AI labels become EU law

If a customer-service bot told you this week that you were speaking to artificial intelligence, it was not being polite. Since 2 August, it has been following EU law. Article 50 of the EU AI Act now requires AI systems and synthetic content to identify themselves as such (EU AI Act, Commission summary). The rule does not ban AI-generated material. It forces part of the digital fakery layer into view.

For Malta, this is not a Brussels abstraction. The rule reaches the same online spaces where political campaigns, public bodies, banks, iGaming operators and newsrooms speak to the public. On an island where a Facebook post can move faster than a ministerial statement, a small label can matter.

What actually has to happen

The law creates three practical duties. A chatbot must say it is AI at the start of the conversation. A realistic synthetic image, video or audio clip must carry a visible label. AI-generated text on matters of public interest, such as election explainers, public-health notices or policy summaries, must also be disclosed as machine-made, unless a human editor has reviewed it and takes editorial responsibility (Article 50 guidance).

Product blurbs are treated differently. The public-interest test is the dividing line: material that shapes civic choices, access to services or public understanding gets a transparency duty.

The system has two layers. The first is visible to users: a tag on a deepfake video, or a disclosure beside a chatbot window. The second sits inside the file itself, through metadata that records where the content came from and can be read by detection tools even when nothing looks odd to the naked eye (Code of Practice). One label is for the reader. The other is for regulators and platforms trying to trace what happened.

Duties change depending on where you sit in the chain. OpenAI or another chatbot vendor must design the system so users know they are dealing with a machine, and must build origin-tracking metadata into synthetic outputs. The bank, newsroom or political campaign using that system has its own duty: to tell audiences when they are looking at deepfakes or AI-written public-interest material (Stibbe).

A line buried in terms and conditions will not do. The Commission says disclosure must happen clearly, accessibly and at the start of the first interaction (AI Act FAQ). If a Maltese public authority uses a chatbot to answer questions on benefits, permits or health services, the notice has to be where the citizen actually sees it.

Personal use is outside the target zone. Someone posting an AI meme to friends is not the point of the law. The obligations apply to professional and commercial use, not purely personal activity (EU AI Act).

Complaints now have somewhere to go

Brussels wrote the law, but national authorities will enforce it. Germany offers the clearest model so far: the Bundesnetzagentur, the federal network agency, became the default complaint office on 2 August, and citizens can file reports free of charge through an online form (Bundesnetzagentur, German government). Ireland has created a national AI Office to coordinate its approach (Department of Enterprise Ireland). Other member states are building equivalent structures.

That enforcement question matters in Malta because the first fights are likely to be practical rather than philosophical. Who takes a complaint about an unlabelled campaign video? What happens if a public body deploys an AI assistant without a proper notice? How quickly can a regulator distinguish a breach from ordinary online nonsense?

Fines for transparency breaches can reach up to €15 million or 3% of global annual turnover. That is below the €35 million or 7% ceiling sometimes quoted in coverage; the higher tier applies to prohibited AI practices, not labelling failures (EU AI Act, Commission enforcement note).

The label is a starting point, not a solution

People acting in bad faith will ignore the rules. Content generated before the deadline does not suddenly need a retroactive label. A missing label also does not prove that something is real, because the technical standards for origin-tracking metadata are still developing (Two Birds).

The courts will have to settle the remaining boundaries. What counts as "obviously AI"? How prominent must a label be inside an app? When does edited content become synthetic enough to trigger the duty?

This is not the whole AI Act arriving in one go. Generative AI systems already on the market have until 2 December 2026 to add machine-readable markings. Wider high-risk rules, covering areas such as employment, education and credit scoring, take effect in December 2027 for standalone systems and August 2028 for systems built into regulated products (AI Omnibus, RegDossier).

The regime is incomplete and can be gamed. Still, it gives users, regulators and courts a first legal handle on synthetic content. Whether AI labels change behaviour, build trust, or become another bit of screen furniture people scroll past is the test that begins now.