EU AI Act transparency rules take effect, but the gaps are as telling as the rules

On 2 August 2026, three separate strands of the EU AI Act became simultaneously enforceable: transparency obligations for AI-generated content, full enforcement powers for the Commission's AI Office over general-purpose AI providers, and active supervision of the AI literacy requirements that have technically been in force since February 2025. Taken together, they represent the first real test of whether Europe's flagship AI regulation can do what its architects promised, which is to make the information environment that democracies depend on a little less opaque.

What Article 50 actually requires

The transparency provisions in Article 50 impose obligations on two groups. Providers of AI systems that involve direct interaction with people must ensure those people are informed that they are dealing with an AI system, not a human. Separately, providers of systems that generate or manipulate synthetic content, deepfakes and AI-generated text on matters of public interest must ensure that those outputs carry machine-readable marks. Deployers, meaning the organisations that actually use these systems, carry their own obligations to disclose deepfakes and AI-generated text on public-interest topics.

The regulation carves out exceptions. Law enforcement is exempted. So is minor editorial assistance, artistic works and satire. Content that has passed through human review and carries clear editorial responsibility also falls outside the labelling requirement. The logic is straightforward: if a human editor has taken responsibility for what a piece of text says, the reader's interest in knowing whether a machine drafted the first version diminishes. Whether that logic holds up in practice, when editorial processes themselves become increasingly automated, is less certain.

Anthropic's watermarking experiment

Anthropic, the company behind the Claude large language model, has become the first major GPAI provider to implement watermarking under the EU's Code of Practice on Transparency. Since 2 August, Claude models released after that date embed an invisible watermark in generated text and attach provenance metadata to supported files. The company chose to roll the technology out globally rather than confine it to European users, a decision that avoids the fragmentation that would result from a Europe-only implementation.

The concession Anthropic itself made, however, is revealing. The absence of a watermark does not prove that content was written by a human. A screenshot, a format conversion, or even a simple re-save of a file can strip the provenance data. The watermark targets a single moment in a much longer chain: the point at which text leaves the model. Everything that happens afterwards, from distribution to modification to the platform where a user eventually encounters it, sits outside the watermark's reach.

The enforcement architecture

The AI Office, the Commission unit responsible for GPAI oversight, now has full enforcement powers. It can request and assess documentation from GPAI providers about training content, copyright compliance and risk management. This matters because documentation is the precondition for any enforcement action. Without it, regulators are left guessing about what data a model was trained on, what risks the provider identified and what mitigations it applied.

The AI literacy provisions in Article 4, which have been in force since February 2025, have now entered the supervision and enforcement phase. The requirement is that providers and deployers ensure staff and others operating AI systems on their behalf have sufficient understanding of those systems, taking into account their technical knowledge, experience and the context of use. The provision sounds modest, almost administrative. It is not. A judge who does not understand the limitations of a risk-assessment algorithm, a police officer who treats a facial-recognition match as fact, or a civil servant who accepts an AI-generated briefing without scrutiny, each represents a failure of institutional readiness that transparency rules alone cannot fix.

The actors the AI Act cannot reach

Much of the disinformation directed at European democracies originates in Russia and China. These states are outside the AI Act's jurisdiction and cannot be deterred by the threat of fines. The regulation's influence on them is indirect: it constrains the commercial platforms, generative tools and distribution channels through which state-backed content reaches European audiences. Whether that indirect pressure materially reduces the volume or effectiveness of foreign influence operations is an open question.

A more technical gap concerns open-weight models. The AI Act regulates companies that place AI systems on the EU market. It has almost no practical reach over a malicious actor who downloads a modified open-weight model and runs it on private infrastructure. Such an actor can generate deepfakes, propaganda or forged documents entirely outside any provider's oversight, and never trigger the transparency requirements that apply to commercial services. The architecture of open-source AI, which many in the European research community support, creates a parallel distribution channel that the regulation simply does not cover.

The laundering problem

Even when a provider does embed provenance information, the chain breaks quickly. A bad actor can upload a deepfake to an unmonitored platform such as Telegram, where copying, screenshotting and re-sharing strip hidden tracking data before the content migrates to mainstream social media. By the time a piece of synthetic content reaches a regulated platform, the watermark that Article 50 required is likely gone. The regulation addresses content generation. It does not address content laundering.

There is a second-order risk that is arguably more corrosive. Mandatory labelling is designed to expose fakes. It can also be used to deny reality. A bad actor who wants to discredit genuine footage can claim it lacks a watermark or appears altered, turning a transparency tool into a denial tool. If this tactic becomes common, it will erode the very accountability the regulation is meant to strengthen. Voters who cannot agree on whether a video is authentic cannot evaluate it on its merits, regardless of what the label says.

Why the DSA is necessary but insufficient

The Digital Services Act targets the algorithms that amplify content rather than the systems that generate it. Once ChatGPT crossed 45 million EU users, the Commission classified it as a Very Large Online Search Engine, bringing it under the DSA's strictest obligations. In principle, the DSA can force major platforms to detect and restrict viral synthetic media regardless of whether that media carries a watermark.

In practice, the DSA has its own coverage problem. Telegram has reported staying just below the Very Large Online Platform threshold for more than two years, despite sustained scrutiny from EU regulators. That positioning allows it to avoid the heightened obligations around detecting and mitigating coordinated manipulation that apply to larger platforms. The same platform that serves as the first staging post for laundering deepfakes is also the platform that has most carefully avoided the strictest layer of regulation.

Transparency is a means, not an end

The AI Act's transparency provisions address one part of the problem: making synthetic content identifiable at the point of generation. They do not address why people believe it, how it spreads, or what happens to provenance data as content moves through the information ecosystem. Declining institutional trust and political polarisation are not regulatory gaps that labelling requirements can fill. People who distrust mainstream media or who are already inclined to believe conspiracy theories will not revise their views because a piece of text carries a machine-readable tag.

The provisions that matter most may be the least glamorous. Article 4's AI literacy requirement pushes public bodies, political campaigns and newsrooms towards a baseline competence in recognising AI-generated content. An official who does not know about a disclosure obligation will not enforce it. A journalist who cannot spot synthetic media will not flag it. Institutional readiness is the precondition that makes transparency and accountability functional rather than theoretical.

Technical standards will also need to evolve. Anthropic's watermarking is a first iteration. More robust, interoperable provenance standards across platforms and file formats would make it harder for tracking data to disappear as content moves. The EU AI Act itself contemplates further technical development, but the regulation can only mandate what is technically feasible, and the current state of the art leaves significant gaps.

Organisations

European Commission · AI Office · Anthropic