Three things you need to know about the new EU AI Act rules

Aspects of the EU AI Act have come into force, bringing a new set of obligations designed to improve transparency for AI use.

The new rules aim to counter misinformation and manipulation, fraud, impersonation, and consumer deception by making it easier for people to recognize when they are interacting with AI or are exposed to AI-generated content.

"AI is a transformative technology that can bring extraordinary benefits to our people and businesses. But we are also seeing that harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale. Europe anticipated this development," said Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy.

"With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI — one that gives innovators legal certainty while protecting the public interest. As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust, and whose benefits are shared widely across our society."

The Commission has published guidelines to help those providing or deploying AI. So what will organizations now have to do?

Here are three things you need to know about the new rules.

Marking and labeling of AI-generated content

Certain AI-generated or manipulated content must be clearly and visibly labelled and include machine-readable marks, according to the European Commission. Icons used in labelling have been made available for use.

This covers deepfake images, audio, and video content that resembles real people, objects, places, entities, or events.

Emotion recognition and biometric categorization tools, as well as text covering matters of public interest that haven't been through human review or editorial control are also covered under the new rules.

Transparency when interacting with an AI system

Transparent AI deployment and use is a key focus with the EU AI Act.

Under the new rules, providers must ensure that users are aware they’re interacting with the technology, such as a chabot, avatar, or AI agent.

“These obligations are intended to foster trust and integrity in the information ecosystem,” the Commission said in a statement.

Tim Pfaelzer, Veeam’s SVP and general manager for EMEA, said these rules should not be viewed as simply “ticking a compliance checkbox” and enterprises should implement robust audit trails and governance policies.

"While on the surface, the transparency requirements for AI governance and operational accountability might seem an easier ask than the delayed high-risk requirements, it’s far trickier to solve in practice - something that enterprises will realise when they attempt to align their AI deployments with these requirements," Pfaelzer commented.

How the rules will be enforced

AI use will be policed by national market surveillance authorities, the European AI Office - for systems under its supervision - and the European Data Protection Supervisor, when EU institutions are providers or deployers.

They can issue fines of up to €15 million, or 3% of global annual turnover for non-compliant companies, and up to €750,000 for EU institutions, bodies, and agencies.

In terms of penalties, the Commission said ‘proportionality’ will be a key focus, and any potential fines will take into account small and medium-sized enterprises or small mid-cap companies.

High-risk systems

Last month, the implementation of special rules for high-risk systems was delayed, with stand-alone high-risk AI systems now to come in scope from 2 December 2027, and high-risk AI systems embedded in products from 2 August 2028.

High-risk AI systems are defined as those presenting significant threats to health, safety, or fundamental rights.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.