The European Union (EU) has started enforcing key parts of the AI Act, with immediate, visible consequences for chatbots, deepfakes and other consumer\u2011facing Artificial Intelligence (AI) systems.<\/p>\n
From August 2, what you\u2019ll likely notice are more \u201cthis is AI\u201d labels, clearer rules for powerful foundation models, and new ways for users and researchers to complain when systems go off the rails.<\/p>\n
The AI Act moved from theory to practice for three big areas:<\/p>\n
General\u2011purpose AI (GPAI) models: The new AI Office in Brussels, together with national regulators, can now enforce rules on providers of general\u2011purpose AI models (think large language models and other foundation models behind many tools).<\/p>\n
Transparency obligations: Transparency rules kick in for interactive systems and AI\u2011generated content: chatbots must say they are bots, and synthetic audio, images, video and text need to be marked as AI\u2011generated or manipulated.<\/p>\n
Banned AI uses: A set of \u201cunacceptable risk\u201d AI uses is now formally prohibited, with enforcement shared between the AI Office, national authorities and the European Data Protection Supervisor for EU institutions.<\/p>\n
Note that content that was generated and published before August 2, doesn\u2019t need to be retro\u2011labelled, but anything published on or after that date falls under the rules, even if it was generated earlier.<\/p>\n
From a security perspective, the AI Act\u2019s transparency push is less about banning AI and more about taking away its best camouflage: pretending to be human.<\/p>\n
Non\u2011compliance with transparency obligations can attract fines up to 15 million Euros (17.3 million USD) or 3% of worldwide annual turnover, whichever is higher, which should be significant enough to get large providers\u2019 attention.<\/p>\n
To make enforcement more than a paper tiger, the AI Office has launched tools aimed at people who see problems from the inside or as users:<\/p>\n
Complaint tool: Individuals and organizations can report alleged infringements of the AI Act by providers or deployers of AI systems supervised by the AI Office.<\/p>\n
Whistleblower tool: People professionally connected to AI providers or deployers get an anonymous channel to flag potential violations that could endanger fundamental rights, health or public trust.<\/p>\n
Downstream complaints channel: Firms building on top of GPAI models can report suspected breaches by the underlying model providers.<\/p>\n
This creates a formal path for reporting systemic issues: think unsafe model behavior, ignored red\u2011team findings, or deployments that quietly cross legal lines around manipulation or discrimination.<\/p>\n
Bans on \u201cnudifiers\u201d and abusive content<\/p>\n
The AI Office has introduced explicit prohibitions on AI systems that generate non\u2011consensual sexually explicit or intimate content (including \u201cnudifier<\/a>\u201d apps) and child sexual abuse material.<\/p>\n For victims of these abuses, that\u2019s more than a symbolic move. It gives regulators and law enforcement a clear legal basis to go after both providers and deployers of such systems in the EU, rather than trying to squeeze them into older, less specific laws.<\/p>\n These rules will apply from December 2, 2026, with companies given time to bring their systems into compliance or pull them from the EU market.<\/p>\n Regrettably, this will not stop abuse completely. Attackers will still use unlabeled tools and infrastructure outside the EU. But it raises the bar for legitimate services and makes it harder for mainstream platforms to ignore the risks<\/a> of deceptive AI\u2011driven features.<\/p>\n The AI Act won\u2019t make AI safe overnight, but it shifts the default from \u201canything goes\u201d to \u201cyou must play by some basic rules if you operate in the EU.\u201d For users, that\u2019s a step toward AI systems you can at least recognize and question, instead of having invisible technology quietly shape our online experience.<\/p>\n Scammers\u00a0don\u2019t\u00a0need to hack you. They just need you to click once.\u00a0<\/p>\n