AI Now Has to Admit It's AI. It Still Doesn't Have to Get You Right.

2026-08-05

On August 2, new transparency rules under the EU AI Act became enforceable across the bloc. The headline obligation is simple to state: AI systems that talk to people have to say so. A chatbot can no longer pass itself off as human. Synthetic images, audio and video have to be marked in a way machines can detect. A deepfake of a real person has to be labelled as one. National regulators can now act on breaches.

Read the coverage and it sounds like the moment AI got honest. It isn't. It's the moment AI got honest about one specific thing: that it is AI. Nothing in the new rules requires it to be honest about you.

That distinction matters more than it looks like it should. Article 50 is a disclosure regime, not a truth regime. It governs the wrapper, not the contents. A system can be in full compliance — clearly labelled, properly marked, everything disclosed exactly as the law now demands — while stating something false and unsupported about a named person, a company, or its leadership. Labelling the output as AI-generated does nothing to verify what it says. There is no requirement to check a claim against a source, no requirement to correct it once it's wrong, no mechanism at all for the substance. Only the label is mandatory.

That gap is not a drafting oversight. It's the honest reflection of a much harder problem regulators have not solved: nobody has found a workable way to make an AI system responsible for the accuracy of what it generates about a real entity, case by case, in real time. So the rule that shipped is the rule that was possible to write and enforce — flag the medium, leave the message alone. It's a pattern showing up across most AI governance moving through legislatures right now: procedural obligations (log it, mark it, disclose it) are advancing quickly, because they're checkable. Obligations tied to truth are not, because truth is not a box a regulator can tick from outside the system.

For anyone whose reputation, leadership, or organisation shows up in what these systems say, the practical consequence runs the opposite way from what the headlines imply. The compliance question — was this properly labelled — now has a clear answer, and a regulator can go find it. The accuracy question — is this true, and can I show what the system actually said, to whom, and when — still has no answer built into the system at all. That work sits entirely with whoever needs to prove it, and it sits there whether or not the label was present.

There's a small silver lining buried in the requirement. A system that is now legally obliged to disclose that it is AI can no longer plausibly claim its output isn't attributable to it. That should make responsibility easier to establish once a dispute exists. But it does nothing to help anyone find out a dispute exists in the first place, or reconstruct what was actually said before the next model update quietly changes the answer. Labelling requirements create a more honest record of what a system is. They don't create a record of what it said. Regulation just wrote a new line into a ledger that, for most companies and the people who lead them, nobody is currently keeping.