Your legal adviser, your board or a customer’s procurement team has asked whether you have an AI policy. For most B2B SaaS marketing teams the answer is no. The second answer is that most templates you will find are written for companies with a compliance function you do not have.
This page sets out what the law actually asks of a small marketing team publishing AI-assisted content, what it does not, and the one-page policy that covers both. It reports research and regulator material. It is not legal advice.
Article 50 of the EU AI Act became applicable on 2 August 2026. From that date its transparency duties are enforceable by national market surveillance authorities across the EU.
Most coverage that summer said the AI Act had been delayed. That is half true. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk deadlines to 2 December 2027 for standalone systems and 2 August 2028 for systems embedded in regulated products.
It did not move the part that touches published content. Providers of generative systems already on the market before 2 August 2026 were given until 2 December 2026 to meet the machine-readable marking obligation. Every duty that falls on an organisation using AI, rather than building it, applied from 2 August 2026 and still does.
So the sentence to hold on to is this. The deadline your board read about moved. The one that covers your content did not.
The AI Act splits its duties between two roles, and which one you hold decides almost everything else.
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in the course of professional activity. A marketing team using ChatGPT, Claude or Gemini to draft, research and edit is a deployer.
That matters because the two duties people worry about most sit with the provider, not you. Designing a chatbot so people know it is an AI is a provider duty, and so is embedding machine-readable marking in generated output.
Neither is your obligation when you are using somebody else’s model.
The deployer duties are narrower: disclosing deepfakes, disclosing certain AI-generated text, and informing people exposed to emotion recognition or biometric categorisation. The last of those is unlikely to touch a marketing team at all.
One caution. The role can shift if you white-label somebody else’s system and offer it under your own name, substantially modify it, or change what it is for.
Putting a vendor’s chat widget on your own website, configured as the vendor intended, does not ordinarily do that. If you are anywhere near that line, it is a question for your lawyer rather than for a blog post.
Here is where most marketing guidance goes wrong. It treats AI disclosure as a default obligation with an exemption you have to earn. The structure is the other way round.
The deployer duty on text applies to AI-generated or manipulated text published with the purpose of informing the public on matters of public interest.
The European Commission sets three criteria, and all three must be met. The text must be published, it must be informative to the public, and it must concern a matter of public interest.
The Commission’s own list of what counts as a matter of public interest covers politics and democratic processes, public administration and services, the administration of justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific or cultural developments that may be a relevant subject of public debate.
Read that list against what a B2B SaaS marketing team actually publishes.
Clearly outside it: product pages, feature announcements, pricing pages, case studies, comparison pages, how-to posts about marketing tactics, nurture sequences, sales emails, social posts and landing page copy. These are commercial communications. They are not published to inform the public on a matter of public interest, and no amount of AI assistance turns them into that.
Genuinely arguable: the last item on the Commission’s list is broad. Original research on an industry’s economics, commentary on regulation, analysis of the labour-market effects of AI, or anything framed as a contribution to public debate sits closer to the line. The more your brand behaves like a publisher, with a newsroom and a reporting cadence, the closer it gets.
Anyone telling you that marketing content is categorically exempt is overstating it. Anyone telling you that every AI-assisted blog post now needs a label is overstating it further, and in the more expensive direction.
Where the duty does apply, there is an exemption. It is disapplied where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for publication.
The Commission is specific about what those words mean, and the specificity is useful.
Human review means deliberate examination of the substance of the content by one or more people with relevant knowledge and professional judgement about the subject matter. Editorial control means control exercised by a responsible editorial entity with authority to approve, alter or reject the substance on substantive grounds, including checking facts and the trustworthiness of sources. Editorial responsibility means a person holds ultimate legal responsibility for publication.
And the negative, which is the part worth pinning to the wall. Superficial, solely formal or procedural checks do not qualify. The Commission’s own examples of what falls short are spell-checking and grammatical correction.
So: someone skimming a draft and fixing the typos is not review. A named person with relevant subject knowledge reading it for substance, checking the facts and the sources, with the authority to reject it and their name attached, is.
Now put the two halves together. Where the duty does not apply, you owe nothing. Where it does apply, the exemption is available and costs you a named reviewer and a note.
Either way, a team that runs substantive human review with a named owner is covered. That is the whole compliance question for most marketing teams, and it resolves into one operating habit rather than a labelling programme.
Every article on this subject quotes the same headline. Breaching Article 50 sits in the second penalty tier: up to EUR 15,000,000 or, for an undertaking, 3% of total worldwide annual turnover, whichever is higher.
Almost none of them mention the next provision. For SMEs, including start-ups, the test is reversed. Each fine is capped at whichever of the two figures is lower.
For a company turning over a few million, that changes the number entirely. The practical ceiling is 3% of turnover, not fifteen million euros. On five million pounds of turnover that is a hundred and fifty thousand, and it is a ceiling rather than a tariff.
