Disclosure Just Became Law, and You're Probably Both
The EU's transparency rules are now in force: tell people when they're talking to AI, and mark AI-generated content. The sleeper detail is the split between who makes the AI and who deploys it.
- #governance
- #ai
- #devex
As of this week, a big market’s AI transparency rules are no longer a debate; they are in force. If someone is interacting with an AI system, you have to tell them, unless it is obvious. If content is AI-generated or altered, it has to carry a machine-readable mark, and deepfake-style media has to be labeled. Miss it and the fine ceiling is the kind of number that gets a boardroom’s attention: a percentage of global turnover or eight figures, whichever hurts more.
The headline is “label your AI.” The part that will actually reorganize your engineering is quieter: the rules split obligations between providers, who build and sell the AI system, and deployers, who use it in a product. Providers have to make the system announce itself and watermark its outputs. Deployers have to label the AI content they put in front of users. And a lot of companies are both at once, which means you own duties on both sides of a line you may never have drawn.
That split is a design problem, not a legal one. Where does the “you are talking to AI” disclosure live, and who owns it when your product wraps someone else’s model? Does the watermark survive when your pipeline re-encodes an image or regenerates a summary? If you consume a model that is supposed to mark its outputs, are you checking that the marks are there, or assuming? These questions have owners now, and the owner is engineering, not the legal review that happens the week before launch.
There is a grace period for things already shipped, which is the only reason this is a planning item and not a fire. Use it. Map your product to the provider and deployer roles, decide where disclosure and marking get injected, and build it into the pipeline. Transparency as a feature you designed is cheap. Transparency as a retrofit under a regulator’s deadline is not.