Here is a rare thing in AI news: a rule written for the person on the receiving end, not the person selling the model. As of 2 August 2026, a chunk of the EU AI Act with real teeth came into force, and it is aimed squarely at deception.
The provision is Article 50, the transparency obligations. In plain terms, if an AI system talks directly to a person in the EU, a chatbot, a voice assistant, an agent, the provider has to disclose that you are dealing with a machine, unless that is already blindingly obvious. Generative output has to be marked too: text, images, audio and video produced by AI must carry a machine-readable signal saying so. And deepfakes, synthetic media made to look like real people or events, have to be labelled as such.
Who has to sweat, and who is off the hook
The duties split between providers (the people who build and place a system on the market) and deployers (the people who use it). The compliance burden lands heaviest on the big labs and the platforms, which is the correct end to load it. You, the person being spoken to, gain a right to know.
Same day, the European AI Office formally gained the power to investigate and enforce obligations on providers of general-purpose AI models. General-purpose model, or GPAI, means the big foundation models that get bolted into hundreds of downstream products. The Commission adopted its guidelines on all this back on 20 July 2026, so nobody can claim they were ambushed.
Strip away the acronyms and this is a consumer-protection law wearing a tech-policy suit: it exists so ordinary people are harder to fool.
The catches worth knowing
Two things to keep honest. First, there is a grace period. The marking-and-detection duty for generative systems already on the market gets a transitional runway until 2 December 2026, so you will not see every AI image sprouting a watermark overnight. Second, this is EU law. If you are outside the bloc, none of it obliges anyone talking to you, though in practice global products often apply the strictest rule everywhere rather than maintain two versions.
Does it have bite? Noncompliance can trigger fines of up to 15 million euro or 3% of worldwide annual turnover, whichever is higher. For a trillion-euro platform, 3% of turnover is not a parking ticket, it is a number that gets read out in board meetings.
Whether enforcement actually bares its teeth is the open question, and regulators have a habit of moving slower than the products they police. But the principle is a good one for the little guy: the cost of proving something is AI now sits with the people who made it, not with the punter trying to work out whether the friendly voice on the phone is a human or a script.
Did you know: the deepfake and AI-content labelling duties come with a softer deadline, 2 December 2026, for material already circulating, but the disclosure rules for chatbots and agents applied immediately from 2 August.
Related on Top Tool Stack: The pass^k reliability test · The ‘Avoiding AI’ librarians