EU Tells Chatbots To Come Clean: 'Hi, I'm a Machine' Is Now Mandatory 🤖

The European Union began enforcing the transparency rules of its AI Act on Sunday, requiring chatbots, voice assistants and other AI systems to disclose to users from the first interaction that they are speaking with a machine. The European Commission's AI Office and national regulators also gained formal enforcement powers, ending a period in which the bloc's flagship AI law operated largely on voluntary compliance. Penalties for the most serious violations reach €35 million or 7% of global annual turnover, with transparency breaches carrying fines of up to €15 million or 3% of worldwide turnover. From 2 August, EU rules require disclosure of the professional use of generative AI when content can be mistaken for real people, places or events, when text on matters of public interest had no human review, or when a user is interacting with a chatbot.

The obligations, set out in Article 50 of the AI Act, extend beyond conversation. Deployers must clearly label AI-generated or manipulated images, audio and video as artificial, and text published to inform the public must be flagged unless a human editor has reviewed it and taken responsibility. Companies running emotion recognition or biometric categorization systems must inform every individual exposed to them, while clearly creative or satirical works face lighter disclosure duties. Personal, non-professional use of AI-generated content on individual social media accounts is excluded from the rules, which target professional or commercial use by businesses, freelancers and monetised influencers.

Generative AI systems already on the market have until 2 December 2026 to add machine-readable watermarks to synthetic content, giving providers an additional transition window. The AI Office can now demand documentation, evaluate models directly, order corrective measures or pull models from the EU market. General-purpose AI model providers have carried documentation and copyright obligations since August 2025, but until Sunday Brussels had no power to compel compliance. The rules apply to any provider or deployer whose system reaches users in the EU, regardless of where the company is headquartered.