EU AI Labels Get Carve-Outs

"New EU rules require AI-generated content to be labelled." That line appeared across European news sites last weekend. It is true only up to a point. The transparency provisions in the EU AI Act came into force on 2 August (EU AI Act), but they do not put a warning label on every spell-checked email, translated paragraph or edited photo. The obligation depends on who is using the system and what kind of content is being put before the public.

For Malta, this is not some distant Brussels compliance exercise. It affects the same small public sphere where political messaging, party media, independent newsrooms, public agencies, iGaming operators and financial services firms all compete for attention. A customer-service chatbot, an AI-assisted article about an election, and a synthetic video of a political rival do not fall under the same rule. The Act treats them differently because the risk, the audience and the person responsible are different.

Builders label the pipes, users label the product

The Act separates two roles: the provider, meaning the company or body that builds the AI system or places it on the EU market, and the deployer, meaning the organisation or professional using it (EU AI Act). The same entity can be both. A bank, gaming company or public authority that builds its own chatbot for clients is both provider and deployer, and must meet both sets of obligations.

A useful comparison is food safety. The manufacturer puts the nutritional information on the packet; the restaurant warns customers about allergens on the menu. Both duties exist, and one does not cancel the other (Stibbe).

Providers carry duties at the design stage. A chatbot or voice assistant must tell users at the start that they are dealing with AI (EU AI Act). Systems that generate synthetic images, audio or video face a different requirement: they must embed a hidden marker in the file, closer to a barcode than a public warning, so regulators and detection tools can identify AI-generated material (Commission guidance).

Deployers are responsible for the disclosures the public actually sees. A political campaign posting a deepfake video must tell viewers that it is synthetic. Separately, a newsroom or agency publishing AI-generated text on elections, public health or government spending must disclose that fact (Stibbe). The two duties run side by side. Fulfilling one does not satisfy the other.

If someone in Sliema is using ChatGPT to plan dinner or fix an awkward sentence, the AI Act is not interested. The rules matter for newsrooms, campaigns, companies and public agencies that publish AI-generated content to audiences.

Your grammar checker is fine

Ordinary AI tools get a clear exemption. A grammar checker, spell-checker or translation tool does not trigger labelling duties if it does not substantially change the meaning of what was written (Commission FAQ). Personal, non-professional use of AI is outside the rules altogether (EU AI Act).

The newsroom exemption matters in Malta, where the line between journalism, party communication and state messaging is already under constant pressure. AI-generated text on public affairs can avoid a visible label if a human editor has genuinely reviewed it and a named person or organisation takes editorial responsibility (Commission FAQ, Canal CEO). Italian and Spanish legal commentary both stress that this responsibility has to be documented and real, not a quick approval after the fact (Corriere della Sera).

Deepfakes used in artistic or satirical work still need disclosure, but the Act allows that disclosure to be made in a way that does not ruin the viewing experience. That distinction will matter in a country where political satire travels quickly from a każin joke to a Facebook clip.

Live now, with one grace period

Since 2 August, chatbots must identify themselves, deepfakes require disclosure, and AI text on public-interest subjects needs a label unless a real editor takes responsibility. There is one grace period. It runs until 2 December 2026 and applies only to the hidden-marker duty for generative AI systems already on the market before that date (Cooley, FAZ). New systems must comply immediately.

Enforcement sits with national authorities. Germany's Bundesnetzagentur already accepts complaints through a free online form (Bundesnetzagentur). Ireland has created a national AI Office as a coordination hub (RTÉ). Spain's AESIA is up and running (AESIA). Fines for transparency breaches can reach up to €15 million or 3% of global annual turnover, below the €35 million or 7% ceiling reserved for the Act's most serious banned practices (Commission summary, Handelsblatt).

The points to watch now are practical. Will regulators act on early complaints? Will hidden file markers survive compression, screenshots and re-uploads? And in Malta's crowded political feed, will disclosure teach audiences anything, or become another line of text people scroll past?