Enterprise Marketing Disclosure Compliance

Customer Operations

Enterprise Marketing Disclosure Compliance

Limited Risk (Transparency)UnverifiedDiscuss / dispute

✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source

End-to-end campaign asset creation with automated scanning against the substantiated product-claim inventory, insertion of required disclosures and AI-content labelling before publication.

Classification rationale: Generative output aimed at the public triggers AI Act Art. 50 transparency and machine-readable marking; the substantive exposure is FTC §5 and the UCPD — unsubstantiated AI or product claims are deceptive practices regardless of who drafted them, and SEC anti-AI-washing enforcement extends this to investor-facing material.

Evaluate risk & value →Open in graph

Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.

pricingPer generated compliant campaign asset

oversightBrand and compliance manager sign-off as the final publishing gate

Compliance brief

This use case is limited-risk under the EU AI Act (Limited Risk (Transparency)); transparency obligations apply.

What is owed

Art. 50. Disclose AI interaction to natural persons; machine-readable marking of synthetic content; deepfake labelling; emotion-recognition disclosure.
Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
GDPR Art. 22. Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
GDPR Art. 17. Right to erasure collides with AI Act Art.
GDPR Art. 25. Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.

Dates that bind

2026-08-02 — General applicability + Art. 50. Transparency obligations for chatbots, deepfakes and synthetic content; EU-level enforcement begins.
2026-12-02 — Additional prohibitions. Additional bans (deepfake CSAM et al.) and transition period for synthetic content under Art. 50(2).

Maximum exposure

FTC Act §5 & Endorsement / AI-Claims Guidance: FTC enforcement, civil penalties, redress and injunctive conduct remedies.
Unfair Commercial Practices Directive: National fines up to 4% of annual turnover in the member state concerned (Omnibus Directive).
EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
GDPR: Up to €20m or 4% of worldwide annual turnover

First five actions

Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
Commission and confirm the Art. 50, Art. 4, GDPR Art. 22 obligations named above as active workstreams with an accountable owner.
Stand up the named oversight design — Mode 1 — with a documented human-review procedure.
Produce the technical documentation and evidence artefacts already mapped to this use case (Synthetic-Content Labelling / Watermarking, HITL Escalation Queue & Review UI, Bitemporal Memory (GDPR×Art.12)) before they are requested.
Put 2026-08-02 — General applicability + Art. 50 — into the compliance calendar with an owner and lead time.

Terms used above: · · ·

Applicable Regulations (6)

FTC Act §5 & Endorsement / AI-Claims Guidance

in-force · verified 2026-08-06

Unfair or deceptive acts and practices, including unsubstantiated AI capability claims ('AI washing'), undisclosed synthetic endorsements and missing material disclosures in automated campaigns. Marketing generated end-to-end by agents must be scanned against a substantiated claim inventory before publication.

Sanctions: FTC enforcement, civil penalties, redress and injunctive conduct remedies.

Unfair Commercial Practices Directive (Directive 2005/29/EC + Omnibus/EECC price-transparency rules)

unverified · no verification date source EUR-Lex

Governs commercial practices toward consumers: dynamic and personalised pricing, ranking transparency and misleading omissions in digital-shelf and marketplace operations.

Sanctions: National fines up to 4% of annual turnover in the member state concerned (Omnibus Directive).

EU AI Act (Regulation (EU) 2024/1689)

unverified · no verification date source EUR-Lex

Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Annex III → 2 Dec 2027, Annex I → 2 Aug 2028).

Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)

GDPR (Regulation (EU) 2016/679)

unverified · no verification date source EUR-Lex

Applies unchanged next to the AI Act for all personal data in training, fine-tuning, RAG and inference. Key friction points: Art. 22 automated decisions, Art. 17 erasure vs. AI Act logging, Art. 35 DPIA.

Sanctions: Up to €20m or 4% of worldwide annual turnover

Art. 50 — Transparency Duties

unverified · no verification date source artificialintelligenceact.eu

Disclose AI interaction to natural persons; machine-readable marking of synthetic content; deepfake labelling; emotion-recognition disclosure.

Art. 4 — AI Literacy

unverified · no verification date source artificialintelligenceact.eu

Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.

Legal Obligations (6)

Art. 50 — Transparency Duties

Disclose AI interaction to natural persons; machine-readable marking of synthetic content; deepfake labelling; emotion-recognition disclosure.

unverified · no verification date read the article artificialintelligenceact.eu

Art. 4 — AI Literacy

Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.

unverified · no verification date read the article artificialintelligenceact.eu

GDPR Art. 22 — Automated Decisions

Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.

unverified · no verification date read the article EUR-Lex

GDPR Art. 17 — Erasure

Right to erasure collides with AI Act Art. 12 immutable logging — resolved architecturally via bitemporal data modelling + physical partition scrub.

unverified · no verification date read the article EUR-Lex

GDPR Art. 25 — Data Protection by Design

Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.

unverified · no verification date read the article EUR-Lex

GDPR Art. 35 — DPIA

Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art. 27) for public-facing high-risk systems.

unverified · no verification date read the article EUR-Lex

Control Objectives (1)

obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact

Art. 50

AI Interaction & Content Disclosure

Natural persons are informed they interact with an AI system, and generated/manipulated content carries both human-visible labels and machine-readable provenance (C2PA-class) that survives publication pipelines. Testable: disclosure presence across all interaction surfaces; watermark validity sampling post-publication; deepfake-path red-team (does stripped metadata get caught at the gate?).

satisfied by: Synthetic-Content Labelling / Watermarking Output Rails / Groundedness Check

evidenced by: Guardrail Telemetry & Sanitization Records

Art. 4

control layer: community mandate — propose objectives

GDPR Art. 22

control layer: community mandate — propose objectives

GDPR Art. 17

control layer: community mandate — propose objectives

GDPR Art. 25

control layer: community mandate — propose objectives

GDPR Art. 35

control layer: community mandate — propose objectives

Take this into your GRC tooling

A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.

