From 2 August 2026, enforcement and new transparency duties make AI inventory, disclosure and provenance operational—not theoretical.
The European Commission announced that, from 2 August 2026, the AI Office and national authorities would begin enforcing the EU AI Act, alongside new transparency requirements for certain interactive systems and AI-generated or altered content.
The practical message for enterprises is straightforward: AI governance can no longer remain a policy document waiting for “the regulation” to arrive.
Transparency becomes a product requirement
The Commission says certain chatbots and interactive systems must tell users they are interacting with AI rather than a human. Deepfakes must be labelled, and certain generated or altered content must carry machine-readable markings.
Those obligations affect product design, content pipelines, vendor selection and record keeping. A disclosure cannot be treated as a footer added by legal at the end. It must appear at the appropriate moment, in the appropriate channel, and survive when content moves between systems.
For voice, image and video, provenance is particularly challenging. Metadata can be stripped. Content can be edited or recompressed. Multiple providers may participate in one asset. Enterprises need a layered approach combining visible disclosure, machine-readable signals, source records and internal audit trails.
Start with an AI system inventory
An organisation cannot govern systems it has not identified.
The inventory should cover more than officially approved AI products. It should include:
- customer-facing agents and chatbots;
- embedded AI features in SaaS tools;
- internal copilots and coding agents;
- scoring, recommendation and optimisation systems;
- generated media;
- vendor models used through APIs;
- locally deployed or open-weight models;
- experimental agents connected to live data;
- automated decisions inherited from suppliers.
Each record should have an owner, purpose, users, data sources, providers, deployment region, level of autonomy, affected people, current controls and change history.
A spreadsheet can begin the process. It is rarely sufficient once agents and embedded features multiply.
Classification must connect to engineering
Legal risk classification matters, but a production team needs controls it can implement.
Examples include:
- disclosure components and interaction logs;
- human-oversight checkpoints;
- approved data sources and retention;
- performance and bias evaluations;
- incident and complaint handling;
- technical documentation;
- change control for models, prompts and tools;
- provenance and content-labelling mechanisms;
- access controls and segregation of duties.
The crucial move is from “this system falls into category X” to “therefore this release must pass controls A, B and C before deployment”.
The calendar is not one single deadline
The AI Act’s obligations phase in across different dates and categories. Product teams should not reduce the regulation to a single August milestone. High-risk systems, general-purpose models, transparency duties and existing systems may follow different provisions and transitional arrangements.
Implementation also depends on guidance, standards and national enforcement. Regulatory interpretation can change.
That is why governance should be built as a changeable control system, not a one-off compliance project. Policies, evidence and system classifications must be versioned.
Five actions for the next board agenda
- Name accountable owners. AI cannot sit ambiguously between innovation, IT, data, legal and security.
- Complete the inventory. Include shadow AI and capabilities embedded in existing vendors.
- Prioritise transparency. Map every customer and employee interaction where AI disclosure may be required.
- Connect controls to delivery. Add governance checks to architecture reviews, procurement and CI/CD.
- Prepare evidence. Retain evaluations, decisions, versions, incidents and human-oversight records in a usable form.
The goal is not to create paperwork around every model call. It is to make consequential systems explainable and controllable.
The Lexdatum view
Compliance-aware architecture is faster than post-hoc remediation.
A well-designed agent already knows its owner, permissions, tools, policy version and escalation path. A well-designed content pipeline already records provenance. A well-designed release process already runs evaluations and keeps evidence.
The AI Act increases the cost of ambiguity. It also rewards organisations that treat governance as part of engineering.
This analysis is general information, not legal advice. Applicability and deadlines should be assessed for each system, role and jurisdiction with qualified counsel.
Sources
- European Commission — Commission starts enforcing AI Act rules and new transparency requirements on 2 August (2026-07-31)
Research note: This analysis is based on public information available on 31 August 2026. Product capabilities, prices and regulatory interpretations can change. Vendor-reported metrics are identified as such. This is not legal, security or investment advice.