AI compliance for UK marketing agencies.

No. Article 50 does not require a label on every AI assisted blog post. Disclosure may be required for AI generated or manipulated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and is subject to editorial responsibility. Check the purpose, audience and review process for each publication.

Not every AI generated image needs a visible Article 50 label. An image, audio clip or video that constitutes a deepfake must be disclosed as artificially generated or manipulated, subject to the Act's exceptions and rules for creative work. Agencies should assess each asset and agree with clients who is responsible for disclosure.

Your agency's policies cover your own operations. A client may need its own documentation depending on how it uses or deploys AI and handles personal data; your policies do not automatically cover its activities.

The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.

The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.

Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.

Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.

The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.

The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.