What the EU's New AI Disclosure Rules Mean for US Builders

On August 2, a new set of AI transparency rules became enforceable in the EU. Before you scroll past because you're in the US, here's the part that matters: the law follows the user, not the company. If someone in the EU can reach your AI app, you're in scope. Several US states and the FTC already have their own versions too.

This isn't something I focus on in my trainings, but I want you covered, because if you're building AI web apps, you'll have EU visitors whether you planned for them or not. Here's the whole thing in plain English.

The four rules that apply to you

1. Your app's chat has to say it's AI, up front. If people can talk to an AI in your app, the first message has to identify it as "AI" (that exact word, not "virtual assistant"), with a visible label in the chat, not buried in the terms or footer.
2. Realistic AI images, audio, or video get labeled. If your app generates a realistic-looking person or voice, a deepfake or a lifelike avatar, it has to be clearly marked as AI-generated. Cartoon dragons and obvious fantasy don't count; anything that could pass for real does.
3. Published AI text that informs people gets a label or a human's name. If your app puts out AI-written text meant to inform the public, it needs a visible "AI-generated" label, or a named human who reviewed it and stands behind it.
4. If your app reads emotions or sorts people by biometric traits, tell them and get a yes first. Detecting stress or sentiment, or categorising people by face, voice, or demographics, means two things: you have to inform anyone exposed to it (AI Act), and because biometric data is protected, you generally need their explicit opt-in before you collect it (GDPR). If your app doesn't do any of this, skip this one.

The part most people get wrong: the "a human reviewed it" exception only covers published text. It does not excuse your app's chat from disclosing, and it doesn't make a deepfake label optional.

What almost no one will tell you

It's not enough to bury "this is an AI" in your terms of service. It's not enough to swap in "virtual assistant" and call it done. And it's not enough to treat this as a legal box to check.

Because the same disclosure that keeps you compliant is the thing that makes people trust your AI app enough to actually buy from it. Nobody ever abandoned a funnel because the chat said "I'm an AI assistant." What kills conversion is a lead figuring it out three messages in and feeling played.

Two prompts that do the work

You don't have to remember any of this. You make the AI enforce it.

Prompt 1: compliant by default (paste at the start of a project)

COMPLIANCE: apply to everything you build in this project. This app may be used by people in the EU and other places with AI disclosure laws, so build these in by default: (1) any chat or voice interface identifies itself as AI in its first message, using the word "AI" (not "virtual assistant"), plus a visible on-screen label, never only in the terms or footer; (2) any AI-generated image, audio, or video output is clearly labeled as AI-generated; (3) if the app publishes AI-generated text meant to inform people, include either a visible "AI-generated" label or a named human reviewer; (4) if the app uses emotion recognition or biometric categorisation, meaning it reads emotions or sorts people by face, voice, or demographics, inform users that it is happening and require explicit opt-in consent before any biometric data is collected. Flag it explicitly if anything I ask for would conflict with these, and propose a compliant alternative instead of dropping the requirement.

Prompt 2: check what you already built

Check this app for AI disclosure compliance and fix what's missing. Make sure every chat or voice interface says it's "AI" in its first message with a visible label on screen (not just in the terms); any AI-generated image, audio, or video is labeled; any published AI text has a label or a named human reviewer; and any emotion recognition or biometric categorisation informs users and has explicit opt-in consent before collecting biometric data. Tell me what's missing, add it, and flag anything that would conflict.

That's it. The rule, the reframe, and two prompts that do the work.

Building the app is only part of the job. You also need to know what could affect it once it's in the real world.

That's what we work through together inside AI Powered Web Apps: the build, and everything that hits it after launch.

Come build with us.

Plain-language summary, not legal advice. Anyone with real EU revenue or enterprise clients should have counsel review their setup.