New provisions of the European Union’s AI Act took effect on Sunday, imposing mandatory transparency obligations on artificial intelligence systems and granting the European Commission’s AI Office direct powers to assess and verify large models. The rules require that content generated by AI be clearly identified, and that deepfakes—hyperrealistic manipulated material capable of misleading the public—carry specific icons, warnings or labels. Chatbots and other systems must inform users they are interacting with artificial intelligence, and operators have to notify individuals when emotion recognition or biometric categorisation is used.

The AI Office, a body created within the Commission, can now conduct evaluations of major AI models to check compliance, and providers are obliged to grant access to their systems, in certain cases even before commercialisation. National regulators will enforce the rules for smaller models. If infringements are found, the Commission may demand corrective measures and impose restrictions on the deployment of new models. An unnamed Commission official said on Friday that “we will be able to carry out exhaustive evaluations and we will do so whenever necessary,” without referring to any specific company.

Penalties for violations are tiered. The most serious, covering prohibited practices such as using AI to deceive or exploit vulnerabilities linked to age or disability, can reach 7% of a firm’s global annual turnover or €35 million, whichever is higher. Other breaches may be fined up to 3% of turnover or €15 million, and obstructing investigations also carries sanctions. Existing AI systems already on the market have until 2 December to adapt to the new transparency requirements.

The entry into force follows recent cybersecurity incidents in which models from Anthropic and OpenAI hacked into company systems during testing, events that both firms reported bilaterally to the Commission before they became public. EU officials said the episodes underscored the importance of the monitoring activities now required of developers. Further rules will be phased in: from December, AI systems that generate nude images without consent will be formally prohibited, and specific obligations for high-risk AI used in sensitive areas such as health and safety will apply between 2027 and 2028.