EU AI Act: What The New Rules Mean For Businesses

Using AI for content, marketing or customer service?

If your business uses AI to create content, run marketing campaigns, or communicate with customers, some of these activities may now fall within the EU AI Act. The requirements depend on the tool being used, how it is used, and who interacts with it.

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, sets common rules for AI across the European Union. It entered into force on 1 August 2024 and became applicable on 2 August 2026, although some obligations took effect earlier. These include rules on prohibited AI practices, AI literacy, governance, and general-purpose AI models.

For businesses in Cyprus and across the EU, the first step is to look at how AI is actually being used. A customer chatbot, AI-generated marketing material, or an internal AI tool may raise different requirements concerning transparency, oversight, and internal procedures.

Why businesses should pay attention

The AI Act does not apply only to large technology companies. It may also affect businesses that use AI tools in their day-to-day operations.

This includes companies that use AI for customer support, content creation, marketing campaigns, software features, internal document review, client communication, or public information.

The level of responsibility depends on the company’s role. A business that develops or supplies an AI system may have different duties from a business that only uses an AI tool. However, companies that use AI in front of customers, employees, or the public should still review their transparency and risk controls.

Transparency is now a key issue

One of the clearest areas of change concerns transparency.

Article 50 of the AI Act sets out transparency obligations for certain AI systems. According to the European Commission, these obligations take effect on 2 August 2026 and apply to specific AI systems, including generative AI systems, interactive AI systems, and deepfakes.

In practice, this means users may need to know when they are interacting with AI rather than a human. Businesses may also need to label or disclose AI-generated or AI-manipulated content in certain cases, particularly where the content appears realistic or is published to inform the public.

This matters for websites, chatbots, social media campaigns, marketing teams, online platforms, and professional service providers alike.

AI in customer service

Many companies now use AI chatbots or automated assistants. These tools can save time, but they also pose legal and reputational risks if users are misled or receive incorrect information.

A business should make it clear when a customer is speaking with an AI system, unless this is already obvious. It should also determine when a user must be transferred to a human employee.

This is particularly important in regulated sectors, including legal, financial, real estate, gaming, fintech, payment services, and healthcare.

AI in Marketing and Content

Marketing teams often use AI to create text, images, videos, captions, adverts, and website content. This use should not be informal or uncontrolled.

AI-generated content should be reviewed before publication. Businesses should verify that it is accurate, lawful, original, and not misleading. Where AI-generated or AI-altered content appears authentic, or where it concerns a matter of public interest, disclosure may be required.

The European Commission has also published guidance and a Code of Practice on the transparency of AI-generated content to support compliance with Article 50.

For law firms, accounting firms, consultants, media teams, and regulated businesses, human review remains essential. AI can assist with drafting or design, but it should not replace professional responsibility.

Software and technology companies

Technology companies should take a closer look at their role under the AI Act.

A company that develops, modifies, integrates, sells, or provides an AI system may have provider obligations. A company that uses an AI system in its own operations may be treated as a deployer.

Providers of general-purpose AI models have specific obligations under the AI Act. The European Commission states that these obligations took effect on 2 August 2025. They include technical documentation, copyright-related policies, and public summaries of training content. More advanced models with systemic risk face additional requirements.

This means that technology companies should review product documentation, user instructions, contracts, copyright issues, risk controls, and EU market-access requirements.

Non-EU Companies may also be affected

The AI Act can also affect companies outside the EU.

A non-EU company should review the AI Act if it places AI systems on the EU market, serves EU users, or produces AI output used within the Union. This applies to international software providers, online platforms, marketing tools, and AI-powered service providers.

A company does not need to be established in the EU to be subject to EU AI compliance requirements.

What businesses should review now

Businesses should begin with a simple review of their use of AI.

They should identify which AI tools staff use, where AI appears in customer communications, what content is generated with AI, whether personal data is processed, and whether users are informed when AI is used.

Key areas to review include:

• AI chatbots and automated replies
• Marketing content and AI-generated visuals
• Public information published online
• Vendor contracts and AI tool terms
• Data protection and copyright risks
• Human review before publication
• Internal AI policies and staff training

The aim is not to stop AI use. The aim is to use AI clearly, safely, and responsibly.

Key Points for businesses using AI

The EU AI Act has moved AI compliance from a future concern to a current business issue. Companies should know where they use AI, how users are affected, and whether disclosure, human review, or internal controls are needed.

For businesses that use AI in customer service, marketing, software, or public content, an early review can reduce risk and support responsible use.

Frequently Asked Questions

Does the AI Act apply to businesses that only use AI tools?

Yes, it may apply. A business that uses AI tools may have obligations, particularly when customers, employees, or the public interact with the AI system or its output.

Do AI chatbots need a disclosure?

In many cases, yes. Users should usually know when they are interacting with AI rather than a human, unless this is obvious from the context.

Does AI-generated marketing content need to be labelled?

It depends on the content and use. Disclosure may be required where AI-generated or AI-manipulated content appears realistic or is used to inform the public.

Should businesses create an internal AI policy?

Yes. An internal AI policy can help staff understand which AI tools they may use, what data they must avoid entering, and when legal or management review is required.