Artificial Intelligence (AI) is rapidly transforming how organisations operate, from internal efficiencies and customer experiences to marketing personalisation and product innovation. However, this acceleration in adoption is now being met with equally fast-evolving regulatory oversight. With landmark legislation like the European Union’s AI Act and a growing patchwork of state-level regulations in the United States, organisations must now move beyond experimentation and adopt structured, compliant approaches to AI deployment. This is particularly crucial for departments such as marketing, human resources, product development and IT, which are increasingly reliant on AI-powered tools and platforms.

Below is a comprehensive overview of the regulatory landscape, why it matters and what steps organisations, especially marketing and leadership teams, need to take now.

The Global Regulatory Landscape: A Shift Toward Accountability

The EU’s AI Act: A Risk-Based Regulatory Framework

The EU Artificial Intelligence Act, finalised in 2024, is the most comprehensive and binding AI-specific regulation introduced to date. It categorises AI systems based on the level of risk they pose, with distinct compliance obligations for each category:

  • Unacceptable Risk (Prohibited): AI systems deemed harmful or manipulative (e.g., social scoring, real-time biometric surveillance) are banned outright.
  • High-Risk: Systems used in recruitment, credit scoring, law enforcement, education, and critical infrastructure are subject to strict obligations.
  • Limited/Minimal Risk: Includes most AI used in marketing, productivity, and customer service, with transparency obligations.
  • Key Compliance Requirements:
    • Mandatory risk classification of AI systems.
    • Detailed technical documentation and audit trails.
    • Human oversight protocols for high-risk applications.
    • Transparency requirements, including disclosures when individuals interact with AI.

Further information: EU Artificial Intelligence Act – Summary & Text

U.S. Regulations: A Fragmented but Emerging Landscape

The United States currently lacks a federal AI law, but several states have introduced sector-specific regulations:

  • New York City Local Law 144 requires bias audits and public notice for AI-based hiring tools.
  • California’s CPRA (effective 2023) includes provisions impacting data collection, usage, and algorithmic profiling.
  • Colorado and Illinois have proposed bills addressing AI accountability in employment and financial services.

In parallel, federal agencies and research bodies such as the National Institute of Standards and Technology (NIST) have introduced voluntary but widely respected frameworks, including the AI Risk Management Framework (AI RMF). These provide guidance on:

  • Risk assessment and mitigation
  • Transparency and documentation standards
  • Avoidance of harmful or prohibited use cases (e.g., autonomous self-replication, advisory systems for weapons)

Further information: NIST AI Risk Management Framework

The UK’s Evolving Approach to AI Regulation

While the European Union has implemented a sweeping regulatory framework through its AI Act, the United Kingdom has taken a more adaptive and sector-led approach at least for now. The UK’s current AI regulatory environment blends principles-based guidance, targeted oversight, and increasing legislative activity aimed at balancing innovation and risk management.

Principles-Based Framework, Not Horizontal Regulation (Yet)

The UK’s AI Regulation White Paper (August 2023) and the government’s response (February 2024) emphasise a non-statutory, principles-based framework. This model empowers existing sector regulators to interpret and apply five cross-sector AI principles within their domains, rather than enacting a central AI law:

  • Safety, security, and robustness
  • Appropriate transparency and explainability
  • Fairness
  • Accountability and governance
  • Contestability and redress

The government argues this model allows for “critical adaptability”, enabling regulators to respond to the rapid evolution of AI technologies. However, the UK has indicated it may introduce a statutory duty for regulators to consider these principles in future.

Organisational Implications: What Leaders Must Prioritise

1. Conduct a Company-Wide AI Inventory

Organisations should begin by mapping all AI applications currently in use across departments especially those that may impact individuals, such as in:

  • Recruitment and HR analytics
  • Personalised marketing and customer segmentation
  • Predictive analytics and business forecasting
  • Content automation and customer engagement tools

2. Establish AI Governance and Oversight

Leaders should develop or strengthen internal governance structures, including:

  • An AI Ethics Committee or similar cross-functional body
  • Defined ownership of AI risk and compliance (e.g., within legal, compliance, IT)
  • Development of AI usage policies, aligned with current and upcoming regulations

3. Strengthen Data and Model Governance

Ensure traceability and auditability of all AI systems by:

  • Documenting training data sources and model assumptions
  • Implementing testing protocols for accuracy, bias, and fairness
  • Ensuring appropriate human-in-the-loop processes for decision-making systems

Why Marketing Leaders Must Take AI Compliance Seriously

Marketing teams are among the most active adopters of AI, using it to:

  • Generate and personalise content at scale
  • Analyse customer behavior and intent
  • Automate segmentation, targeting, and campaign execution

However, this widespread use also exposes marketing to potential compliance risk.

Key Risks to Address:

  • Algorithmic bias in personalised targeting or automated decisioning
  • Lack of disclosure when customers engage with AI-generated content or chatbots
  • Use of personal data in non-compliant ways under GDPR, CPRA, or similar laws

Action Steps for Marketing Teams:

  • Conduct an AI capability audit across all MarTech platforms
  • Ensure vendor transparency confirm whether tools marketed as “AI-powered” meet actual compliance and transparency requirements
  • Implement disclosure practices for AI-generated or AI-assisted content
  • Coordinate closely with legal, data privacy, and IT teams to assess risk exposure

Helpful Resource: AI Marketing Compliance Guide – IAPP

Balancing Innovation with Accountability

  • Regulation is not meant to stifle innovation, it’s intended to ensure that as AI becomes more embedded in business and society, it is developed and deployed responsibly, transparently, and ethically.
  • Business leaders must recognise that AI is not simply a tool for operational efficiency, it is also a source of legal, reputational, and strategic risk if used irresponsibly or without proper governance.
  • The companies that lead will be those that treat AI not just as a technological asset, but as an area requiring serious executive oversight and cross-functional alignment.

Conclusion: Time to Act on AI Compliance

AI is no longer an emerging trend, it’s embedded in everyday business operations. As legislation evolves across the EU, UK and US, organisations must go beyond experimentation and start building compliant, transparent and ethical AI practices.

This blog was written by Robyn MacMillan, a marketing tutor at Oxford College of Marketing. Want to understand how AI is shaping the future of work? Join OxPE AI Exchange, a free webinar series designed to help professionals across industries make smarter, more responsible decisions with AI.