EU AI Act enters into force

The EU Artificial Intelligence Act (AI Act) officially entered into force on August 1, 2024, marking a landmark moment in global AI governance. The regulation, which was formally adopted by the European Parliament in March 2024 and published in the Official Journal of the EU in July 2024, establishes a comprehensive risk-based framework for AI systems operating within or affecting the EU market. It categorizes AI applications into unacceptable risk (banned outright), high risk (subject to strict compliance requirements), limited risk (transparency obligations), and minimal risk (largely unregulated). Prohibited practices include real-time biometric surveillance in public spaces, social scoring systems, and certain forms of subliminal manipulation — all of which have direct implications for behavioral advertising and audience targeting technologies. For the AdTech industry specifically, the AI Act introduces significant obligations around transparency and disclosure. AI-generated content — including synthetic media, deepfakes, and algorithmically generated ad creatives — must be clearly labeled or disclosed to consumers. Ad targeting systems that use AI to profile individuals or predict behavior may fall under high-risk or limited-risk categories depending on their application, triggering requirements around documentation, human oversight, and explainability. The Act also intersects with the GDPR, creating a layered compliance environment for companies deploying AI-driven personalization, programmatic bidding, and audience segmentation tools in European markets. The regulation does not apply immediately in full — it follows a phased implementation timeline, with prohibitions on unacceptable-risk practices applying six months after entry into force (February 2025), rules for general-purpose AI models applying twelve months later, and most other provisions becoming applicable by August 2026. Despite this staggered rollout, the Act's entry into force signals a new era of AI accountability in Europe and is already prompting global AdTech players to audit their AI systems, update disclosures, and reconsider data practices to ensure compliance ahead of enforcement deadlines.

The EU AI Act reshapes the AdTech landscape by introducing a new layer of regulatory complexity on top of existing frameworks like GDPR and the Digital Services Act. For programmatic advertising, AI-driven bidding algorithms, audience segmentation models, and real-time personalization engines will face scrutiny under the Act's risk classification system. Companies operating demand-side platforms (DSPs), data management platforms (DMPs), and supply-side platforms (SSPs) must assess whether their AI systems qualify as high-risk and, if so, implement conformity assessments, maintain technical documentation, and ensure human oversight mechanisms. This raises compliance costs and may disadvantage smaller AdTech players who lack the legal and engineering resources to adapt quickly. The mandatory disclosure of AI-generated content is particularly disruptive for creative AdTech, including generative AI tools used to produce ad copy, images, and video at scale. Platforms and advertisers deploying such tools in EU-facing campaigns must build labeling infrastructure, which adds friction to automated creative workflows. This could slow adoption of generative AI in advertising or push innovation toward compliant-by-design solutions. Identity and targeting vendors that rely on AI-based probabilistic modeling or behavioral inference may also need to restructure their methodologies, especially where these overlap with GDPR's restrictions on automated decision-making. Competitively, the Act may accelerate consolidation as larger players — including Google, Meta, Amazon, and major agency holding companies — absorb compliance costs more easily and potentially use regulatory adherence as a market differentiator. It also creates opportunity for privacy-first and contextual advertising vendors to position their solutions as inherently compliant alternatives to behavioral AI targeting. Global AdTech companies will face pressure to either build EU-specific compliance stacks or adopt the EU standard globally, mirroring the 'Brussels Effect' seen with GDPR. The Act is likely to spur demand for AI auditing, explainability tooling, and compliance consulting services within the AdTech ecosystem.