A phase change has occurred in European AI regulation, and it is easy to misread as a technicality. The EU AI Act's transparency obligations - on the books for some time - have this month moved from applying to being enforced: the European Commission's AI Office and national authorities have begun policing them, with penalties that reach into the millions of euros or a percentage of worldwide annual turnover, whichever is higher. The duties themselves are plainly stated. Interactive AI systems must tell users they are dealing with AI rather than a human. Deepfakes - AI-generated or AI-altered images, video and audio - must be labelled as such. And AI-generated content must carry machine-readable marks so that software, not just people, can detect its origin. What was best practice in January is a compliance obligation with an enforcement apparatus behind it now.
The scope is broader than the word deepfake suggests, and that is the part businesses most often miss. A company does not need to build AI to be covered; it needs only to deploy it in ways users encounter. The customer-service chatbot on an ordinary e-commerce site is an interactive AI system that must disclose itself. The AI-generated product video, the synthetic voice-over on a promotional clip, the realistic AI image in a marketing campaign - these are candidates for labelling duties. The machine-readable marking requirement lands mostly on the providers of generation tools, but deployers inherit questions too: whether the tools they use apply the marks, and whether their own editing pipeline strips them. As with the EU's privacy regime before it, the rules also reach non-European firms serving European users - which is how EU transparency law becomes, in practice, a default for anyone selling across borders.
It is worth being honest about the two standard objections, because each contains something true. Disclosure fatigue is real: the lesson of cookie banners is that a notice seen everywhere is read nowhere, and an AI label glanced past a hundred times protects no one in the hundred-and-first, deceptive case. And labelling is technically porous: machine-readable marks can be stripped, sophisticated bad actors will not volunteer labels, and detection of unlabelled synthetic content remains unreliable - as covered here before, watermarking is a genuinely hard technical problem, not a solved one. The rules' realistic value lies elsewhere: they set a floor for the honest majority, they give enforcers a clean charge against the dishonest minority - the unlabelled deepfake becomes a violation in itself, provable without litigating intent - and they push the content-generation industry toward marking by default, which raises the cost of deception even if it cannot eliminate it.
The practical posture for a business is straightforward and cheaper taken early. Inventory where customers encounter AI you have deployed - chat interfaces, voice systems, generated media in your marketing - and make the disclosure and labels explicit rather than arguable; a plain label costs nothing and reads, increasingly, as professionalism rather than confession. Ask your tool vendors the newly pointed question of whether their output carries the machine-readable marks the law expects, and keep the answer in writing. And treat the deeper shift seriously: regulators have concluded that knowing whether you are dealing with a human or a machine is a consumer right, not a courtesy. Companies that internalised the equivalent conclusion about data privacy early spent the following decade comfortable; those that treated it as someone else's problem funded the case law. The same fork is now open for AI transparency, and this month is when choosing stopped being free.