EU Steps Up Enforcement of AI Regulations: What Companies Need to Know

The European Commission’s AI Office Begins Enforcing Key Provisions of the AI Act

The European Commission’s AI Office, in collaboration with national authorities, has officially initiated the enforcement of crucial aspects of the AI Act, marking a significant milestone in the European Union’s regulation of artificial intelligence.

One of the new requirements is the implementation of transparency measures, which mandate certain AI systems to clearly disclose to users when they are interacting with artificial intelligence rather than a human.

Providers are also obligated to reveal when content has been generated or substantially altered using AI technology, with specific labeling requirements applicable to deepfakes and other AI-generated media.

These measures are intended to enhance trust in AI technologies, mitigate the risk of deception, and establish clear compliance duties for developers and businesses.

Simultaneously, the AI Office has been granted enhanced enforcement powers over general-purpose AI models, extending regulatory oversight as increasingly advanced AI systems are deployed throughout Europe.

In response to the introduction of the Act, Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy, emphasized the importance of establishing a trustworthy framework for AI that benefits both individuals and businesses.

She highlighted the need for proper design and usage of AI to prevent potential harms, especially with the emergence of highly advanced models that pose new risks. The AI Act aims to provide legal certainty for innovators while safeguarding the public interest.

As enforcement commences, it represents a significant step towards fostering understanding and trust in AI technologies, ensuring widespread benefits across society.

Introduction of New Transparency Obligations under the AI Act

The latest provisions of the AI Act introduce mandatory transparency requirements for various AI applications utilized by businesses and consumers.

Interactive AI systems such as chatbots and virtual assistants must explicitly disclose to users that they are engaging with artificial intelligence.

These rules aim to enable informed decision-making when interacting with automated systems, preventing assumptions of human interaction.

The regulations also target AI-generated media, necessitating clear labeling of images, videos, and audio produced or manipulated using AI, including deepfakes.

Furthermore, AI-generated or altered content must incorporate machine-readable identifiers for enhanced detection by platforms, authorities, and digital services.

To aid implementation, the European Commission has released an initial list of over 180 organizations that have endorsed its voluntary Code of Practice on transparency for AI-generated content, facilitating compliance with the new obligations.

Enhanced Oversight of General-Purpose AI Models

A pivotal aspect of the enforcement phase is the AI Office’s authority to supervise providers of general-purpose AI (GPAI) models.

These foundational models support a wide array of AI applications, ranging from chatbots to autonomous AI agents capable of diverse tasks.

Providers of GPAI models are required under the AI Act to maintain technical documentation, disclose specified information to regulators and downstream developers, implement copyright policies, and publish detailed summaries of the data used for model training.

Advanced models posing potential systemic risks must adhere to additional regulatory obligations, including risk identification and mitigation for societal harm.

These obligations encompass addressing risks such as cyber attacks, harmful manipulation, threats to fundamental rights, loss of human control, and potential hazards associated with chemical, biological, radiological, or nuclear incidents.

Shared Enforcement Responsibilities among EU Authorities

Enforcement of the AI Act is distributed among multiple regulatory bodies, with the European Commission’s AI Office overseeing AI systems from the same provider as the underlying general-purpose AI model, in addition to systems integrated into major online platforms and search engines covered by the Digital Services Act.

National competent authorities will supervise other AI systems within their jurisdictions, while the European Data Protection Supervisor will oversee AI systems utilized by EU institutions, agencies, and bodies.

The Commission emphasizes the necessity for Member States to establish well-resourced national authorities capable of consistently enforcing the legislation for effective implementation.

Supporting regulators is a newly established Scientific Panel comprising 60 independent AI experts, offering scientific advice on technical and emerging AI issues.

Furthermore, the AI Office has appointed Professor Alessandro Abate from the University of Oxford as Lead Scientific Adviser, responsible for scientific assessment of general-purpose AI models and contributing to innovation, testing, and model evaluation.

Introduction of New Reporting Tools and Future AI Act Milestones

To enhance compliance, the AI Office has implemented various reporting mechanisms for businesses and individuals.

A newly introduced Complaint Tool allows individuals and organizations to report suspected AI Act breaches by providers under the AI Office’s supervision.

Dedicated whistleblower channels have been established for employees and individuals identifying potential violations, while downstream developers using general-purpose AI models can report non-compliance suspicions by model providers.

All information submitted through these channels will be treated with confidentiality, according to the Commission.

Looking ahead, the AI Omnibus package has revised the implementation timetable for certain aspects of the legislation.

High-risk AI system regulations have been postponed to December 2, 2027, while requirements for high-risk AI integrated into regulated products will be effective from August 2, 2028.

The package also introduces new prohibitions concerning AI systems generating non-consensual sexually explicit content and child sexual abuse material, scheduled to take effect on December 2, 2026, expanding the regulatory scope of the AI Act as the EU continues to develop its artificial intelligence framework.