The AI Act for an SEO agency: roles and workflow

AI ACT · AGENCIES AND CLIENTS

In an SEO agency, risk comes less from the word “AI” than from a missing boundary between who provides the system, who uses it, who approves the material and who answers to the audience. Contract, brief and editorial workflow should tell the same story.

Classify each service, not the agency as a whole

An agency may be a professional user of a tool, operate a configured client workflow or place an AI solution on the market under its own name. Determine the role per system and use case. Calling a service “AI SEO” does not decide whether the agency is a provider or deployer. ^{[EU-REG] [EU-GPAI-G]}

The minimum register separates research, SEO topic grouping, draft generation, images, translation, data analysis, chatbot and automated publishing. For each, record vendor, data, output, affected people, permissions, approver and whether the system merely recommends or can execute actions. ^{[EU-DESK] [EU-LIT]}

The brief must include AI boundaries

Alongside audience, objective and tone, the brief defines allowed sources, prohibited data, claims needing an expert, whether people or brands may be generated, automation level and approval point. The client should understand which parts use AI assistance and where human decision remains. ^{[EU-LIT] [G-AI] [EDPB-28]}

Do not put identifiable analytics, support conversations, lead databases or confidential documents into prompts merely to “personalise” copy. The AI Act does not provide a GDPR lawful basis. Agency and client should clarify purpose, data-protection roles and vendor flow before first use. ^{[EDPB-28] [EU-REG]}

Text and images need different controls

For text, check facts, sources, quotations, search intent, experience and editorial responsibility. For images, check recognisable people, marks, protected elements, realism, metadata and misleading context. One internal “AI” label does not cover both workflows. ^{[EU-A50] [EU-A50-G] [G-AI]}

Article 50 separates technical marking from visible disclosure and treats chatbots, deepfakes and certain public-interest text differently. An agency should not turn every AI assistance into a meaningless badge, nor use superficial review as an excuse. Apply the legal test to content type and retain evidence of substantive review. ^{[EU-A50] [EU-A50-G]}

Client approval does not transfer all responsibility

A client may hold final editorial responsibility, but the agency remains accountable for contractual promises, data it processes and service delivery. The approval record should show what the system generated, what the agency checked, remaining exceptions and what the client approves. ^{[EU-A50] [EDPB-28]}

An “OK” message does not prove the person saw sensitive claims, images or changes from the prior version. Present a change summary, sources and decision points. For automated publishing, default to draft and explicit confirmation. ^{[G-AI] [EU-LIT]}

Google evaluates value, not the tool

Google says generative AI can assist research and structure, while publishing many pages without added value may violate scaled-content-abuse policy. Accuracy, quality and relevance also apply to titles, descriptions, structured data and alt text. “AI-friendly” does not rescue weak material. ^{[G-AI] [G-SPAM]}

Measure corrected claims, rejected sources, stopped drafts, review time, post-publication errors and performance of useful content—not words generated. Good automation reduces repetitive work and leaves people the decisions that change truth, positioning and risk. ^{[G-AI] [G-HELP] [EU-LIT]}

A six-row client–agency matrix

For each AYSA.RO project, a recommended matrix states: the client approves purpose and sensitive sources; the agency selects and inventories tools; the data owner authorises access; the editor reviews substance and metadata; the client or named owner approves publication; both parties follow incident and correction procedures. ^{[EU-REG] [EU-LIT] [G-AI]}

The contract covers auditability, vendor-change notice, retention, correction duties, data-subject request ownership and exit. Do not sell generic “AI Act compliance included”. Commit to an observable process, evidence and escalation where classification exceeds agency competence. ^{[EU-DESK] [EU-REG] [EDPB-28]}

Official sources and verification date

1. Regulation (EU) 2024/1689 — Artificial Intelligence Act
2. European Commission — AI Act Service Desk and Compliance Checker
3. European Commission — AI Literacy Questions & Answers
4. European Commission — transparency obligations under Article 50
5. European Commission — guidelines on transparency obligations
6. European Data Protection Board — Opinion 28/2024 on AI models
7. Google Search Central — using generative AI content
8. Google Search Central — scaled content abuse and spam policies
9. Google Search Central — helpful, reliable, people-first content