The EU AI Act's transparency obligations moved from "guidance" to "enforced" this week. Most of the act is still phasing in over the next two years, but four rules are live now and carry real penalties.

The four rules that bite first

  1. Disclosure of AI-generated content. Synthetic audio, video, and image content shown to EU users must be machine-readably labeled. No exemption for "obviously AI" content.
  2. Chatbot disclosure. Any conversational interface must make clear the user is talking to a system, not a person, at first interaction — not buried in a terms page.
  3. Emotion recognition restrictions. Deployment in workplaces and schools is now banned outright, not just regulated.
  4. Biometric categorization limits. Inferring protected characteristics (race, political opinion, sexual orientation) from biometric data is prohibited except under narrow law-enforcement carve-outs.

These are the "prohibited practices and transparency" tier — the lowest-friction, highest-fine tier of the act. The riskier high-risk-system obligations don't land until 2027.

Who this actually applies to

If you ship a model, a fine-tuned wrapper, or a chat interface that EU users can reach, you're in scope — geographic hosting location doesn't matter, user location does.

  • A US-based SaaS with EU signups: in scope.
  • An internal tool with no EU employees or customers: out of scope.
  • A open-source model weights release with no hosted service: mostly out of scope, but downstream deployers are on the hook.

The fines

Non-compliance with this tier caps at €35M or 7% of global annual turnover, whichever is higher — the same ceiling as GDPR's worst tier, not a lighter one.

What to do this week

  • Audit every user-facing surface that generates synthetic media or runs a chatbot and confirm disclosure is present at first contact, not just in a footer link.
  • If you run any emotion-recognition or biometric-categorization feature touching EU users, turn it off now rather than arguing about carve-outs later.

The rest of the act phases in gradually. These four rules did not.