EU AI Act Transparency Rules Are Now In Effect. Was It A Missed Opportunity?

Yesterday, the transparency rules in the European Union’s AI Act entered into effect. The date represented more than a regulatory deadline; it marked a pivotal shift in the governance of synthetic content. We are now witnessing a collision between the ambitious promise of transparency and the complex, often dangerous reality of how content behaves in the wild. This moment forces a difficult question: are we building systems that genuinely protect the public, or are we merely masking systemic risks with superficial labels?

At the center of this transition lie Article 50’s transparency obligations and the newly minted Code of Practice (CoP), which aims to provide developers and deployers with a roadmap for identifying AI-generated media, chatbots, and biometric systems. Yet, the foundation of this effort—the CoP and its accompanying guidelines—reveals a fragility. There is a persistent gap between technical mandates and the reality of how content lives, breathes, and spreads online. To be truly effective, these regulations must move beyond the safety of binary labels and confront the technical and legal realities of the digital lifecycle, ensuring that transparency is as durable as the content it describes.

What went right and what is missing

The first section of the Code sets rules for Providers of Generative AI Systems, and further develops the requirements present in Art. 50 (2) and (5). Overall, this section is responsible for outlining transparency and labeling obligations for providers of generative AI systems, focusing on four core commitments: implementing a multi-layered approach to marking AI outputs (e.g., digitally signed metadata and watermarking), providing free and functional detection tools that adhere to EU privacy laws, ensuring quality standards like robustness and interoperability, and establishing rigorous compliance, monitoring, and testing processes. Lastly, the final text also requires providers to make best efforts to preserve metadata markings and prohibits their removal, while offering proportionate compliance pathways for SMEs and startups to ensure that transparency measures remain effective and reliable across the content lifecycle.

While we welcome the progress made in the Code's provisions on metadata, watermarking, detection, interoperability, and privacy-preserving detection services, some important gaps remain. The main gap is that provenance information (Section 1, Measure 1.3) is designated optional and ‘encouraged’ while a binary AI generated marking (Measures 1.1.1 and 1.1.2) is all that the code requires of signatories which limits transparency across the content lifecycle.

On open-weight models, the code's reliance on voluntary cooperation, rather than structural marking obligations on model releases, leaves a significant gap: compliance with regulation cannot be enforced once weights are released and models are fine-tuned or stripped of provenance signals downstream.

Public reporting requirements and civil society oversight remain limited under the Code, a gap that weakens its overall trust and accountability mechanisms.

Finally, user-facing transparency benefits from stronger media literacy and clearer provenance information, ensuring that transparency measures are meaningful and understandable for the people they are intended to serve. However, the Code makes this optional and encouraged, stopping short of the mandatory obligations these measures would need to be effective.

Section 2 mandates transparency for deployers of AI systems, and it is the part of the Code closest to our own work. We welcome the disclosure obligations it sets, but from what we see through the Deepfakes Rapid Response Force we would add one caution: a label is not the same as protection, and it should not be mistaken for one. For the deepfakes that cause the gravest harm, above all non-consensual intimate imagery, disclosure does little for the person targeted, and the recourse for genuinely illegal content lies elsewhere, in the Digital Services Act and, for image-based sexual abuse, in the Directive on combating violence against women (Directive (EU) 2024/1385). The Code works best read alongside those frameworks, and with safeguards so that recourse does not tip into the over-removal of satire, dissent or human rights documentation.

Where the Code could go further is in the strength of the label itself. The most informative layer, the one that would tell a viewer what was actually changed, is only encouraged rather than required (Section 2, Measure 1.1), and the marking behind the label carries no robust provenance, the same gap we note for providers in Section 1 (Measure 1.3). Because labels are also easily lost as content is edited, re-encoded and re-shared, more durable and provenance-rich marking would make disclosure far more meaningful in practice. The Code does, though, deserve credit for making the accessibility of disclosures binding, so that they work with screen readers, high contrast and audio or haptic cues.

Two things are worth watching as the rules take effect. The law-enforcement exemption, which lifts disclosure where a use is authorized to detect, prevent, investigate or prosecute a criminal offense (reflecting Article 50(4)), is the kind of state-use carve-out that can travel badly when copied into jurisdictions with weaker safeguards, at a moment when even official accounts, including the White House, are posting unlabeled synthetic imagery. And detection, which enforcement ultimately leans on, remains unreliable and uneven across languages and faces, as our TRIED benchmark shows, so it should not be treated as a dependable backstop.

Do the guidelines water down the obligations?

The guidelines clarify some of the concepts in the Code, set out the applicable exemptions and define what falls out of scope, and explain how compliance with the Article 50 obligations may be demonstrated, including by signing the Code. They are a useful addition, but they also open friction points with Article 50 and the Code.

The first is vagueness in the key exemptions. The "obviousness" exception for interactive AI, and the line between exempted "standard editing" and regulated "substantial semantic alteration", both rest on subjective, case-by-case judgements, which creates real uncertainty for developers, deployers and platforms that blend ordinary editing with generative tools.

The second is an internal tension on watermarking. The guidelines acknowledge that universal, provider-agnostic watermarking and detection do not yet exist, especially for text, while the Code requires synthetic outputs to be machine-readable and detectable through "effective, interoperable and reliable" solutions. As we note above, detection is genuinely unreliable, so the candour is welcome, but the gap between what the guidelines admit and what the Code mandates risks eroding confidence in the marking regime just as it takes effect.

The third is the breadth of the exemptions themselves. Some are sensible lower thresholds for the first phase of implementation, but several remain concerning:

1. minor alterations to input data such as cropping, reframing and AI-generated translation of text;
2. real-time generation where labeling is technically unfeasible;
3. text and deepfakes on matters of public interest under other applicable law; and
4. purely personal, non-professional use.

Several of these are grey areas that market-surveillance authorities will struggle to audit at the scale and speed at which AI content now moves. The personal-use exemption is the most consequential: it lifts the labeling duty from exactly the viral, privately created deepfakes that cause so much harm, pushing the burden downstream onto platforms rather than onto those who make and share them.

Finally, enforcement, oversight and accountability remain open questions, and how these exemptions are read in practice will decide whether the guidelines clarify the obligations or quietly narrow them.

Why is this an important moment for AI regulations across the globe?

Apart from the EU, US states like California and New York are also part of a wave of regulatory efforts focusing on content provenance and authenticity, embedding the same principles that guide initiatives such as the Coalition for Content Provenance and Authenticity in regulation, and addressing the lack of transparency in AI-generated or manipulated content. We are experiencing a moment where regulators are choosing to act and cover the transparency gaps that have allowed users to be manipulated and trust in what we see and read online to be eroded.

August 2 was an important date, not just due to the provisions of the AI Act going into force, but also as a turning point in AI regulation––from generic transparency measures to focused efforts around remedy and recourse for AI content, including misleading content and misinformation generated by AI systems. That shift will only deliver if transparency is paired with labeling and provenance robust and durable enough to survive how content actually moves, with recourse that is effective for victims and safeguarded against abuse, and with exemptions that do not quietly hand the loudest producers of synthetic media a pass.

Acting now matters because the harm from misuse reaches beyond the people directly targeted. It eats away at public trust, both in these rules and in their promise to help rebuild confidence in what we see and read online.