The New Rules of AI - What Tech Leaders Must Know

The EU AI Act has entered a new and important phase.

In this episode of the Inspiring Tech Leaders podcast, I explore what the 2 August 2026 milestone means for organisations using, deploying and supplying AI.

The discussion covers:

💡 Why transparency is becoming a core AI responsibility
💡 When people must be told they are interacting with AI
💡 New expectations around deepfakes and synthetic media
💡 The importance of machine-readable labelling and digital provenance
💡 Why every organisation needs an AI invento💡 The difference between AI providers and deployers
💡 How AI procurement is becoming part of supply-chain governance
💡 The potential penalties for getting transparency obligations wrong
💡 Whether responsible AI can become a competitive advantage rather than simply a compliance burden

The central message is simple – AI Governance should not be about stopping innovation. It should be about enabling organisations to innovate safely, transparently and responsibly.

Available on: Apple Podcasts | Spotify | YouTube | All major podcast platforms

Start building your thought leadership portfolio today with INSPO.  Wherever you are in your professional journey, whether you're just starting out or well established, you have knowledge, experience, and perspectives worth sharing. Showcase your thinking, connect through ideas, and make your voice part of something bigger at INSPO - https://www.inspo.expert/

Everyday AI: Your daily guide to grown with Generative AI
Can't keep up with AI? We've got you. Everyday AI helps you keep up and get ahead.

Listen on: Apple Podcasts   Spotify

Transcript

Introduction

SPEAKER_00 0:00

Welcome to the Inspiring Tech Leaders Podcast with me, Dave Roberts. Today I'm talking about a development that could have a significant impact on how artificial intelligence is built, deployed and used, and not just across Europe, but potentially around the world. On the 2nd of August 2026, the European Union moved the AI Act from being primarily a piece of legislation that companies were preparing for into a much more serious enforcement phase. The European Commission's AI Office, together with national authorities, has started enforcing important provisions of the EU AI Act, while a new set of transparency requirements has also come into effect. And this matters because the EU AI Act is arguably the most significant attempt by a major economic bloc to regulate artificial intelligence according to the risks that it creates. We've spent the last few years talking about what AI can do. We've talked about generative AI, large language models, AI agents, deepfakes, autonomous systems, and AI-powered decision making. But increasingly the conversation is moving from what AI can do to what organizations should be allowed to do with it, how people should be told that AI is involved, and who is ultimately responsible when something goes wrong. So today I want to look at what has actually changed. What these new transparency rules mean in practice, what businesses need to think about, and perhaps most importantly, whether this represents the beginning of a new era of trust in AI or the beginning of a much more complicated compliance burden for organisations. So

When People Need to Know They’re Interacting with AI

SPEAKER_00 1:30

let's start with the headline. The European Commission says that from the 2nd of August 2026, new transparency rules apply to certain AI systems. The objective is relatively straightforward. People should be able to recognise when they're interacting with AI and when that content has been generated or manipulated by AI. For example, this audio podcast is really me, but if you watch the video version of it, then you'll see my AI avatar, which looks like me but has saved me hours in studio recording time. So this all sounds obvious, but the implications can be significant. Imagine you open a customer service chat on a company's website. You might assume you're talking to a person, but you're actually talking to an AI agent. Under the new requirements, certain AI systems need to be designed so people are informed when they are directly interacting with AI. Now imagine you see a video online of a politician apparently saying something controversial, or perhaps a photograph showing a major event that never actually happened. The technology to create convincing synthetic content is becoming extraordinarily powerful. The challenge is that the average person may have no reliable way of knowing whether what they're seeing or hearing or reading is authentic.

Article 50 – Making AI-Generated Content Detectable

SPEAKER_00 2:43

That is where Article 50 of the AI Act becomes particularly interesting. The transparency requirements cover several different scenarios. Providers of certain AI systems have obligations to inform people that they are interacting with AI. AI generated or manipulated content also needs to be appropriately marked so that it can be detected, with machine readable information being particularly important for content generated or manipulated by AI. There are also specific obligations for organizations deploying certain systems. For example, if an organization uses emotion recognition or biometric categorization, people exposed to those systems generally need to be informed. And there is another particularly interesting provision covering AI-generated or manipulated text that is published for the purpose of informing the public on matters of public interest, where it has not undergone human review or editorial control. Think about what that could mean for news, public communications, marketing and corporate communications. If an organization uses AI to generate an article about an important public issue and simply publishes it without meaningful human review, transparency requirements may come into play. This is a very different proposition from saying that companies cannot use AI to rise. The EU is simply saying don't use generative AI. Instead, it is increasingly say if you use AI in certain ways, people need to know. And I think that distinction is really important, because one of the biggest challenges we have with AI today is not necessarily the technology itself, it is the erosion of certainty. We're entering an environment where seeing something is no longer necessarily believing something. A photograph isn't necessarily a photograph. A voice recording isn't necessarily someone's voice. A video isn't necessarily evidence that someone did or said something, and increasingly an article isn't necessarily evidence that a human actually wrote it.

