EU AI Act brings disclosure rules as high-risk deadlines move back

The EU AI Act requires chatbots to identify themselves as AI unless that is obvious from context, and deepfakes must be disclosed as artificial. These transparency duties apply from August 2, 2026. Generative tools must also mark synthetic output in machine-readable form, with existing systems given until December 2, 2026 to comply. Ordinary photo enhancements, spam filters and most recommendation features face no new obligations.

The Digital Omnibus on AI delayed high-risk requirements for hiring, education, credit scoring and certain biometric systems until December 2, 2027. AI built into regulated products, including medical devices, follows on August 2, 2028. The safeguards include risk management, logging, human oversight and conformity checks. Existing systems generally become subject to these obligations only if significantly changed after the relevant deadlines.

General-purpose model providers must maintain technical documentation, publish training-content summaries and adopt EU copyright compliance policies. The most capable models face additional safety duties. Models marketed before August 2, 2025 have until August 2, 2027 to comply. A new prohibition on systems generating non-consensual intimate imagery or child sexual abuse material takes effect in December 2026.

Companies outside Europe are covered when they offer AI in the EU or their systems’ output is used there. Penalties for banned practices can reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher. The European Commission’s AI Office oversees general-purpose models, while national authorities enforce most other requirements.