Standards & Evidence

C2PA Content Credentials

Open technical standard for cryptographically signed content provenance: manifests binding origin, toolchain and edit history to media assets. The de-facto machine-readable implementation path for Art. 50 synthetic-content marking (machine-readable format + detectability duty) — visible labels satisfy the human side, C2PA manifests the machine side. Verification at publication gates produces the disclosure evidence stream.

published · verified 2026-08-06

evidence for: Art. 50 · Art. 50 — Transparency Duties

ISO/IEC 42005 (AI Impact Assessment)

Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.

unverified · no verification date publisher ISO

evidence for: GDPR Art. 35

IEEE CertifAIEd™

Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.

unverified · no verification date

evidence for: EU AI Act

Architecture Blueprint

Guarded RAG Pattern

For limited-risk conversational/generative systems: deterministic RAG with input rails (DLP/NER, injection blocking), retrieval rails (relevance, freshness, ACL) and output rails (groundedness check with deterministic fallback), plus synthetic-content labelling.

Mode 1 — Assistant (HITL)

Agent proposes, human disposes: every consequential action reviewed before execution. Default for first deployments, irreversible or legally sensitive actions.

Required Technical Components (12)

Synthetic-Content Labelling / Watermarking

Synthetic-content labelling & watermarking: visible disclosure plus machine-readable provenance (C2PA Content Credentials) embedded in generated images, audio and video; metadata identifying artificial origin survives common transformations. Discharges Art. 50(2)/(4) for deepfakes and synthetic media; verification telemetry (watermark presence/validity checks at publication gates) is the corresponding evidence stream.

from: Art. 50 · Guarded RAG Pattern

HITL Escalation Queue & Review UI

HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.

from: GDPR Art. 22

Bitemporal Memory (GDPR×Art.12)

valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.

from: GDPR Art. 17

PII Scrubbing / DLP-NER Layer

Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.

from: GDPR Art. 25 · Guarded RAG Pattern

Per-Tenant Retrieval Segmentation

Retrieval is scoped by tenant and by caller entitlement at query time, preventing cross-client and cross-role leakage through shared indexes.

from: GDPR Art. 25

Segmented Vector Store (RBAC + CMEK)

Vector indexes, embeddings and document stores are logically and physically partitioned per client, with role-based access and customer-managed encryption keys.

from: GDPR Art. 25

Live Risk Register / Posture Management

Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.

from: GDPR Art. 35

Data Lineage & Versioning

Provenance tracking of datasets, features and embeddings; write-time attribution (source, actor, timestamp, confidence).

from: Unfair Commercial Practices Directive

Input Rails / Prompt Shields

Pre-model validation of user input: injection detection, topic blocking, encoding checks.

from: Guarded RAG Pattern

Retrieval Rails (ACL-aware RAG)

Relevance, freshness and per-user permission checks on every retrieved chunk; curated, versioned index.

from: Guarded RAG Pattern

Output Rails / Groundedness Check

Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.

from: Guarded RAG Pattern

Dual-Gate Validation Pipeline

Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.

from: Guarded RAG Pattern

Delivery Stack & Pipeline Stage (7)

Service-as-a-Software delivery: the engines, patterns and artifacts this workflow needs on top of the generic obligations. See the full pipeline

Synthetic-Content Labelling / Watermarking

Output Rails / Groundedness Check

Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.

pipeline stage 4 — Output audit & human-in-the-loop gateway

Deterministic Policy Engine (OPA / Cedar)

Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.

pipeline stage 2 — Deterministic prompt & guardrail orchestration

HITL Escalation Queue & Review UI

pipeline stage 4 — Output audit & human-in-the-loop gateway

Cognitive Orchestrator

The reasoning and control plane of an agentic workflow: goal decomposition, tool selection across enterprise APIs, confidence scoring per step, and a human-machine interface exposing progress, limitations and a global halt. It is the architectural home of AI Act Art. 14 oversight — oversight that lives only in a downstream UI cannot stop an executing agent.

Propose-Action Objects

Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.

Guardrail Sidecar / Interception

Rule-based (NeMo/Colang), model-based (alignment checkers) and structural validators deployed as sidecar or gateway plugin (<50 ms), decoupling safety scaling from inference scaling.

Required artifacts

EU Declaration of Conformity Guardrail Telemetry & Sanitization Records Event Logs & Decision Traces

Build or Buy — Vendor Layer (5)

The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.

Regulated Foundation-Model Platforms

Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Exemplary (community-maintained): Anthropic Claude (ZDR enterprise tier), OpenAI GPT enterprise, Google Gemini Enterprise, Cohere (private-cloud RAG), Mistral (EU/self-hosted), Meta Llama (open-weight sovereignty). GPAI-chapter duties and vendor due diligence attach at this layer.