Europe Starts Checking IDs at the AI Border

The European Union began enforcing its AI Act on 2 August, requiring chatbots to disclose they’re AI and deepfakes to carry detectable machine-readable marks, per the European Commission.

(Source: European Commission)

Think of it less as a light switch than a customs checkpoint: some lanes open now, others stay queued for years. Providers of general-purpose AI models must now document training data and publish copyright summaries, with the largest, riskiest models carrying added obligations tied to cyber and bio-risk.

Enforcement itself splits three ways:

• The AI Office handles GPAI-linked systems
• National regulators cover the rest
• The European Data Protection Supervisor polices EU institutions’ own AI use

All while more than 180 organizations have already signed the Commission’s voluntary Code of Practice as their preferred route through it (Commission).

At the narrowest lane, this is a labeling problem: a business must now know whether it’s a “provider” or “deployer” for each AI tool it touches, since Article 50’s four disclosure duties (bot identification, deepfake labeling, machine-readable content marks, and emotion-recognition notices) attach differently to each role, and the “obvious AI” exemption is read narrowly enough that most companies should simply disclose (Travers Smith).

Zoom out one level and it’s a compliance-architecture problem: penalties reach €15 million or 3% of global turnover, and the AI Omnibus has already pushed the harder high-risk-system rules to December 2027 and August 2028. Meaning today’s obligations are the opening move in a multi-year rollout, not the whole game.

Zoom out further and it stops being a company problem at all: it’s the EU asserting, ahead of most jurisdictions, that machine-generated reality needs a detectable seam — a bet on trust infrastructure whose payoff, if it works, is continental rather than corporate.