New EU AI transparency rules: do they affect your firm?

On 2 August 2026 the EU AI Act's transparency obligations came into force, and they are the clearest signal yet of where AI regulation is heading worldwide. For most Australian professional services firms there is no immediate legal obligation, but two things make this week's milestone worth your attention. First, the rules reach beyond Europe: they can apply to firms outside the EU when the output of their AI systems is used inside it. Second, Australia's own AI standards legislation is slated for early 2027, and the EU rules are the template most regulators are watching. Here is what changed, who it touches, and what a sensible Australian firm should do about it this month.

What actually changed on 2 August?

The EU AI Act has been phasing in since 2024, and 2 August 2026 was the date its Article 50 transparency obligations became applicable. These rules are not limited to so-called high-risk AI. They apply to everyday systems in four situations:

• Chatbots and assistants must disclose they are AI. Any system that interacts directly with people must be designed so users know they are dealing with AI, unless that is already obvious to a reasonably observant person.
• AI-generated content must be machine-readable as AI-generated. Providers of generative AI must mark synthetic audio, images, video and text so it can be detected as artificial. Generative systems already on the market have until 2 December 2026 to comply with the machine-readable marking requirement.
• People must be told when emotion recognition or biometric categorisation is used on them.
• Deepfakes and AI-generated public-interest text must be labelled. Organisations deploying AI to generate or manipulate realistic content must disclose it, and AI-written text published to inform the public on matters of public interest must be flagged unless a human has editorial review and responsibility.

Alongside these obligations, the European Commission has published guidelines and a Code of Practice on marking and labelling AI-generated content, which set out how the standardised labels are expected to work in practice.

Can an EU law really reach an Australian firm?

In some circumstances, yes. The AI Act applies to providers and deployers established outside the EU where the output of their AI systems is used in the EU. A firm in Sydney or Brisbane with no European office can still be in scope if, for example, it serves EU-based clients with AI-assisted work product, runs an AI chatbot that European visitors interact with, or publishes AI-generated content aimed at European audiences.

The distinction that matters is between providers (the companies that build AI systems, such as OpenAI, Anthropic, Microsoft and Google) and deployers (the organisations that use them under their own authority). Most professional services firms are deployers. That is a lighter set of duties, but not an empty one: the deepfake and public-interest labelling obligations sit with deployers, as does the duty to tell people when emotion recognition is used.

For most Australian firms with a domestic client base, the honest answer is that direct exposure is low. If your firm has EU clients, EU-facing marketing, or a public chatbot, it is worth a proper conversation with your own advisers rather than an assumption either way.

What are the penalties?

Non-compliance with the transparency obligations can attract fines of up to 15 million euros or 3 per cent of total worldwide annual turnover, whichever is higher. The Commission's enforcement powers and penalty regime also became fully operational with this milestone. Nobody expects regulators to lead with maximum fines against small foreign firms, but the numbers tell you how seriously the EU is treating disclosure of AI use.

Is Australia heading the same way?

Signs point to yes. In July the federal government announced a shift away from its light-touch approach, including a new AI office within the Prime Minister's department and AI standards legislation planned for early 2027. The detail is still to come, and the government has said it will not try to legislate for every eventuality. But the direction of travel is clear: disclosure and transparency obligations of the kind the EU switched on this week are the most likely starting point, because they are the easiest to justify and the hardest to argue against.

Professional bodies are moving in the same direction. Courts, regulators and industry associations across law, accounting, architecture, real estate and health have all been sharpening their expectations about disclosing AI use in professional work. The question your clients will increasingly ask is not "do you use AI?" but "how do you use it, and how would I know?"

What this means for your firm

You do not need an EU compliance program. You do need the habits the EU has just made law, because they are rapidly becoming baseline professional practice everywhere:

1. Know where AI sits in your client-facing work. Most firms cannot currently list which workflows involve AI-generated or AI-assisted output. A simple register, even one page, puts you ahead of most of the market and is the foundation for any future compliance obligation.
2. Decide your disclosure position now, on your own terms. Write down when and how your firm tells clients that AI was involved in producing work. A firm that can explain its AI use calmly and confidently wins trust. A firm that gets asked and has no answer loses it.
3. Label the obvious cases. If you publish AI-generated images or video, or use a chatbot on your website, say so. It costs nothing today and it is exactly what both the EU rules and any future Australian rules will require.
4. Keep humans in editorial control. The EU's own carve-out is instructive: AI-written public content does not need a label where a human has editorial review and responsibility. Human review of anything that leaves the firm is the single practice that satisfies regulators, professional bodies and clients at the same time.
5. Check your EU exposure once, properly. If you have European clients or audiences, ask your advisers whether Article 50 touches you. If you do not, note that you checked and move on.

How to get ahead of the 2027 conversation

The firms that will find Australia's 2027 legislation easy are the ones that spent 2026 building simple, documented AI practices: knowing their tools, reviewing outputs, and being upfront with clients. That is a governance habit, not a technology purchase, and it is very achievable for a small or mid-sized firm.

If your firm wants help putting a practical AI policy and disclosure approach in place, that is exactly the kind of work our in-house training and consulting covers. And if you want to stay current as the rules evolve, our upcoming webinars regularly cover what regulators and professional bodies expect from firms using AI.