The EU AI Act, in operational terms

Unacceptable risk

Prohibited practices: harmful manipulation, social scoring, sensitive biometric categorisation and other banned uses.

High risk

Employment, education, essential services, critical infrastructure, justice, migration and biometrics. Requires risk management, data governance, technical documentation, registration, human oversight and conformity assessment.

Transparency risk

Chatbots, synthetic content and emotion recognition: duty to inform users and label content.

Minimal risk

Everything else. No specific obligations, but voluntary good practice applies.

• Design the system so that individuals are explicitly informed whenever they interact directly with an AI system.
• Add machine-readable marks that allow AI-generated or manipulated content to be detected.
• Make marking solutions effective, interoperable, robust and reliable as far as technically feasible.

• Inform individuals when emotion recognition or biometric categorisation is used.
• Disclose that image, audio or video content is a deepfake.
• Disclose AI-generated text published on matters of public interest where there was no human review or editorial control.

Code of Practice on transparency

The Commission published a first list of more than 180 organisations that signed the Code of Practice on transparency of AI-generated content, which operationalises these obligations.

Not adhering means finding equivalent means

Providers and deployers that do not adhere to the Code must demonstrate marking and labelling through alternative, equivalently adequate means. For the other transparency obligations, each organisation determines adequate measures itself, taking the Guidelines into account.

Who supervises

National market surveillance authorities, the AI Office for systems under its supervision, and the European Data Protection Supervisor where EU institutions are providers or deployers.

• Have you identified whether you are a provider, a deployer, or both?
• Have you defined the intended purpose of each AI system?

• Have you classified the risk level of each of your AI systems?
• Have you documented the reasoning behind that classification?

• Do you clearly inform users when they are interacting with an AI system?
• Do you label synthetic content where the Regulation requires it?

• Is there human review before the system produces legally or materially relevant effects?
• Is that oversight documented, with named roles and intervention powers?

• Do you maintain an inventory of the AI systems in use across the organisation?
• Have you trained your staff in the responsible use of AI (AI literacy)?

• Do you keep technical documentation and event logs up to date and retrievable?
• Do you periodically review your systems, models and third-party suppliers?

What changed on 2 August 2026?

The Commission, through the AI Office, and national authorities began enforcing the Regulation. The Article 50 transparency obligations and the Annex III high-risk regime also started to apply.

Who has to label AI-generated content?

The provider must embed machine-readable marks in synthetic content. The deployer must disclose deepfakes, emotion recognition, biometric categorisation, and text on matters of public interest published without human review.

Do chatbots have to say they are AI?

Yes. Systems that interact directly with people must be designed so the person is explicitly informed they are dealing with AI, unless this is obvious to a reasonably well-informed user.

Does signing the transparency Code of Practice guarantee compliance?

Not on its own, but it is the recognised route to demonstrate marking and labelling. Those who do not adhere must demonstrate it through alternative, equivalently adequate means.

Who enforces these rules?

National market surveillance authorities, the AI Office for systems under its supervision, and the European Data Protection Supervisor where EU institutions are involved. Complaints and whistleblower channels are also available.

What is still pending after 2026?

From 2 August 2027, obligations apply to high-risk systems embedded in products covered by EU sectoral legislation, with their own conformity assessment procedures.