Telling people they are dealing with AI

Why this is the part that will actually affect you

Most coverage of the EU AI Act focuses on the heavy “high-risk” regime — recruitment algorithms, credit scoring, insurance pricing. That regime is real, but it is a December 2027 problem and it only affects businesses building those specific things.

The transparency rules are different. They took effect on 2 August 2026, on the same day the enforcement machinery switched on. They apply to something very ordinary: a chatbot on your website, an AI voice agent on your phone line, a feature that drafts text or generates images for your users. If you have European customers, this is the part of the Act you are most likely to be breaching right now without knowing it.

The good news is that compliance is mostly cheap. Three of the four duties are satisfied by saying something clearly. Only the machine-readable marking duty needs engineering work.

Any AI system meant to interact directly with people must be designed so that the person knows they are dealing with AI. The exception is where it is obvious anyway — nobody needs a disclaimer on a system that plainly announces itself.

For a customer-facing chatbot this is usually one line at the start of the conversation and a persistent label on the widget. Do not bury it in the terms of use. The test is whether a reasonable person would know, not whether the information exists somewhere on your site.

If your system generates synthetic audio, images, video or text, the output must be marked in a machine-readable format and detectable as artificially generated or manipulated. This is not a visible watermark for humans — it is metadata or an equivalent signal that other software can read.

This is an engineering task, not a legal one, and it needs to reach your product backlog. Systems already on the market before 2 August 2026 have until 2 December 2026 to comply — that is the deadline most businesses with existing generative features are actually working to. There is a real carve-out worth checking against your product: the duty does not apply where the AI performs an assistive function for standard editing, or does not substantially alter the input or its meaning. A spelling-and-grammar helper is not caught; a feature that drafts the paragraph for you is.

If you use an AI system to generate or manipulate image, audio or video content that is a deepfake, you must disclose that the content has been artificially generated or manipulated.

The disclosure has to be made at first exposure — not in a caption three scrolls down or in a credits page. If your marketing team uses AI-generated presenters, synthetic voice-overs or manipulated footage in campaigns that reach Europe, this is your duty as the user of the tool.

Three further disclosures sit with the business using the system. Tell people when an emotion-recognition or biometric-categorisation system is operating on them. And label AI-generated text published to inform the public on matters of public interest — unless a human has reviewed it and someone holds editorial responsibility for it.

The editorial-responsibility carve-out is the practical route for most businesses publishing AI-assisted content: have a named human review it and own it. Note that emotion recognition in the workplace is banned outright in most cases, so if that duty is live for you, check the prohibition first.

The duty is yours, not your AI vendor’s

This is the point businesses most often get wrong, and it is worth being blunt about.

You build a customer-support chatbot on top of a model from OpenAI, Anthropic, Google or a hyperscaler platform. It feels natural to assume that the model vendor — the huge, sophisticated, obviously-regulated company — carries the compliance burden. They do carry obligations, but for the model. For the chatbot you built and put in front of your customers under your own brand, you are the provider. The disclosure duty is yours and you cannot outsource it upstream.

The hyperscalers say so themselves, quite openly. Microsoft casts itself as the upstream provider of AI tools, services and components, and its enterprise customers as the downstream regulated actors it has to support. Google Cloud signed the general-purpose AI code of practice as a model provider and tells customers they are the providers or deployers of whatever they build. AWS states that customers remain responsible for assessing how their use of AWS services falls under the Act. The model layer is theirs. The system layer is yours.

What good looks like

Five situations a South African business is likely to be in, and what to actually do about each.

The December 2026 catch-up deadline

One date is easy to miss and matters to anyone who shipped an AI feature before August 2026.

Providers of generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking obligation. If your product has been generating text, images or audio for European users since before August, that December date — not the August one — is your real engineering deadline. It is worth putting on the roadmap now, because output-marking touches the generation pipeline rather than the user interface, and that is rarely a one-sprint change.

Frequently asked