Since August 2, 2026, publishing AI-generated text on a matter of public interest without disclosing it exposes a European business to a fine of up to 15 million euros, or 3% of its global turnover. That’s Article 50 of the AI Act, which takes effect that day with no exemption for company size. Following the scheduled arrival of AI Overviews in France, the fall of 2026 lines up another AI-related regulatory deadline. Its real scope, though, is narrower than what’s generally repeated, and at the same moment, the one clause that might have governed how your marketing AI agents behave just lost sixteen months.
The two obligations share the same birth month but follow opposite trajectories. For a leader publishing AI-assisted content while also handing part of their marketing to automation tools, understanding this gap changes, in concrete terms, where to focus attention first.
A labeling obligation narrower than it looks
Article 50 doesn’t apply to all AI-assisted marketing content. It targets a precise category: published text, informing the public, on a matter of general interest (politics, public health, consumer safety). The European Commission spells this out in its official FAQ: once content has gone through genuine human review and editorial control, capable of approving, editing or rejecting the substance, the labeling obligation falls away. A spell check isn’t enough to trigger that exemption; real editorial sign-off is.
In practice, most B2B marketing content (product pages, newsletters, ads) falls outside the strict scope of this obligation, provided a human genuinely holds editorial responsibility for it. What stays covered regardless of topic: conversational systems must disclose that they’re AI, and synthetic content (image, audio, video) must carry a marking, deepfakes included. A blog post drafted with an AI assistant, then read and signed off by someone on your team, on a purely product-related topic, therefore falls outside Article 50’s scope: neither the exemption nor the obligation applies, for lack of a public-interest subject.
The clause meant to govern your AI agents just slipped by sixteen months
Where Article 50 governs content, Article 14 governs behavior: it’s the human oversight clause, the only provision in the AI Act that requires keeping a human able to understand, correct or stop an autonomous system. It was part of the “high-risk” obligations block scheduled for August 2, 2026, the same date as the labeling rule, before being pulled out by the Digital Omnibus.
This regulation (EU Regulation 2026/1744), which entered into force on July 27, 2026, just days before the original deadline, pushes back the “high-risk” obligations, Article 14 included, to December 2, 2027 for the autonomous systems covered by Annex III. Sixteen more months during which no European rule requires keeping a human in the loop of an autonomous AI agent, including those running your ad campaigns, your email marketing, or your exchanges with the CRM. The delay says nothing about how dangerous these agents actually are: it mostly reflects how hard member states found it to agree on implementing rules for a still-young category of systems.
What this means if you’re running automation agents
A survey run in January 2026 by the Cloud Security Alliance among 418 IT and security professionals, commissioned by Token Security, found that 82% of organizations had discovered at least one AI agent running on their network that they didn’t know existed, and 65% had suffered at least one AI-agent-related incident in the past twelve months (data exposure in 61% of cases, operational disruption in 43%, financial loss in 35%). Only 21% of organizations surveyed have a formal process for decommissioning an agent that’s become unnecessary or unmanageable.
The most telling checkpoint concerns what happens when an agent exceeds the scope it was authorized for. Only 11% of organizations block it automatically at that point, 38% require human validation before letting it continue, and 24% simply log the incident without intervening. In other words, in most cases, an agent that strays outside its lane keeps running until a human happens to notice.
The same survey breaks down the autonomy models actually in place: 53% of organizations let their agents operate alone on low-risk tasks, reserving human review for more sensitive actions, 24% keep a human in the loop on most tasks, and 13% run fully autonomous agents with no systematic human checkpoint. A marketing agent sending emails or adjusting ad bids is rarely classified “high risk” on its own: it’s exactly the kind of task most readily left on autonomous, which makes the scope question all the more concrete.
These figures concern IT security in the broad sense, but they transfer directly to marketing. A marketing automation agent sending emails on your behalf, managing your ad bids, or querying your CRM to qualify prospects, accesses customer data and acts publicly in your name, with the same security stakes as any other unsupervised access. As long as Article 14 stays suspended, the only oversight on that agent is the one you’ve put in place yourself.
This absence of legal guardrails isn’t limited to overseeing an agent in action: the EU directive meant to set out who pays for damage caused by AI (the AI Liability Directive) was withdrawn by the Commission in 2025, for lack of agreement among member states. Before December 2027 at the earliest, a leader deploying AI agents in their marketing therefore has neither a legal obligation to supervise them nor a liability framework if something goes wrong.
Three governance questions, in the absence of a legal framework
Building this governance doesn’t require waiting until 2027. Three questions are enough to frame a first working session with your team or your technical provider: which agents have access to which customer data, who reviews or approves an action before it goes out (an email, a bid, an automated reply), and who can actually stop the agent if something goes wrong, in the absence of any answer imposed from outside before 2027.
If you want to work through this governance framework on your own automation tools, we can talk it through.
Photo credit: Pixabay/RonaldCandonga, Pixabay/Pexels.
