European Commission tightens oversight on AI companies to combat deepfakes and cyber threats - Jurist.org

The European Commission on Friday announced that its AI Office in Brussels and national regulators will begin enforcing key provisions of the EU Artificial Intelligence Act on August 2, including new duties to identify deepfakes, label AI-generated material and oversee risks linked to powerful AI systems.

This move gives EU regulators greater power to inspect advanced AI models, demand technical records and act against companies that fail to label synthetic content or control serious cyber risks.The larger team will investigate whether companies operating in the EU are operating in strict compliance with the Artificial Intelligence Act. Officials may seek technical records, examine how models work, question company staff and order changes where systems fail to meet legal requirements. The Commission has also created confidential channels for employees and users to report suspected violations.

This latest development comes as European regulators have started paying closer attention to the plethora of security risks created by increasingly capable AI agents. OpenAI and Anthropic recently informed EU officials about separate cases involving unauthorized cyber activity by AI systems. The incidents have added to concerns that safety controls must continue after a model is released, rather than ending at the testing stage.

Article 50 of Regulation (EU) 2024/1689 requires that people be informed when they are interacting with certain AI systems. It also requires providers to make AI-generated or manipulated material detectable in a machine-readable form. Those using AI to produce realistic images, audio or video must disclose when the material has been artificially created or altered. However, it must be noted that this law does not impose a blanket ban on all deepfakes. Its purpose is to simply make synthetic content easier to identify and to reduce the risk of fraud, impersonation and manipulation. Deepfakes used for illegal purposes remain subject to other criminal, privacy and platform laws.

Previously, Grok AI has faced intense global scrutiny and been subjected to regulatory investigations for its generation of non-consensual sexualized deepfakes, often involving women and minors. Grok AI has been used as an example to reinforce the argument that safety controls in AI systems  should be monitored continuously, especially in light of new updates to its image-editing tools which created a loophole and permitted users to generate obscene images of innocent people.

The AI Act entered into force in August 2024 and is being introduced in stages. Its bans on certain unacceptable uses began applying in February 2025. The August 2026 phase introduces broader transparency requirements and stronger oversight of general-purpose AI models.

Member States must establish effective, proportionate and dissuasive penalties. National market-surveillance authorities may require a non-compliant system to be corrected, withdrawn or recalled, generally within 15 working days or any period set under other applicable EU law. Violations of Article 50 can result in fines of up to €15 million or three percent of worldwide annual turnover. Breaches involving prohibited AI practices may attract penalties of up to €35 million or seven percent, while smaller businesses are subject to the lower applicable ceiling.