EU's AI Act starts August 2: companies must now disclose every AI system they deploy

Europeans are about to encounter AI disclosures everywhere they look. On August 2, the bloc's new Artificial Intelligence Act takes effect, requiring organisations across the EU to inform users whenever they interact with an AI system or encounter content generated or manipulated by the technology. The overhaul aims to curb deception and help people make informed decisions while strengthening trustworthy AI adoption across the continent.

What has to be disclosed#

The rule captures a staggering breadth of applications. Companies must flag deepfake-laden advertisements and social media posts. Customer service chatbots and complaint hotlines powered by AI need to announce themselves upfront. Call centres deploying machine learning to detect caller emotions must inform callers at the outset. Even behind-the-scenes uses—from AI-assisted scheduling and email handling to contract negotiations—require disclosure when the technology is involved commercially.

Violators face penalties of up to €15 million (around $17 million) or 3 percent of global annual revenue, whichever is steeper.

How widespread is this?#

According to industry experts, once companies honour these obligations, the scale of AI deployment will become startlingly clear. Firms like Spotify, known for algorithmic music recommendations, and Adobe, with its AI-powered editing tools, sit squarely in the crosshairs. "When you start looking, it's everywhere," one lawyer observed, suggesting few digital services will escape the labelling requirement.

The European Commission's newly formed AI Office will oversee compliance from model builders—not only well-known names like OpenAI and Google DeepMind, but a much wider ecosystem of technology providers.

The labelling fatigue problem#

Critics worry that ubiquitous notifications could backfire, rendering disclosures meaningless. Excessive warnings risk creating "banner blindness," much like the cookie-consent pop-ups spawned by the 2018 GDPR privacy law. If every minor application—spell-checked emails, filtered photos—triggers an AI label, users may simply tune out warnings about genuinely risky systems.

Implementation challenges ahead#

The shift parallels GDPR's complex rollout, which upended web user experience through cookie consent fatigue while leaving ambiguities that required years of regulatory guidance to clarify. Legal experts anticipate similar growing pains here. The EU has granted model providers a grace period until December to implement machine-readable formats for synthetic media detection, acknowledging the technical hurdles. Other compliance deadlines have already slipped as the AI Office develops essential guidance.