive techniques to push people into decisions that cause them significant harm, or if they exploit vulnerabilities due to age, disability, or social situation. Ordinary advertising is not covered. Anyone who automates pressure tactics and tailors them to vulnerable groups is approaching the line.
• Emotion recognition in the workplace. The regulation prohibits it in principle. Tools that evaluate the emotional state of your own employees in sales calls should therefore be reviewed legally before use. Analyzing customer sentiment additionally raises transparency and data protection questions.
• Recruitment. AI that pre-sorts applications or evaluates employees counts as high risk. This affects you as soon as you have applications filtered automatically when hiring your first sales employee.

And scoring inquiries? A points system for business customers, as used in lead qualification, is not explicitly named in the list of high-risk cases as I understand it. What is named there is the creditworthiness assessment of natural persons. Anyone who automatically ranks consumers by ability to pay, or refuses them offers on that basis, should have the case reviewed.

For infringements the regulation provides for fines: up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, and up to 15 million euros or 3 percent for most other obligations. For small and medium-sized enterprises, the lower of the two amounts applies. According to the Commission, the relief for small and medium-sized enterprises was extended in 2026 to somewhat larger mid-sized companies.

What does AI literacy under Article 4 require?

Since February 2, 2025 the regulation has contained a provision on AI literacy. Providers and deployers are to see to it that people who work with AI systems on their behalf understand enough about them: what the tool can do, where it goes wrong, and which data belongs in it.

According to the consistent accounts of several law firms, the 2026 amendment softened this provision. Companies are to take measures that support the development of AI literacy. On that reading they do not have to guarantee a particular level of competence for each individual. If in doubt, read the exact wording in the Official Journal or have it read for you.

Regardless of the legal position, the idea is sensible. An hour of instruction, one page of rules, and a contact person in the business cost little and prevent the most expensive mistakes, such as customer data in an unvetted tool.

Does transparency cost revenue?

In the short term it can, as the research shows.

• Luo, Tong, Fang, and Qu (2019) analyzed a field experiment at a large financial services company. 6,255 customers were randomly assigned to receive highly structured sales calls from experienced or inexperienced staff or from a bot that identified itself not at all, before the conversation, or only afterward. Undisclosed bots sold as well as experienced staff and four times as well as inexperienced staff. Notice before the conversation cut purchase rates by more than 79.7 percent. Customers perceived the bot as less knowledgeable and less empathetic, although the analysis of the call recordings showed it to be both. Later disclosure and customers' prior AI experience softened the effect.
• In Israfilzade (2025), ads labeled as made by humans received more trust and higher purchase intent, even when they came from an AI.
• Feng and colleagues (2026) found in three experiments that disclosing AI authorship indirectly worsened attitudes toward the brand because viewers assumed less effort behind the ad.
• Fisher (2026), by contrast, found mostly ambivalence toward online banners labeled as AI-generated, and some positive effects among people with AI experience.
• Raddatz and Green (2026) used an online panel to survey 220 users of financial services in EU countries about the AI Act. Those who rated the institutional structures as robust trusted AI systems more and saw less risk. The model explained 43.8 percent of the differences in trust, but only 8 percent for perceived risk. Respondents were 29.5 years old on average, and two thirds were male. The study measured perceptions, not purchasing behavior.

The studies come from particular industries and countries and cannot be transferred one to one to your market. Their shared finding: people rate the same performance lower when they know a machine is behind it. The late disclosure from the experiment is no way out in the EU, because Article 50, by its wording, requires the notice at the latest at the time of the first interaction. In a legal analysis of the draft at the time, Varošanec (2022) called transparency the currency of trust.

If you hide AI in selling, you save yourself a label today and risk tomorrow the trust that every deal depends on.

For sales, a sober division of labor follows: the machine prepares, the human talks to the customer. According to Luo and colleagues, the company in the study took the same path, and its bots have since assisted the call center staff. Legally that is the simpler position.

The AI use profile: how do you put your AI use in order?

You do not need a compliance system to get started. A spreadsheet with one row per AI use is enough. I call it the AI use profile. Six entries suffice.

1. Purpose

   What is the tool used for? One sentence, for example: drafts for follow-up emails to existing customers.

2. Role

   If you use a ready-made tool, you are a deployer. If you rebuild it and offer it under your own name, you can become a provider.

3. Risk level

   Prohibited, high risk, transparency risk, or minimal. If in doubt, put a question mark and clarify.

4. External contact

   Do customers see or hear the output without review? Then the question of disclosure arises.

5. Data

   Which customer or employee data goes in, and where is it processed?

6. Person responsible

   One person who knows the use, answers questions, and reports changes.

How many businesses already use AI is shown in the assessment of SME digitalization in numbers.

How to get started

Half a day is enough for the first pass. After that you know what you need legal advice for.

• List all AI tools used in sales, marketing, and customer service, including private accounts of individual employees.
• Fill in an AI use profile with the six entries for each use.
• Check whether the chatbot or phone assistant identifies itself as a machine.
• Ask the provider of every text, image, and video tool how it marks AI-generated content.
• Look for artificially generated images, voices, and videos of real people in current advertising and label or replace them.
• Write one page of rules for the team: which tools are allowed, which data does not belong in them, who reviews.
• Collect the uses with question marks, such as applicant selection or sentiment analysis, and present them to a legal adviser.

The opening question was which obligations the AI Act places on a business that uses AI in sales and marketing. Most businesses are deployers and have manageable obligations. The transparency rules come first: people should be able to tell when they are talking to a machine or seeing deceptively real AI content. Things only become sensitive with prohibited practices and high-risk applications, and for those cases legal advice is worthwhile, made shorter and cheaper by a complete list of AI uses.