Digital Provenance – Knowing Where Content Came From

SPEAKER_00 4:38

The EU's approach is therefore attempting to create a form of digital provenance. The idea is that technology should help us to understand where content came from and whether it's been generated or manipulated. That becomes even more important as AI-generated content moves from being obviously artificial to becoming almost indistinguishable from reality. And this is where the new requirements become particularly relevant for businesses. If you're a technology leader, you can't simply ask which AI models are we using. You increasingly need to ask where is AI being used across the organization? Who is using it? What is it generating? Who sees the output and what obligations do we have? That requires an AI inventory. I think every organization should be building one now. Not necessarily a giant spreadsheet containing every use of ChatGPT or Microsoft Copilot, but an understanding of where AI is embedded in business processes. For example, is AI being used in customer service? Is it being used in recruitment? Is it generating marketing content? Is it producing images or videos? Or is it analysing employee sentiment? Is it embedded into software that your organization has purchased from another supplier? And perhaps most importantly, does your organization actually know the answers

AI Governance is Now a Business Responsibility

SPEAKER_00 5:55

to those questions? Because one of the greatest challenges with AI governance is that AI is becoming decentralized.

[Ad] Everyday AI: Your daily guide to grown with Generative AI

SPEAKER_00 6:40

A few years ago, an organization could reasonably expect its IT department to know what technology was being deployed. Today, AI is everywhere, and that makes governance

(Cont.) AI Governance is Now a Business Responsibility

SPEAKER_00 6:51

much more complicated. The EU AI Act therefore isn't simply a technology issue, it's becoming a business governance issue. It involves legal teams, procurement, cybersecurity, data protection, risk, HR, marketing, communications, IT, and increasingly the board. And there is another important part of this story that's worth understanding. The 2nd of August deadline does not mean that every single provision of the AI Act suddenly becomes enforceable on that day. The Act has been introduced progressively. Some prohibited AI practices and AI literacy obligations have already been applied since February 2025, while obligations relating to general-purpose AI models began applying in August 2025. The 2nd of August 2026 milestone is particularly important because the Commission's enforcement powers relating to general-purpose AI providers became applicable alongside the Article 50 transparency obligations. So we shouldn't describe the 2nd of August as simply being the day the whole AI Act came into force. It's better understood as another major phase in the implementation of the Act. And there is a very important distinction for businesses between being a provider and being a deployer. A provider is essentially the organization developing or placing an AI system on the market. A deployer is an organization using an AI system under its authority. That means an organization doesn't necessarily escape its responsibilities simply because it didn't build the underlying AI model. You might be using somebody else's model, somebody else's platform or somebody else's AI application, but depending on what you're doing with it, you may still have obligations. This is one of the reasons why AI procurement is becoming increasingly important. When an organization buys an AI-enabled product, the question can no longer simply be, does

AI Procurement and Supply Chain Governance

SPEAKER_00 8:37

it work? The procurement team needs to ask questions around AI governance, transparency, data, security, model provenance, documentation, and regulatory compliance. And this is going to put increasing pressure on technology suppliers. Because enterprise customers are going to start asking vendors how to demonstrate that their products comply with the AI Act. That could ultimately create a chain reaction through the technology ecosystem. The large AI model providers will have responsibilities, the software companies building on those models will have responsibilities, and organizations deploying those applications will have responsibilities of their own. So, AI regulation is potentially creating an entirely new layer of supply chain governance. And of course, there is also the question of enforcement. The European Commission says the enforcement of Article 50 transparency rules will mainly involve national market surveillance authorities, with the AI office having specific responsibilities for certain systems under its supervision. The European Data Protection Supervisor has responsibility for AI systems used by EU institutions, bodies and agencies, and the penalties are significant. For breaches of transparency obligations, fines can reach up to €15 million, or 3% a worldwide annual turnover for the preceding financial year, with proportionality taken into account for SMEs and small mid-cap companies. That changes the conversation. This isn't just about producing a nice AI policy that sits on the internet somewhere. This is now a financial consequence to getting some of the aspects of AI governance wrong. And that brings me to perhaps the biggest question. Is the EU regulating too aggressively? There are certainly arguments on both sides. The criticism is that regulation could slow innovation. AI is deploying incredibly quickly. Governments and regulators are trying to write rules around technologies that can change significantly between the publication of the regulation and its enforcement. There is a legitimate concern that smaller businesses could struggle with the administrative burden. There is also the risk that companies become so focused on compliance that they become reluctant to experiment with AI. But the counter-argument is equally strong. If people cannot trust what they see online, then the economic and social consequences could be enormous. If companies deploy AI systems without adequate transparency, customers may not understand how decisions are being made. If deep fakes become indistinguishable from reality, misinformation becomes much harder to combat. And if organizations don't know where AI is being used, they can't properly manage the risks associated with it. So perhaps the real question isn't whether AI should be regulated, it is how intelligently it should be regulated. And this is where I think the EU's risk-based approach is interesting. The AI Act doesn't treat every AI application as equally dangerous. A recommendation engine suggesting what music you might like is not treated in the same way as an AI system being used in a high-risk environment. The object is to focus regulatory attention where the potential harm is greatest. And transparency is one of the most obvious areas to start. Because telling someone they're interacting with AI isn't necessarily a restriction on AI. In fact, it could help

