The European Commission’s AI Office, working alongside national authorities, has officially started enforcing key provisions of the AI Act, marking a significant milestone in the European Union’s regulation of artificial intelligence.
New transparency requirements also come into force, requiring certain AI systems to clearly inform users when they are interacting with AI rather than a human.
Providers must also disclose when content has been generated or significantly modified using artificial intelligence, with new labelling requirements applying to deepfakes and other AI-generated media.
The measures are designed to strengthen trust in AI technologies, reduce the risk of deception, and establish clear compliance obligations for developers and businesses.
At the same time, the AI Office has gained new enforcement powers over general-purpose AI models, expanding regulatory oversight as increasingly capable AI systems become widely deployed across Europe.
Commenting on the introduction of the Act, Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said: “AI is a transformative technology that can bring extraordinary benefits to our people and businesses.
“But we are also seeing that harms can occur if AI is not properly designed and used, and the most advanced models create risks on an entirely new scale. Europe anticipated this development.
“With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI – one that gives innovators legal certainty while protecting the public interest.
“As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust, and whose benefits are shared widely across our society.”
New transparency obligations under the AI Act
The latest provisions of the AI Act introduce mandatory transparency requirements for a range of AI applications used by businesses and consumers.
Interactive AI systems, including chatbots and virtual assistants, must explicitly tell users they are communicating with artificial intelligence.
The rules aim to ensure people can make informed decisions when engaging with automated systems rather than assuming they are interacting with another person.
The regulation also targets AI-generated media. Images, videos and audio created or manipulated using AI, commonly known as deepfakes, must now be clearly labelled.
In addition, AI-generated or altered content must include machine-readable identifiers that allow it to be more easily detected by platforms, authorities and other digital services.
To support implementation, the European Commission has published an initial list of more than 180 organisations that have signed its voluntary Code of Practice on transparency for AI-generated content, helping organisations demonstrate compliance with the new obligations.
Greater oversight of general-purpose AI models
A major element of the enforcement phase is the AI Office’s authority to supervise providers of general-purpose AI (GPAI) models.
These foundation models underpin a growing number of AI applications, from chatbots and search tools to autonomous AI agents capable of performing a wide range of tasks.
Under the AI Act, providers of GPAI models must maintain technical documentation, make specified information available to regulators and downstream developers, implement copyright policies, and publish sufficiently detailed summaries describing the data used to train their models.
The most advanced models, classified as presenting potential systemic risks, face additional regulatory obligations.
Providers must identify and mitigate risks associated with large-scale societal harm, including cyber attacks, harmful manipulation, threats to fundamental rights, loss of human control, and risks linked to chemical, biological, radiological or nuclear incidents.
The expanded requirements reflect growing concern over the capabilities of increasingly powerful AI systems and their potential impact on public safety and security.
Enforcement responsibilities shared across EU authorities
Responsibility for enforcing the AI Act is divided across several regulatory bodies.
The European Commission’s AI Office oversees AI systems supplied by the same provider as the underlying general-purpose AI model, as well as systems integrated into very large online platforms and search engines covered by the Digital Services Act.
National competent authorities will supervise other AI systems operating within their jurisdictions, while the European Data Protection Supervisor is responsible for AI systems used by EU institutions, agencies and bodies.
The Commission has stressed that effective implementation will depend on Member States establishing adequately resourced national authorities capable of enforcing the legislation consistently.
Supporting regulators is a newly established Scientific Panel comprising 60 independent AI experts. The panel recently held its inaugural meeting and will provide scientific advice on technical and emerging AI issues.
The AI Office has also appointed Professor Alessandro Abate from the University of Oxford’s Department of Computer Science as Lead Scientific Adviser.
His role includes supporting scientific assessment of general-purpose AI models, alongside work on innovation, testing and model evaluation.
New reporting tools and future AI Act milestones
To strengthen compliance, the AI Office has introduced several reporting mechanisms for businesses and individuals.
A new Complaint Tool enables people and organisations to report suspected breaches of the AI Act by providers under the AI Office’s supervision.
Separate secure whistleblower channels have also been established for employees and other individuals who identify potential violations, while downstream developers using general-purpose AI models can report suspected non-compliance by model providers.
The Commission says all information submitted through these channels will be handled confidentially.
Looking ahead, the AI Omnibus package has revised the implementation timetable for some parts of the legislation.
Rules covering high-risk AI systems have been postponed until 2 December 2027, while requirements for high-risk AI integrated into regulated products will apply from 2 August 2028.
The package also introduces new prohibitions covering AI systems used to generate non-consensual sexually explicit content and child sexual abuse material.
Those restrictions are scheduled to take effect on 2 December 2026, extending the scope of the AI Act as the EU continues to develop its regulatory framework for artificial intelligence.
