What came into force with the EU’s AI Act this week – and what didn’t

On August 2, the next phase of Europe’s Artificial Intelligence Act came into force as the European Union frames this legislation as the world’s first comprehensive law on AI.

Like the General Data Protection Regulation (GDPR) before it, this new EU legislation is intended not to replace the economic bloc’s existing digital rulebook but to complement it.

While GDPR governs how organisations collect and use personal data, the AI Act regulates how AI systems are developed and deployed.

GDPR has gone on to shape privacy practices well beyond Europe, becoming the benchmark against which many multinational organisations design their compliance programmes. The question now is whether the AI Act will prove just as influential for AI governance.

Article 50 of the AI Act now begins to apply, adding a transparency layer to the EU’s broader AI rulebook. Chatbots and other AI systems that interact directly with people must disclose that users are dealing with AI unless the context makes that obvious.

Providers of AI systems that generate or manipulate images, audio, video, or text must ensure that synthetic content is identifiable through machine-readable marking where required by the Act.

Systems used to recognise emotions or categorise people using biometric data must inform individuals that such processing is taking place. Certain law enforcement activities are exempt from some of these transparency obligations. The key point is that these provisions require disclosure, not a general ban on the technology, and breaches can attract administrative fines of up to 15 million euros ($17.3m) or 3 percent of global annual turnover, whichever is higher.

For companies, the immediate impact is mostly operational rather than transformational.