As of August 2026, EU regulators can enforce AI Act transparency mandates — here's what your organization must now label, disclose, and prove.
For two years the EU AI Act was a compliance deadline on a distant horizon. That horizon has arrived. The European Commission's AI Office and member state authorities are now empowered to enforce the Act, and the first obligations to bite are not the complex high-risk requirements — those have been deferred to December 2027 — but the transparency rules. These are live, enforceable, and far broader in scope than most enterprises assume.
If your organization operates a chatbot, generates marketing images with AI, uses synthetic voice, or deploys any system that interacts with people or produces content, you are almost certainly in scope. And unlike the high-risk regime, transparency obligations do not care whether your use case is "risky." They care whether a human might be fooled.
What the transparency rules actually require
The AI Act's transparency provisions boil down to a simple principle: people have a right to know when they are dealing with a machine or its output. In practice that translates into four concrete duties.
- Disclose AI interactions. If a user is interacting with an AI system — a chatbot, a virtual agent, an automated phone line — that must be made clear unless it is obvious from context.
- Label synthetic content. Audio, images, video, and text generated or manipulated by AI must be marked as artificial, in a machine-readable format where feasible.
- Flag deepfakes. Content that convincingly depicts real people or events but is AI-generated must be explicitly disclosed.
- Notify affected individuals. People subject to emotion-recognition or biometric categorization systems must be informed they are being processed.
The Commission has reinforced these statutory duties with its first official Code of Practice on transparency for AI-generated content, signed by OpenAI, Google, and Meta. The Code is voluntary, but it functions as a practical roadmap: adhere to it and you have a defensible presumption of compliance with the watermarking and marking mandates coming into force.
This is not just an EU problem
The temptation is to treat this as a Brussels-only headache. That would be a mistake. The same week EU enforcement powers activated, California's AI transparency law took effect, requiring generative AI developers to embed provenance metadata into synthetic audio, video, and images. Ireland has stood up a dedicated national AI Office as its supervisory authority. Italy's Garante has already fined a consumer AI operator €158,000 over data and age-control failures, and penalized four companies €7.72 million for opaque automated decision-making.
The direction of travel is unmistakable: transparency and provenance are becoming table stakes across jurisdictions, and regulators are demonstrating both the appetite and the machinery to enforce.
Why most organizations can't answer the basic question
Here is the uncomfortable part. To comply, you first have to answer a question most enterprises cannot: Where, across our operations, are we generating AI content or exposing users to AI interactions?
That question is deceptively hard because AI has diffused into workflows without central visibility. The customer-service team spun up a chatbot. Marketing uses a generative image tool. A product group embedded a copilot. A vendor's platform quietly added AI features under the hood. Each is a potential transparency obligation, and none of them appear on a single list anywhere in the organization.
You cannot label what you have not inventoried. You cannot prove disclosure across a fleet of systems you cannot see. This is the same shadow AI problem that undermines every other governance objective — but now it carries direct regulatory liability, complete with named authorities empowered to investigate.
A practical path to compliance
Transparency compliance is achievable, but it demands a structured, evidence-based approach rather than a scramble.
- Build a complete inventory of user-facing and content-generating AI. Every chatbot, generation tool, synthetic-media pipeline, and embedded vendor feature needs to be catalogued with its purpose, owner, and jurisdictions of use.
- Classify each system against transparency triggers. Does it interact with humans? Produce synthetic content? Involve biometrics or deepfake risk? Map each to the specific obligation it creates.
- Verify that labeling and disclosure are actually implemented. Check for machine-readable content marking, user-facing "you are talking to an AI" notices, and provenance metadata — and record the evidence.
- Assign accountability. Every in-scope system needs a named owner responsible for maintaining compliance as the tool evolves.
- Track the moving deadlines. With high-risk obligations deferred to 2027, new prohibitions added, and NIST drafting standardized documentation templates, your compliance roadmap is not static.
Turn a deadline into a control plane
The organizations that will handle this well are not the ones with the biggest legal teams — they are the ones with visibility. If you can see every AI system in your estate, understand what each one does, and measure your governance maturity against transparency and disclosure requirements, then a regulatory deadline becomes a prioritized to-do list rather than an existential scramble.
That is precisely the gap evum is built to close: inventory your AI systems, classify their obligations, measure maturity across five dimensions, and convert the gaps into prioritized initiatives. Transparency enforcement is the first wave. The 2027 high-risk deadline is next. The enterprises building their control plane now will meet both from a position of readiness — and everyone else will be reacting.
The rules are no longer coming. They are here.