Could Transparency Become a Competitive Advantage?

SPEAKER_00 11:55

adoption. If customers know they're interacting with an AI assistant, they can make an informed decision about how much they trust the response. If an image is clearly identified as AI generated, people can interpret it appropriately. If an organization explains that AI was involved in creating content, that transparency may actually build trust rather than undermine it. And I think it could become a competitive advantage. We often talk about responsible AI as if it's a purely compliance function, but I don't think it should be. Responsible AI could become part of a company's brand. Imagine two organizations offering essentially the same AI-powered service. One says very little about how AI is being used, the other tells you when you're interacting with AI, explains where AI-generated content is involved, gives you meaningful human escalation options, and clearly communicates the limitations of the technology. Which one would you trust? Suspect the second. And that brings us to an important point for technology leaders. AI governance is not designed to stop people using AI. It should be designed to allow people to use AI safely. And that is a very different philosophy. The best organizations are not going to have an AI governance program that says no. They're going to have a governance program that says yes, and here are the conditions. Yes, you can use generative AI. Yes, you can build AI agents. Yes, you can automate processes, and yes, you can generate content. But you need to understand what system is being used, what data is being used, what risks it creates, how the output is controlled, and how the customer or employee knows AI is involved. And I think that is where the next stage of the AI journey is heading. We spent the first phase of generative AI asking what we can do with it. The next phase is asking what we should do with it. And perhaps the phase after that may be how do we prove we are doing it responsibly? The EU AI Act is an important part of that transition. There is a practical detail worth mentioning. The European Commission has published guidelines specifically to help organizations understand the Article 50 requirements. It has also developed a code of practice on transparency of AI generated content, which organisations can use as a voluntary tool to demonstrate compliance. There is also a transitional arrangement for certain generative AI systems that were already in place on the market before the 2nd of August 2026. For those systems, the marking and detection obligations for AI generated content have a compliance period extending to the 2nd of December 2026. Content generated before the 2nd of August 2026 does not need to be labelled retrospectively, although the Commission encourages organizations to do so where possible. So if you're a technology leader or a business leader, what should you actually be doing? First, understand where AI is being used. Second, identify

What Technology Leaders Should Do Now

SPEAKER_00 14:46

which systems you own, which systems you deploy, and which systems you simply consume through another supplier. Third, understand where those systems fall within the transparency requirements. Fourth, make sure your procurement processes include AI-specific questions. Fifth, work closely with legal, security and risk teams. And finally, don't treat AI governance as a one-off project. The technology is changing too quickly for that. AI governance needs to become an ongoing business capability, because the biggest mistake an organization can make is to think that compliance is something you complete once. AI regulation is going to evolve, the technology is going to evolve, and the way organizations use AI is also going to evolve. So the organizations that succeed will be those that can innovate quickly while also understanding the boundaries within which they need to operate. And perhaps that's the biggest message from the 2nd of August. The European Union isn't saying that AI has to stop, it's saying that AI has to become more accountable, and that is a significant change. For years the technology industry has operated on the principle of moving fast and breaking things. With AI, we may be entering an era where that philosophy becomes something slightly different. Move fast, innovate aggressively, but know what you're building, understand the risks, and be transparent with people affected by it. Whether you agree with every part of the EU AI Act or not, that is a conversation that every technology leader needs to be having. Because AI regulation is no longer something that is coming, it has arrived, and the 2nd of August 2026 may well be remembered as the point at which AI governance moved from policy documents and conference discussions into real-world enforcement. The next question is what happens when regulators start testing those rules against the rapidly evolving AI systems that businesses are deploying today. Well, that's all for today. Thanks for tuning into the Inspiring Tech Leaders Podcast. If you've enjoyed this episode, don't forget to subscribe, leave a review, and share it with your network. You

Wrap Up

SPEAKER_00 16:44

can find more insight, show notes, and resources at www.inspiringtechleaders.com. Head over to the social media channels you can find Inspiring Tech Leaders on X, Instagram, Inspo, and TikTok. And let me know your thoughts on the EU AI Act. Thanks for listening, and until next time, stay curious, stay connected, and keep pushing the boundaries of what's possible in tech.