There is a second provision worth knowing, because it is the best argument for writing anything down at all. When an authority sets a fine it must weigh a list of factors, and the organisational measures the operator has implemented is one of them.
A short written policy that your team actually follows is an organisational measure. That is the return on the hour it takes to write.
Here is the finding that should reshape what your policy is for. There is no published UK case of an organisation being sanctioned for failing to disclose that marketing content was AI-generated. The UK advertising codes contain no AI-specific rules and apply regardless of how content was made.
What does exist is a run of rulings where AI was the method and the breach was ordinary dishonesty.
In March 2026 the Advertising Standards Authority upheld 22 complaints about a paid social ad for a robot-dog toy. The footage was highly lifelike and the voiceover claimed the toy behaved like a real puppy.
No evidence was provided that it did. The ad was ruled misleading because it exaggerated the product, and it had to come down.
The more instructive one came a month later. A children’s supplement brand ran a website section headed “Meet the Experts”, presenting five named individuals with doctoral titles, portraits and quotes endorsing the product. At the foot of the homepage sat a disclosure saying that some images, names and people shown were AI-generated representations used for illustrative purposes.
The ASA read the disclosure and noted that the wording suggested the individuals might not be genuine health professionals. It upheld the complaints anyway, because the overall impression was still that qualified doctors endorsed the product’s benefits.
The rules engaged included the one on qualifications, which is what stops a disclaimer rescuing a misleading impression.
The standing position from the UK advertising regulator is blunt on this point: disclosure alone is very unlikely to mitigate the harm caused by a fundamentally misleading message.
Read those together and the lesson is uncomfortable for the template genre. A policy built to stop unlabelled AI content solves a problem nobody has been penalised for. A policy built around substantive review solves the one they have.
Eleven sections. Each exists because something specific requires it, which is the test a section has to pass to earn its place.
On that last point, a warning. No record-keeping format is prescribed anywhere in the regulation, and no retention period is set. If a template tells you to keep a review log for a specified number of years, it has invented an obligation.
Most of the length in enterprise templates is inherited structure that a team of a dozen cannot run and will not follow.
Drop the committee, the multi-tier approval board, the AI ethics council, the formal risk register, the separate vendor security review workflow and the annual audit cycle. Also drop the static list of approved tools, or at least stop treating it as the control. Tool choice changes faster than any policy gets revised, and a list that is three months stale teaches people the document is decorative.
Govern by category and data rule instead. Say what kind of tool may be used for what kind of work with what kind of information. Name a few current tools as illustration and mark them as illustration.
There is no UK equivalent of Article 50 and no general UK requirement to disclose AI use in marketing. The advertising codes are technology-neutral and already cover the risks, which is why the cases above were decided on ordinary misleadingness rules.
The UK position on automated decision-making changed in 2026, but it bites on automated decisions about individuals with legal or similarly significant effects. Writing a blog post is not that. Automated lead scoring and qualification that materially changes how someone is treated is closer to it, and is worth a separate conversation.
For US exposure, the pattern repeats. There is no general federal AI disclosure requirement, but there is active enforcement against deceptive claims and against fake reviews and testimonials, including AI-generated ones.
That maps onto two lines you already have in the policy above: substantiate your claims, and never generate social proof.
If you write one thing this week, write down who is accountable and what substantive review means on your team. Those two lines carry more weight than the other nine combined, under the EU rules, under the UK advertising codes and in front of a customer’s procurement questionnaire.
The rest is a morning’s work. It is considerably less than most people fear, and considerably more useful than the sixty-page version.
In most cases, no. The deployer duty on text applies only to text that is published, informative to the public, and about a matter of public interest. Product pages, case studies, nurture emails and how-to posts do not ordinarily meet the third criterion.
Partly. The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk obligations to 2 December 2027 and 2 August 2028. The Article 50 transparency obligations were not moved and have applied since 2 August 2026.
It can. The AI Act reaches providers and deployers outside the EU where the output of the AI system is used in the Union. There is no UK equivalent of Article 50, but the UK advertising codes still apply to AI-generated advertising in full.
Where the duty applies, there is an exemption for content that has undergone human review or editorial control with a person holding editorial responsibility. The review has to be substantive. Spell-checking and grammatical correction do not qualify.
Article 50 breaches sit in a tier of up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. For SMEs and start-ups that test is reversed to whichever is lower, so for a small company the ceiling is the turnover percentage.
No. Retroactive labelling of content generated before 2 August 2026 is encouraged where possible but is not required.
One page. Eleven sections, each tied to a specific obligation or risk, is enough for a team of three to fifteen people. Length is what stops policies being read, and an unread policy is not an organisational measure.
For wider context on how these tools are being used across B2B SaaS teams, see our guide to AI marketing and our explanation of the AI-native marketer.
.svg){kind=icon}