The EU AI Act’s transparency obligations took effect on 2 August 2026. The high-risk rules that everyone was bracing for did not: those moved out to 2 December 2027. Article 50 was left where it was, so the part that is live now is the part about telling people the truth.
In plain terms, you have to tell someone when they are interacting with an AI system, unless that would be obvious to a reasonably well-informed, observant and circumspect person. Synthetic audio, image, video and text has to be marked in a machine-readable format, to the extent that is technically feasible. People exposed to emotion recognition or biometric categorisation have to be told. Deepfakes have to be disclosed, with exceptions for artistic and creative work. And AI-generated text published on matters of public interest has to be disclosed, except where there has been human review or editorial control.
If you are reading this in the UK and assuming none of it lands on you, check where your output goes. The Act reaches providers and deployers outside the Union where the output produced by the AI system is used in the Union. Established in a third country is not a defence. In the Article 50 context the exposure runs up to €15 million or 3% of total worldwide annual turnover, whichever is higher, and that is one tier of a tiered regime rather than a single headline fine.
What most organisations with EU exposure have not done is not writing a policy. Nobody has been made responsible for deciding, per channel, whether the disclosure applies. Marketing thinks legal has it. Legal assumes the tooling does it. Meanwhile the support chat, the recruitment screening emails and the customer-facing summaries all go out without anyone having asked the question once.
The exception everybody will reach for is human review and editorial control. Read those three words slowly.