EU's AI Act 'Cookie Banner' Moment: New Rules Force Transparency for Chatbots and Deepfakes

European companies are racing to label chatbots, deepfakes and AI-generated marketing material as Brussels prepares to enforce the first consumer-facing obligations under its landmark AI act.

Online retailers, travel groups and advertising agencies are among the businesses overhauling websites and customer service systems before new transparency rules take effect on August 2.

The rules require companies to tell customers when they are interacting with AI systems and to identify AI-generated images, audio and video. The deadline also marks the point when the European Commission can begin imposing fines on companies that fail to comply with the act.

“This will be a cookie banner moment for AI,” said Patrick Van Eecke, a lawyer at Cooley, referring to the cookie notices that became ubiquitous under Europe’s privacy regime. “Until now, the AI act has largely been abstract. Now, everyone will actually start seeing labels telling them certain content was generated by AI.”

The deadline is an early test of whether Brussels can make AI more transparent for consumers without slowing the adoption of a technology that EU leaders say is essential to Europe’s competitiveness.

The Commission published its guidance only weeks before the new rules start to apply, leaving companies with little time to adapt. © Jakub Porzycki/NurPhoto/ Getty Images

Commission president Ursula von der Leyen wants businesses to adopt AI more rapidly to prevent the bloc from falling further behind the US and China in the global AI race.

As part of this push, Brussels has unveiled plans for AI gigafactories, increased investment in computing infrastructure and promised to cut red tape to boost competitiveness and decrease Europe’s reliance on US tech providers.

But many companies argue the bloc is simultaneously asking businesses to deploy AI faster while complying with new rules that remain difficult to interpret. The Commission published its guidance only weeks before the new rules start to apply, leaving companies with little time to adapt.

Berlin-based online retailer Zalando, which uses AI to generate or enhance about 90 per cent of its marketing material, said the Commission’s guidelines added “another unnecessary layer of regulation”.

“The newly introduced guidelines do not bring the clarity we would have wished for,” said Zalando.

It added that the Commission’s guidance risked fragmenting implementation because different businesses might interpret the rules differently.

Retail lobby group Eurocommerce has also warned against “indiscriminate labelling” that could create disproportionate compliance costs while confusing consumers.

The new labels are intended to make consumers more aware when they are interacting with AI-generated material.

But lobby group CCIA Europe, whose members include large US tech companies, warned the guidelines defined deepfakes so broadly that almost anything AI-generated needed a label. “Treat every image and content the same way and the label stops meaning anything,” it added.

CCIA’s AI policy lead Boniface de Champris said the “burdensome requirements and questionable interpretations” were a “recipe for compliance paralysis, not for innovation”.

But the EU’s tech chief Henna Virkkunen has argued that the new rules are important in ensuring AI content, agents and chatbots are “more transparent and trustworthy” for consumers.

The new rules are important in ensuring AI content, agents and chatbots are ‘more transparent and trustworthy’, says EU tech chief Henna Virkkunen. © Krisztian Bocsi/Bloomberg

“These are systems being inserted into millions of people’s lives and livelihoods, often by a handful of big corporations, and the public deserve to know what they’re dealing with, what AI can do and what risks come with it,” said Risto Uuk, head of EU policy and research at the Future of Life Institute, which has lobbied for stricter protections for high-risk AI systems.

Commission officials also insist the guidelines contain several exemptions designed to avoid “labelling fatigue”, including for standard photo editing.

The idea that even “the smallest modifications through AI would require excessive labelling is misplaced”, said one Commission official, noting that the guidance has been changed to make it more proportionate after consultations with industry.

“The guidelines have really sought to take a most practical approach to this so that we do not end up with a transparency obligation that is meaningless.”

For some companies, the new rules largely formalise practices they had already adopted.

Gaming company Chess.com said it understood the importance of its community knowing when they are playing against a person and when it is a bot. Last month, more than 250mn games on the platform were played against bots, according to chief executive Erik Allebest.

Booking.com, an online travel company, said customers increasingly expected to know whether they were talking to an AI assistant or a human agent, making transparency good business as well as a regulatory requirement.

“We’ve seen that objectively being transparent about the fact that you’re talking to an AI leads to better customer service outcomes at the end of that issue,” said Pranav Pathak, director of product, AI at Booking.com.

But while Booking.com is supportive of the AI act in general, the company said it wanted more clarity from the Commission on how to translate the legislation into its products. “We need to understand in plain and simple terms what the regulation allows [our engineers] to do and what it doesn’t.”

The EU’s transparency rules are only one part of the AI act’s gradual rollout, which entered into force in August 2024.

On Sunday, the Commission will also gain new legal powers to inspect general-purpose AI models that pose “systemic risks.” If in breach, tech companies can be fined up to 3 per cent of their total worldwide annual turnover in the preceding financial year, or €15 million, whichever is higher.

However, under pressure from the tech industry and some EU countries, the Commission has already postponed the start date for the requirements for so-called high-risk systems until December 2027.

“The issue is not so much that the legislation is onerous, but that it is unpredictable and keeps on changing. Businesses don’t like that,” said one lawyer advising clients on the legislation.