EU’s Landmark Artificial Intelligence Law Takes Effect with New Transparency Rules, But Key Safeguards Delayed

The European Union has moved closer to establishing the world’s first comprehensive legal framework for artificial intelligence, with a new phase of the Artificial Intelligence Act coming into force this week. The latest measures introduce transparency obligations for AI systems that interact with users or generate synthetic content, while some of the law’s most significant safeguards for high-risk applications have been pushed back.

 

The EU’s AI Act follows the path of the General Data Protection Regulation (GDPR), which reshaped global privacy practices after becoming a reference point for organisations handling personal data. While GDPR regulates how companies collect, process and store personal information, the AI Act focuses on how artificial intelligence systems are developed, deployed and monitored.

 

The central question now is whether the AI Act will have the same international influence as GDPR by becoming a global benchmark for responsible AI governance.

 

Transparency Obligations

The latest provisions bring Article 50 of the AI Act into operation, creating new transparency requirements for AI systems that directly interact with individuals.

 

Under the rules, chatbots and similar AI tools must inform users when they are communicating with artificial intelligence, unless it is already clear from the circumstances. The requirement aims to ensure that people are not misled into believing they are interacting with another human.

 

AI providers that create or modify images, audio, video or text using artificial intelligence must also ensure that synthetic content can be identified through machine-readable marking where required under the legislation.

 

The rules also apply to certain biometric applications. Systems designed to recognise emotions or categorise individuals based on biometric information must notify people when such processing is taking place. Some law enforcement activities are exempt from specific transparency obligations.

 

However, the provisions do not amount to a blanket ban on AI technologies. Instead, they introduce disclosure requirements designed to improve accountability and user awareness.

 

Companies that breach these obligations could face administrative fines of up to €15 million or 3 per cent of their global annual turnover, whichever is higher.

 

For businesses, the immediate effect is expected to be compliance-related rather than a major disruption to AI adoption. Organisations are not required to stop using AI tools or seek prior approval before deploying them. Instead, they must understand where AI is already integrated into their operations and ensure that those systems comply with transparency requirements.

 

This includes AI applications embedded in customer services, workplace tools, software platforms and third-party products purchased from external vendors.

 

High-risk AI Rules Postponed Until 2027

 

While transparency obligations have now taken effect, the EU has delayed some of the most demanding requirements under the AI Act.

 

The stricter rules covering “high-risk” AI systems were originally scheduled to apply alongside the transparency provisions. These rules apply to AI technologies used in sensitive areas such as employment, education, healthcare, essential services, biometrics, migration, asylum and border management.

 

However, EU lawmakers agreed in May to postpone these obligations until December 2, 2027 under the Digital Omnibus package.

 

Until then, organisations using high-risk AI systems will continue to follow existing regulations, including GDPR and sector-specific laws, but will not yet be required to comply with the AI Act’s full governance framework.

 

The European Commission has described the delay as an implementation measure rather than a weakening of its regulatory approach. Officials have argued that businesses and regulators need additional time to develop technical standards, guidance and support mechanisms before the most complex requirements become mandatory.

 

The postponement has also been linked to broader EU efforts to improve competitiveness and reduce regulatory burdens on businesses.

 

Supporters of the delay argue that rushing implementation without adequate technical standards could create uncertainty and hinder innovation. European Parliament negotiators backed the move, citing concerns that compliance frameworks for high-risk AI systems were not sufficiently prepared.

 

Critics Warn of Weaker Protections

 

Digital rights organisations have criticised the postponement, arguing that delaying the stricter rules could leave vulnerable groups exposed to risks associated with automated decision-making.

 

The concern is particularly strong around AI systems used in migration, asylum and border management. Under the AI Act, certain technologies in these areas are classified as high-risk because they can influence decisions affecting people’s legal status, movement and access to essential services.

 

The delayed rules would have introduced additional safeguards, including stronger requirements for risk assessments, documentation, data governance, traceability and human oversight.

 

Critics argue that postponing these obligations means individuals affected by automated decisions will have to wait longer for the AI Act’s strongest protections.

 

Campaigners say existing safeguards under GDPR and national laws do not fully address concerns about algorithmic bias, lack of transparency and potential discrimination.

 

They argue that some AI systems used in migration and border control carry risks that cannot be solved only through additional compliance requirements and call for stricter restrictions on their use.

 

Global Impact of the EU’s AI Framework

 

The influence of the AI Act is expected to extend beyond Europe, following the precedent set by GDPR.

 

Multinational companies often prefer to apply a single global compliance standard rather than maintain separate systems for different markets. As a result, transparency requirements introduced by the EU could become common practice worldwide.

 

This reflects what has become known as the “Brussels effect”, where European regulation shapes business practices internationally because companies operating globally adapt their systems to meet EU standards.

 

However, the impact of the AI Act may be more limited when it comes to some of the highest-risk applications.

 

Critics point out that AI technologies used in migration and border surveillance outside EU territory may not fall within the law’s direct scope, even if they are connected to European migration policies or funding programmes.

 

This creates a potential gap between the EU’s ambition to promote responsible AI and the practical reach of its strongest protections.

 

A Phased Approach to AI Regulation

 

The AI Act is being introduced gradually, reflecting the complexity of regulating rapidly evolving technology.

 

Rules banning certain prohibited AI practices and introducing AI literacy obligations began applying in February 2025. Requirements for general-purpose AI models followed in August 2025. Transparency rules have now entered into force, while high-risk AI obligations are expected to become applicable from December 2027.

 

The phased rollout highlights the challenge governments face in balancing innovation with public protection.

 

Supporters argue that careful implementation will create a workable regulatory framework that encourages responsible AI development. Critics, however, warn that repeated delays could weaken enforcement and postpone protections for people most affected by automated decision-making.

 

As the AI Act moves forward, its success will depend not only on the strength of its legal provisions but also on how effectively regulators enforce compliance and ensure that artificial intelligence develops in a way that protects rights while supporting innovation.