With today’s publication of compliance guidelines, the EU has made one thing clear: enforcement of the AI Act is not theoretical. While the initial obligations target systemic-risk and foundation models, advertisers who build on top of these systems will not be shielded for long.

This is not just a legal matter. It is an operational one. Most advertisers today cannot fully map which AI systems touch their customer journeys, let alone confirm how data is processed, what training sources are used, or where risks may emerge. This blind spot creates exposure, both regulatory and reputational.

The strategic opportunity is to treat compliance not as a checklist, but as a catalyst for control. Advertisers who audit and document their AI supply chain now will gain not only legal defensibility, but clearer levers to improve performance, governance, and cost efficiency across media and creative workflows.

Regulation will inevitably shape how AI scales in advertising. Those who invest early in visibility and control will shape how, and where, value is created. 

The European Commission has issued guidelines to help companies comply with the AI Act, which targets models with systemic risks. These include advanced AI systems with significant societal impact, facing strict rules from 2 August.

Firms like Google, OpenAI, Meta, and others must complete model evaluations, risk assessments, cybersecurity measures, and report serious incidents. Fines for non-compliance can reach €35 million or 7% of global turnover.

General-purpose AI models must meet transparency rules, including documentation, copyright policy adoption, and data usage disclosures. The guidelines aim to ease regulatory concerns and support smooth implementation of the AI Act.