EU AI Transparency Rules Are Here — Yes, This Affects Us

We rolled out a few internal AI tools at work last quarter, and suddenly the EU AI Act isn't abstract policy anymore. The transparency obligations kicked in from the start of this year, and I've been the one figuring out what the heck we actually have to do. Short version: if you're a company doing business in the EU, you can't just quietly run AI in the background anymore. You have to be upfront about it.

The core requirement is pretty simple on paper — if you use AI to interact with people or generate content, you have to tell them. That means chatbots need to disclose they're not human, and AI-generated or manipulated media — deepfakes, synthetic voices, the works — has to be labeled as AI or clearly flagged. If the content could realistically mislead someone and they'd have a reason to care, you label it. Public figures and serious topics get extra caution, because the rule specifically says you have to make the artificial nature clear unless it's harmless parody or artistic work.

Where it gets tricky for an actual workplace: it's not just customer-facing stuff. Employee-facing AI counts too. We use an internal AI assistant for drafting and summarization, and we had to update our employee handbook so staff knows when they're interacting with the AI versus a real person. That barely takes effort, but it's a mandatory disclosure. The deeper headache is high-risk AI systems — the ones used for hiring, credit scoring, or similar consequential decisions. Those carry much heavier obligations: risk assessment, human oversight, the whole compliance apparatus. If you're small or just experimenting, that's the line you want to stay on the lighter side of, at least for now.

The penalties aren't a joke either — fines can reach €35 million or 7% of global turnover, whichever is higher. That's the kind of number that gets CFOs paying attention real fast.

What's actually changed for us day-to-day:

• We added a short disclosure line on the AI assistant's start screen. One sentence, done.
• Our HR team audited whether any of our tools qualify as high-risk. We dodged it, but it took a spreadsheet and a bit of reading.
• Deepfake labeling feels like a non-issue internally, but we do a little content for marketing, so we're just in the habit of tagging anything AI-generated in our asset library.

Honestly, the EU AI Act isn't a monster to start with. The transparency part is more paperwork than pain. But I suspect the high-risk rules are where companies will actually stumble, because they're not just "tell the user" — they're "prove you are doing it right." Anyone else here mid-compliance?