The EU AI Act doesn't care about your brand guidelines. It cares about your training data.
Brand safety used to mean a keyword blocklist.
For years, "brand safety" in digital advertising meant making sure your ad did not appear next to objectionable content. You maintained a blocklist of URLs and keywords, ran a post-campaign report, and moved on. The brand was safe if it was not embarrassed.
That definition is now dangerously incomplete.
The regulatory shift
The EU AI Act entered full application in August 2025. For any organization deploying AI systems in the European market, which includes most agencies running AI-generated campaigns for European clients, the compliance requirements are concrete and enforceable.
Transparency obligations. If your campaign uses AI-generated content, you must disclose it. This applies to text, images, video, and audio. "Generated with AI" labels are not optional for content that depicts realistic scenarios or could be mistaken for human-created. The days of quietly using AI to produce ad creative without disclosure are over.
High-risk classification. AI systems used in employment, credit scoring, and law enforcement are classified as high-risk and face strict requirements. Marketing AI is generally not high-risk, but the moment your targeting system makes decisions that materially affect individuals, dynamic pricing based on personal profiles for example, you may cross the line.
Data documentation. For any AI model you deploy or fine-tune, you need to document the training data: where it came from, what it contains, how it was processed. If you are using a third-party model, you need the provider to give you this information. If they cannot, you are taking on compliance risk.
Fines. Up to 35 million euros or 7% of global annual turnover, whichever is higher. These are not theoretical. The first enforcement actions have begun.
What agencies must do now
Audit every AI tool in the pipeline. Map which AI systems you use across campaign creation, targeting, optimization, and measurement. For each one, document: what it does, what data it accesses, whether its outputs require disclosure, and who the vendor is.
Establish a disclosure framework. Decide, before the campaign launches, which outputs require AI disclosure and how that disclosure will appear. This needs to be a policy, not a case-by-case judgment call in the middle of production.
Demand vendor transparency. If you use third-party AI models for creative generation, text production, or audience modeling, your vendor must provide documentation on training data provenance, model architecture, and known limitations. If they will not, find a vendor who will.
Build a chain of custody. For every AI-generated asset that reaches a consumer, you should be able to trace: which model produced it, what prompt or input generated it, when it was created, and who approved it. This is not just good compliance. It is good operations.
Train the team. Compliance is not a legal department problem. Every person in the agency who touches AI needs to understand the basics: what requires disclosure, what requires documentation, and what crosses the line into high-risk territory.
The competitive angle
Compliance sounds like a cost. It is also a differentiator. Clients operating in the EU need agencies that can demonstrate compliance. The agencies that build these capabilities now, meaning transparent processes, documented AI usage, and clear disclosure frameworks, will win the clients that cannot afford regulatory risk. And in 2026, that is most clients.
The real brand safety
Brand safety is no longer just about where your ad appears. It is about whether your AI usage can withstand regulatory scrutiny, whether your generated content is properly disclosed, and whether your data practices can survive an audit. The keyword blocklist was the easy version. This is the real one.
