EU AI Act transparency deadline hits August 2: what to do now

Key Takeaways

• AI systems interacting with users must disclose they are AI starting August 2, 2025
• Non-compliance penalties range from €750K to €15M, or up to 3% of global revenue
• Systems placed on market before August 2 get until December 2 to comply

The European Commission's AI transparency rules take effect on August 2, 2025. Any company that deploys AI chatbots, conversational agents, or systems that generate deepfakes, emotion recognition outputs, or biometric categorization must explicitly tell users they are interacting with AI. Fines for non-compliance run from €750,000 to €15 million, or up to 3% of total worldwide annual revenue.

The Commission published detailed guidelines last week to help deployers meet the deadline. The rules apply to any company serving the EU market, regardless of where it is headquartered. If your system produces output used in the EU, you are inside the scope.

Which AI systems must disclose?

The transparency requirements target systems that interact directly with people. This includes AI-enabled chatbots, conversational agents, AI companions, and coding agents. Any system designed to have a back-and-forth with a user falls under the rule.

However, not every AI tool qualifies. Recommender systems, spam filters, authentication systems, search and retrieval tools, transcription services, text and code auto-completion, and predictive maintenance systems are explicitly excluded. The distinction turns on direct human interaction versus background processing.

Specific outputs carry their own requirements. AI-generated text, images, video, and audio must contain machine-readable markers. Deepfakes and public interest-related AI content created without human review need clear labeling. The exception: artistic, creative, satirical, or fictional deepfake content is largely exempt.

The three mandatory labels

The Commission has defined three labels for AI content: "AI," "Fully AI-generated," and "Partially AI-modified." Each serves a distinct purpose.

• "Fully AI-generated" applies when news summaries, music, art, or videos have been created without human oversight beyond prompting
• "Partially AI-modified" covers cases like face-swapping in authentic photographs to create deepfakes
• "AI" serves as a general marker for interactive systems

The Commission has made all three icons available for free download in PNG and SVG formats. No licensing fees, no registration required.

Why this matters for content asymmetry

"Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood," said Sanchit Vir Gogia, chief analyst at Greyhound Research. The transparency requirement "is an attempt to restore friction to that imbalance."

The Commission frames the requirement as essential to reducing "the risk of deception and manipulation" and building public trust in AI. Henna Virkkunen, the Commission's executive VP for tech sovereignty, security and democracy, stated that the guidelines "support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI."

The December 2 grace period is not a strategy

AI systems placed on the market before August 2 get a grace period until December 2, 2025. But Gogia warned against relying on this extension. A four-month allowance "on one obligation, for one population of systems, contingent on one procedural step, is not a strategy," he emphasized. Enterprises should plan to comply by August 2 and "treat any relief that arrives as margin."

The Commission has also introduced a voluntary code of practice. Signing provides "legal certainty" and a "simple and practical" way to demonstrate compliance. Signatories gain access to a Signatory Taskforce that shares practices and advances marking and labeling technologies.

Companies that choose not to sign retain flexibility but face more scrutiny. They must demonstrate through surveillance authority assessments that their alternative compliance methods are "adequate." In practice, that means more documentation, more audits, and more uncertainty.

Extraterritorial reach: location does not matter

"Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits," Gogia noted. A US company serving EU customers, an Indian outsourcer processing EU data, or a Singapore startup with EU users all fall under these rules.

This extraterritorial scope mirrors GDPR's approach. The Commission has signaled it will enforce against non-EU companies, though the practical mechanisms for collecting fines across borders remain untested for the AI Act specifically.

What CIOs should do this week

1. Inventory all AI-powered systems that interact with EU users, including third-party tools embedded in your stack
2. Verify which systems fall under the transparency requirements versus the exclusions
3. Contact vendors of embedded AI to confirm their compliance plans and timelines
4. Download the Commission's official icons and integrate them into user interfaces
5. Evaluate whether signing the voluntary code of practice simplifies your compliance burden

The transparency requirements are just the first wave. The AI Act's high-risk provisions, which carry even heavier compliance burdens, phase in through 2027. Treating this deadline as a fire drill for the larger compliance effort ahead is sound strategy.

Frequently Asked Questions

Does the EU AI Act apply to US companies?

Yes. Any company that places AI systems on the EU market, puts them into service there, or produces outputs used in the EU falls under the Act, regardless of where the company is headquartered.

What are the fines for violating EU AI Act transparency rules?

Fines range from €750,000 to €15 million, or up to 3% of total worldwide annual revenue, whichever is higher.

Are all AI systems required to disclose they are AI?

No. Systems that interact directly with users, like chatbots and conversational agents, must disclose. Background systems like spam filters, recommender systems, and predictive maintenance tools are exempt.

What labels does the EU AI Act require for AI content?

The Commission defined three labels: "AI" for general interactive systems, "Fully AI-generated" for content created without human oversight, and "Partially AI-modified" for content like deepfakes that alter authentic material.

When does the EU AI Act transparency deadline take effect?

August 2, 2025 for most systems. Systems already on the market before that date have until December 2, 2025 to comply.

Source: Computerworld