What Europe's AI Disclosure Rule Means for Small Business

On August 2, a piece of the EU AI Act became enforceable. Most of the coverage was about the part that didn't.

The headline for the past year was the delay. Europe's rules for high-risk AI systems, the ones covering hiring, credit, education, and critical infrastructure, were supposed to land this week. The Council approved a deferral in June. Standalone high-risk systems now have until December 2027. AI built into regulated products has until August 2028.

A lot of people read "delayed" and stopped reading.

The transparency obligations were not delayed. They took effect on schedule and they are live now.

What they require is simple enough to say in one sentence. If a person is interacting with an AI system, they have to be told. If content is generated or manipulated by AI, it has to be marked. Deepfakes have to be labeled.

If you run a business in the United States with no European customers, none of this is your legal problem today.

Here's where I want to slow down, though, because "not my legal problem" and "not my problem" are different things.

Rules like this one do something besides create liability. They set a public standard for what counts as normal behavior. Once the largest regulated market in the world decides that telling people they're talking to a machine is the baseline, that becomes what your customers expect from everyone. Not because they read the regulation. Because the companies they buy from start doing it, and the ones that don't start looking evasive.

GDPR already ran this play. Cookie banners are a European invention. You clicked one this morning on an American website with no European users, because the standard traveled faster than the jurisdiction.

So the practical question isn't whether the rule applies to you. It's whether your business would pass it.

Most owners can't answer that quickly, and the reason is worth sitting with. AI got into their operations sideways. Nobody made a decision to deploy it. A tool added a feature. A vendor swapped in a model. Somebody on the team started drafting with it. The AI showed up before the policy did.

Give it twenty minutes this week. Write out every place AI touches a customer. The chat widget on your site. The phone system that answers after hours. The review responses. The estimate that gets drafted before someone edits it. The follow up sequence that goes out after a quote.

Then mark each one with whether the customer could tell.

Most lists come back with at least one item where the honest answer is no, and where disclosure would have cost nothing. That gap you can close this afternoon with a sentence of copy.

The harder ones are more revealing. If disclosing feels like it would hurt, that tells you something about how much of the interaction your customer assumed was human.

I don't think disclosure is a competitive disadvantage, and I'd push back on anyone selling you that idea. A customer who knows they're talking to a machine and gets a bad answer is annoyed. A customer who finds out afterward feels tricked. The second one tells other people.

That's not a small distinction. What you're protecting by staying quiet is almost always smaller than what you're risking.

One more piece of this is worth watching, even though it needs nothing from you yet. The synthetic content requirement pushes toward machine-readable markers embedded in the file itself, not just a note in the caption. That standard is still forming, and your tools will handle it for you when it lands. But the day your image generator starts stamping metadata into every output is the day "AI-generated" stops being something you get to decide whether to mention.

The delay made this look like a story about 2027. The part that actually matters started on Monday, and it was never really about compliance.

It's about whether your customers, if they found out exactly where AI sits in your business, would feel informed or misled.