A new AI Visibility audit from 5W AI Communications found that when buyers ask the AI engines who must disclose AI-generated advertising under the EU AI Act, the answer comes back from law firms and compliance-software vendors — and almost never from the communications industry.
The finding is stark. The audit ran five buyer prompts against the retrieval corpus that ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews draw from. Law firms including Sidley Austin, Lewis Silkin, Gleiss Lutz, and Dentons dominated every query. AI-governance vendors including OneTrust, TrustArc, and Compliance.ai filled the rest. Not one global PR or communications firm surfaced on the compliance or scope prompts — not WPP, Omnicom, Publicis, Interpublic, or any of the 200-person independents.
The timeline makes this worse. The EU AI Act's core disclosure duties took effect August 2, 2026 — six days ago. The buyer researching compliance risk is being handed directly to lawyers and software. The firm that manages the brand is nowhere in the conversation.
In the answer-engine era, the domains cited today become the defaults the engines repeat tomorrow. This isn't just a visibility problem. It's a market-share problem. Whoever owns the answer owns the client.
What the Audit Found
Five high-intent buyer prompts tested across ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews:
- "Does the EU AI Act require disclosing AI-generated ads?"
- "What is Article 50 of the EU AI Act?"
- "Does the EU AI Act apply to U.S. agencies?"
- "What counts as a deep fake under the EU AI Act?"
- "What are the penalties for violating the EU AI Act?"
Across all five queries, the retrieval pattern was consistent:
Tier 1 (Top 3 results across engines): Sidley Austin, Lewis Silkin, Gleiss Lutz, Dentons. All law firms. All EU-based or global with EU practices. Sidley's piece on Article 50 disclosure appears in 4 of 5 engines in the first three results.
Tier 2 (Results 4-10): Compliance software vendors (OneTrust, TrustArc, Compliance.ai), trade associations (EACA, IAB Europe), regulatory bodies (European Commission AI Office), and platform terms of service (Meta, Google, TikTok).
Tier 3+ (Results 11+): Tech blogs, academic papers, news aggregators. Zero PR or communications firms.
Why Law Firms Own the Answer
1. Law firms moved first — and published at scale. When the EU AI Act text finalized in late 2023, legal teams began publishing guidance immediately. Sidley and Lewis Silkin had detailed compliance guides live within weeks. PR firms were still in the "what is this, do we need to care?" phase.
2. The buyer journey doesn't start with PR. A general counsel or CMO asking "are we compliant?" types that question into Google or ChatGPT. They're looking for lawyers first, comms second — if at all. The search behavior itself biases retrieval toward legal sources.
3. Communications firms positioned this as a legal checkbox, not a communications win. The firms that won the answer — Sidley, Lewis Silkin, Gleiss Lutz — treated it as both: compliance risk + communications opportunity + market share defense. They built retrieval authority accordingly.
The Two Dates That Matter Under Article 50
Article 50 — August 2, 2026 (NOW). Core disclosure duties are live. Deployers — including brands and agencies creating or distributing AI-generated content — must disclose in a clear and distinguishable manner at the time of first interaction or exposure. Chatbots must identify themselves. Synthetic media must be labeled. Deepfakes and AI depictions of real people must carry clear warning.
Article 50(2) — December 2, 2026. Machine-readable watermarking requirement. Systems already on the market before August 2 get until December 2 to comply. New systems must mark from today. C2PA standard supported by Adobe, Microsoft, Google, OpenAI, and Meta is the industry track.
Extraterritorial reach — No EU office required. This applies to U.S. companies, U.S. agencies, and U.S. brands whose AI-generated content is used in the EU. The Act doesn't require a European office. It requires that your AI output reaches European persons.
Penalty exposure — Up to €35 million or 7% global turnover. €15 million or 3% for disclosure violations. €35 million or 7% for prohibited practices.
What PR Agencies Must Do
If your agency creates AI-generated content: You are the deployer. You must disclose. Documentation matters — dated records showing which tools produced which assets, who approved them, what disclosure frameworks you built.
If your agency distributes or amplifies AI-generated content: You share deployer obligations. The media agency, the creative shop, and the brand each carry contingent liability depending on where the chain breaks.
If your agency uses AI tools in operations: Your vendor's compliance posture is now your liability surface. Non-compliant vendors = non-compliant outputs = your breach.
If your agency does GEO work in EU markets: This is the gray zone. If you're creating or modifying content destined for EU audiences, even for retrieval optimization, disclosure obligations likely apply. Document the decision either way.
The carve-out: AI-generated text escapes disclosure if it received meaningful human review and editorial control before publishing. Document the review. Name the reviewer. Show the edits.
How PR Firms Win the Answer Back
1. Stop treating compliance as a legal checkbox. Compliance is a communications problem. The brands that navigate Article 50 cleanly are the ones with documented disclosure frameworks, trained teams, audited vendors, and pre-positioned crisis narratives.
2. Publish specific guidance before enforcement examples set the standard. The first fines will land within months. The firms that have published actionable guidance before those cases break will be cited as authorities.
3. Audit client vendors. Midjourney, Adobe Firefly, Runway, Sora, ElevenLabs, Synthesia — none have published comprehensive Article 50 compliance statements. Build the audit framework. Become the advisor clients call before the lawyer.
4. Map GEO obligations explicitly. Publish a framework that says: "Generative Engine Optimization triggers Article 50 obligations in these specific scenarios." Own that answer. Right now, nobody is saying it clearly.
