EU AI Labels Get Carve-Outs

"New EU rules require AI-generated content to be labelled." That line appeared across European news sites last weekend. It was true as far as it went, but it missed the working part of the law. The EU AI Act's transparency rules came into force on 2 August (EU AI Act), yet they do not put a warning label on every spell-checked email, translated memo or AI-touched photograph. The duty depends on who is using the system, what they are using it for, and whether the result is being put before the public.

Take three ordinary cases. A company runs a chatbot for customer queries. A newsroom uses an AI tool while preparing an article about an election. A political campaign posts a synthetic video of an opponent. The same regulation covers all three, but not in the same way. The law is aimed at different actors in the chain, and only some of those duties will ever be visible to the reader, voter or customer.

Builders label the pipes, users label the product

The Act draws a practical line between the provider, meaning the person or company that builds the AI system or places it on the EU market, and the deployer, meaning the organisation or professional using it (EU AI Act). Sometimes they are the same. If a bank builds its own customer-service chatbot, it is both provider and deployer, so it carries both sets of obligations.

The easiest comparison is food safety. The manufacturer puts the nutritional information on the packet; the restaurant tells you about allergens on the menu. Both duties matter, and one does not cancel out the other (Stibbe).

Providers have duties built into the design of the system. A chatbot or voice assistant must make clear at the start that the user is dealing with AI (EU AI Act). Systems that generate synthetic images, audio or video face a different requirement: they must embed a hidden marker in the file. That is closer to a barcode than a public warning, designed so regulators and detection tools can identify AI-generated material (Commission guidance).

Deployers are responsible for the disclosures the public actually sees. A campaign publishing a deepfake video must tell viewers it is synthetic. A newsroom or agency publishing AI-generated text about elections, public health or government spending must also disclose that fact (Stibbe). These obligations run side by side. Complying with the hidden technical marker does not remove the need for a visible disclosure where the law requires one.

For ordinary users, the position is much less dramatic. If you are asking ChatGPT for dinner ideas, the AI Act is not suddenly part of your evening. The real change is for newsrooms, campaigns, companies and public bodies that use AI-generated material in content aimed at an audience.

Your grammar checker is fine

Everyday AI tools are mostly left alone. A grammar checker, spell-checker or translation tool does not trigger labelling duties if it does not substantially change the meaning of what you wrote (Commission FAQ). Personal, non-professional AI use is outside the rules altogether (EU AI Act).

The newsroom exception is the one editors will be reading closely. AI-generated text on public affairs does not need a visible label if a human editor has properly reviewed it and a named person or organisation takes editorial responsibility (Commission FAQ, Canal CEO). Italian and Spanish legal commentary both make the same point: that responsibility has to be real and documented, not a quick sign-off after the fact (Corriere della Sera). Deepfakes used in artistic or satirical work still require disclosure, but the notice can be handled in a way that does not ruin the piece itself.

Live now, with one grace period

Since 2 August, chatbots have had to identify themselves, deepfakes have needed disclosure, and AI-generated text on public-interest topics has needed a label unless a real editor takes responsibility. There is one grace period, running until 2 December 2026, and it covers only the hidden-tag requirement for generative AI systems already on the market before that date (Cooley, FAZ). New systems have to comply straight away.

Enforcement sits with national authorities. Germany's Bundesnetzagentur is already taking complaints through a free online form (Bundesnetzagentur). Ireland has established a national AI Office to act as a coordination hub (RTÉ). Spain's AESIA is up and running (AESIA). For transparency breaches, fines can reach up to €15 million or 3% of global annual turnover, below the €35 million or 7% ceiling reserved for the Act's most serious banned practices (Commission summary, Handelsblatt).

The tests now are practical ones: whether regulators move on early complaints, whether hidden file tags survive compression, screenshots and re-uploads, and whether the public treats AI disclosures as useful information or just another line to scroll past.