← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for marketing and advertising teams

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Copy generation, image generation, audience segmentation and campaign optimisation are not high-risk as such. The Act reaches marketing through other doors:

• Article 50, from 2 August 2026. Providers of generative systems must mark synthetic output in a machine-readable format. Deployers must disclose deepfakes: image, audio or video resembling real people, objects, places or events that would falsely appear authentic. For evidently creative or satirical work, disclosure can be done in a way that does not spoil it. AI-generated text published to inform the public on matters of public interest must be disclosed too, unless it has gone through human editorial review.
• Article 5, since 2 February 2025: techniques that are subliminal, purposefully manipulative or deceptive, or that exploit vulnerabilities due to age, disability or social and economic situation, are prohibited where they materially distort behaviour and cause or are likely to cause significant harm.
• Annex III point 8(b): AI intended to influence the outcome of an election or referendum or voting behaviour is high-risk, except tools whose output people are not directly exposed to, such as tools that organise or optimise campaigns logistically.
• Annex III point 4(a): targeting job advertisements is high-risk. Recruitment campaigns are not ordinary campaigns.

The logging duties that follow

For the high-risk cases (political persuasion, job ad targeting):

• Art. 12 (providers): automatic event recording over the system's lifetime.
• Art. 19 (providers) and Art. 26(6) (deployers): keep logs for at least six months, with human oversight by the deployer (Art. 26(2)).

For Article 50 there is no retention rule, but you will want to prove the label was applied. See Art. 50 transparency.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

The practical dispute is a complaint that an ad used a realistic synthetic person without disclosure. The record should tie the generated asset, by hash, to the disclosure applied before publication.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"llm.request","data":{"model":"image-gen-x","campaign":"AW27-outerwear","params":{"style":"photoreal"}}}
{"seq":2,"type":"tool.result","data":{"name":"render","output":{"asset":"sha256:8f3c…","depicts_person":true}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"block","hits":[{"rule":"photoreal-person-needs-label"}]}}
{"seq":4,"type":"tool.call","data":{"name":"publish","input":{"asset":"sha256:8f3c…","label":"AI-generated image","approved_by":"brand_mgr_2"}}}

The asset hash links the published file to the label decision recorded before it went out.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign the approval run for each campaign that uses synthetic people or voices, and keep the attestation with the campaign archive.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the campaign complied with advertising law. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. Langfuse, vs. RFC 3161 timestamping.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.