Podcast transcript
Five Cents looks at AI rules becoming real, and why the EU AI Act is shifting from a legal headline into something companies now have to prove in daily operations. We’ll cover what is starting to apply, who enforces it, what firms need to document, and why this matters well beyond Europe. The useful starting point is simple: this is no longer just about having a rulebook. It is about being ready to show your work.
The EU AI Act entered into force in August 2024, but it was designed to roll out in phases. That matters because businesses often treat new regulation as a future problem until the enforcement calendar gets close. Now that calendar is becoming practical. The European Commission, the AI Office, and national market surveillance authorities are moving from setup to supervision. In plain terms, companies using or selling AI into the European market have to know whether their systems are covered, what role they play, and what obligations follow from that role.
The Act works by looking at both the type of AI and the way it is used. A company may be a provider, meaning it develops or places an AI system on the market. It may be a deployer, meaning it uses an AI system in its own service or workflow. Others may be importers, distributors, or part of the wider value chain. That classification is not a legal detail to tidy up later. It decides who must disclose information, keep documentation, manage risks, and respond if authorities ask questions.
The first live obligations show the direction of travel. Rules on AI literacy and prohibited practices began applying in February 2025. Obligations for general-purpose AI model providers begin in August 2025. Transparency rules apply from August 2026, including cases where people need to be told they are interacting with AI, or where AI-generated and manipulated content needs to be labeled or detectable. The Commission has also published guidance to help providers and deployers prepare for those transparency duties. So the focus is moving from broad principles, like responsible AI, to practical evidence: notices, labels, model records, internal processes, and audit-ready decisions.
For general-purpose AI, the pressure is especially clear. Providers need controls around transparency and copyright-related information, and the strongest obligations apply to models considered to carry systemic risk. For those, the AI Office becomes a central point of oversight. This does not only affect companies that build famous frontier models. It can affect any business that embeds, adapts, distributes, or relies on those models in products used by customers, employees, or the public. The bigger the AI supply chain becomes, the more important it is to know who is responsible for which piece.
The practical change inside companies is that compliance becomes operational. It cannot sit only with a legal team reviewing a document before launch. Product teams need to design user notices into the experience. Engineers need to track model changes, prompts, outputs, and safety controls. Procurement teams need to ask vendors for documentation. Customer-facing teams need to know when people must be informed that AI is involved. Compliance teams need records showing how a system was classified, what risks were assessed, what disclosures were made, and what controls are still running.
A common mistake is to treat AI compliance as a one-time checklist. AI systems change constantly. A model update, a new use case, a change in training data, or a new customer-facing feature can alter the compliance picture. Another mistake is to bury transparency in terms and conditions. The logic of the Act points toward disclosures that are part of the actual user journey, not hidden legal fine print. And for global firms, the EU standard can become a market-access standard: if a product touches European users or is embedded in European services, the company may need processes that are continuous, documented, and auditable.
So the takeaway is this: the AI Act is turning AI governance into proof, not posture. The key questions are who you are in the chain, what the system does, and whether you can demonstrate the controls behind it. A useful next Five Cents episode would be a practical walk-through of how a company should classify one AI tool under the Act, from chatbot to content generator to internal decision system. You can create a new Five Cents on that angle if you want to go from regulation to a concrete compliance workflow. And with that, you're up to speed in a few minutes.