EU AI Act Transparency Rules for Deepfakes and Biometric Systems Take Effect August 2

New transparency requirements under the European Union’s AI Act will take effect on August 2, introducing disclosure and content-marking obligations for providers and deployers of certain artificial intelligence systems.

Article 50 requires providers to ensure that people are informed when they are interacting directly with an AI system, unless the artificial nature of the interaction is already obvious from the circumstances. The requirement is intended to prevent users from unknowingly engaging with chatbots, virtual assistants, and other automated systems presented as human.

Providers of systems that generate or manipulate text, images, audio, or video must also ensure that their outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The European Commission says the marking should be effective, interoperable, robust, and reliable, taking account of the technical state of the art and the cost of implementation.

A limited grace period applies to systems placed on the market before August 2. Providers of those systems will have until December 2, 2026, to comply with the machine-readable marking and detection obligation. The grace period does not broadly postpone the other transparency requirements under Article 50.

Separate obligations apply to organizations deploying AI systems. People must be informed when they are exposed to emotion-recognition or biometric-categorization technology, subject to limited exceptions. Deployers must also clearly disclose deepfake content and AI-generated or manipulated text published to inform the public on matters of public interest when it has not undergone human review or editorial control.

The rules do not necessarily require every piece of synthetic content to carry a conspicuous visual watermark. Providers can use embedded metadata and other machine-readable techniques, while deployers remain responsible for clear, human-facing disclosures in contexts such as deepfakes and public-interest communications.

Fines for violations can reach €15 million or, for companies, three percent of total worldwide annual turnover for the preceding financial year. The Commission says proportionality can be taken into account for small and medium-sized enterprises and small mid-cap companies.

The August deadline is separate from the timetable for high-risk AI systems. Following the European Parliament’s earlier vote to delay the requirements, the Council of the European Union gave final approval to legislation setting new application dates of December 2, 2027, for stand-alone high-risk AI systems and August 2, 2028, for high-risk systems embedded in regulated products.

Organizations working with biometric AI are also preparing for the Act’s conformity-assessment framework. Earlier this year, DEKRA became the first accredited certification body for biometric systems under the AI Act.

The transparency provisions give organizations operating in Europe a more immediate compliance challenge than many of the Act’s broader high-risk requirements. Providers and deployers will need to determine where notices are required, how synthetic content will be marked, and whether existing biometric and emotion-analysis deployments adequately inform affected individuals.

Sources: European Commission, European Commission FAQ, Council of the European Union


By the ID Tech Editorial Team