EU AI Act Transparency Violations: €7.5 Million for Undisclosed AI Interactions

Regulatory Authority: Regulation (EU) 2024/1689, Article 50 (Transparency obligations for certain AI systems), Article 52(1) (Chatbot disclosure), Article 52(2) (Emotion recognition and biometric categorization notification), Article 50(2) (Deepfake and AIGC labeling), Article 50(4) (Journalism and satire exceptions), Article 99(5) (Administrative fines for transparency violations and incorrect information), Article 99(6) (SME considerations), Recital 132 (Transparency rationale), Recital 133 (Synthetic content labeling context)

Applies to providers and deployers who fail to meet the transparency obligations of Article 52: failure to disclose AI chatbot identity to users, failure to label AI-generated synthetic content (deepfakes, AIGC), or failure to notify individuals that an AI system is assessing their emotions or performing biometric categorization. The obligation applies even for AI systems that are not classified as high-risk.

Article 99(5) applies this penalty tier to any provider or deployer who supplies incorrect, incomplete, or misleading information to national competent authorities or the EU AI Office in response to a request or during an investigation. This is structurally similar to obstruction of justice in U.S. regulatory law — the fine attaches to the conduct during the investigation, not just the underlying violation.

Article 50(2) requires that AI-generated synthetic audio, video, image, or text that realistically depicts real people, places, or events — and which could plausibly deceive — must be labeled as artificially generated. This applies to providers of the generation systems and deployers who publish the content without labeling. Article 50(4) carves out news reporting and satire with disclosure.

Understand Your EU AI Act Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

Take the Quiz →   Gap Analyzer →

Exactly what language is required to disclose that users are talking to an AI chatbot?

Article 52(1) of Regulation (EU) 2024/1689 requires that operators of AI systems intended to interact with natural persons 'inform natural persons that they are interacting with an AI system in a timely, clear and intelligible manner.' The Act does not specify exact phrasing — this is left to implementing guidance from national competent authorities and the EU AI Office. Key requirements emerging from Q1 2026 guidance: the disclosure must be made at the beginning of the interaction (not buried in terms of service), must be in the user's language, must be prominent enough that a reasonable user would notice it, and cannot be waived by the user unless the AI system operates in a context where it is 'obvious from the context' that the user is interacting with AI. The exception for 'obvious context' is narrow — it covers things like explicitly labeled AI demo environments, not general consumer chatbots.

Does the deepfake labeling obligation apply to satirical content and news?

Article 50(4) creates a narrow exception: the synthetic content disclosure obligation in Article 50(2) does not apply to AI-assisted human expression for the purpose of artistic work, satire, or parody — provided 'appropriate disclosure' is made by other means and the content does not cause harm to specific individuals. News reporting and journalism are also subject to a modified standard. In practice, this exception is interpreted strictly: a clearly labeled satirical piece in an established publication that uses AI-generated imagery of a politician can qualify. A realistic AI-generated video published without context on a social platform claiming to show an actual event does not qualify. The carve-out requires affirmative disclosure — the satirical intent must be communicated, not just implied. Importantly, the obligation falls on the deployer (who publishes the content) and the provider of the AI generation system under different provisions — both can be liable simultaneously.

What counts as 'incorrect or misleading information' to regulators under Article 99(5)?

Article 99(5) applies the €7.5M / 1% penalty to operators who supply 'incorrect, incomplete, or misleading information to notified bodies or national competent authorities.' Based on analogous GDPR enforcement practice (where Art. 83(1)(c) penalizes failure to cooperate), the standard covers: technical documentation that materially misrepresents system capabilities, risk assessments that omit known failure modes, conformity declarations for systems that do not meet the standards assessed, and verbal or written statements during NCA investigations that contradict documented system behavior. NCAs do not need to prove intentional fraud — reckless or negligent submission of materially incorrect information is sufficient. The practical implication: companies must apply the same due diligence to regulatory submissions as to financial reporting. Internal audit-grade review of all NCA submissions is advisable before the August 2026 enforcement date.