From August 2026 the EU AI Act's transparency obligations apply: when you must tell a user they are talking to a machine, when synthetic content must be marked, what is required of foundation-model providers, and what this means for an Israeli company selling to Europe.
The transparency obligations of the EU AI Act are the part that touches the largest number of organizations. Unlike the heavy obligations that apply only to high-risk systems, the transparency obligations apply also to systems considered low risk, among them tools organizations already use today: a chatbot on a website, a tool that generates marketing images, and a system that drafts text.
This article explains what is required, from whom, and what it means for an Israeli organization.
The act's timeline is spread over several years, and the transparency obligations come into force at a relatively late stage, in August 2026. Many organizations put off dealing with them for exactly that reason. The result is that many of them run tools today that are subject to obligations already in force, without any check having been done.
The first concerns systems that interact with people. If a user is communicating with an AI system, the user must be informed of this, unless it is obvious to a reasonable person in the circumstances. A customer-service chatbot posing as a human agent is the clear example.
The second concerns emotion-recognition and biometric-categorization systems. Here it is mandatory to inform the person exposed to the system, in addition to the separate obligations that arise from privacy law.
The third concerns providers of systems that generate synthetic content: text, image, audio, or video. The output must be marked in a machine-readable format, so that it can be identified as the product of a system and not of a human.
The fourth concerns the party that operates such a system and publishes the output. Content that is a deepfake requires disclosure, and text published to inform the public on matters of public interest also requires disclosure, unless the content underwent human review and there is a party bearing editorial responsibility for it.
The obligation to mark synthetic content is not limited to deepfakes and not limited to content meant to mislead. It applies to the output simply because it is synthetic. An organization that generates product images for a campaign, or drafts product descriptions automatically, is within scope even when it has no intention to mislead anyone.
The second distinction worth internalizing is between a provider and an operator. The technical marking obligation falls on the provider of the system. The disclosure obligation to the public falls on whoever publishes the content. An organization that uses an external tool is an operator, so the disclosure obligation is its own, even if the provider did its part.
Providers of general-purpose AI models carry their own set of obligations: technical documentation of the model, information that lets downstream providers meet their obligations, a policy for complying with copyright law, and a public summary of the content used for training. Models classified as carrying systemic risk, usually because of exceptional compute power, are subject to a further layer: systematic model evaluation, proactive adversarial testing, reporting of serious incidents, and cybersecurity measures.
Most organizations are not foundation-model providers, but almost all are consumers of one. The practical meaning is that the information the provider must supply is the information the organization needs to meet its own obligations. If the provider does not supply it, that is a point to raise in the contract, not after an incident.
The act does not ask where the company is registered but where the users are and where the output is used. An Israeli company with clients in Europe, or a product serving users there, is within scope. The question of where the servers sit is not decisive. Another point easy to miss: the obligations travel down the chain.
An Israeli provider that integrates a third party's model into its product and sells it to a European client must pass on the information and the marking, not simply rely on its own provider having done so.
Preparation starts with mapping: which generative tools operate in the organization, who the provider of each is, and what their output is. Then comes a decision on each tool: is the organization a provider or an operator, and which obligation applies accordingly. Finally, two steps that tend to be put off and should not be: drafting the disclosure wording to be shown to users, and reviewing the contract with the provider to make sure the information the organization needs will actually be supplied.
Orderly infrastructure here is cheap. The same work under pressure from a client demanding an answer, or inside a due diligence, is far more expensive.
Note: nothing here is legal advice or a substitute for it, and it is not a binding opinion. Every case requires an individual review with a licensed lawyer.
נושא: בינה מלאכותית וממשל סיכונים
Real estate advisory & opinion · AI advisory & opinion · Advisory · Mediation & dispute resolution · Articles · Q&A · Readiness assessment · Book a call