The EU AI Act: the two duties that apply to your business now

AI's got so convincing at being human that it's hard now to tell the difference. In 2024, researchers ran the classic Turing test, the yardstick the technology community has used since the 1950s for whether a machine can pass as a person. People could no longer reliably tell GPT-4 from a human. A year later, they ran it again with a newer model and it went further than anyone expected. The AI was judged to be the human more often than the actual humans were.

Which is why, since Sunday the 2nd of August, new EU rules have applied to exactly this. The transparency obligations in the EU AI Act are built on one simple position. People must be able to tell when they're dealing with an AI and when they're dealing with a human. People should not be tricked.

Now, this is really me, Kristina Agustin, founder of Southern Sky AI. The background isn't real, of course. This is my stratosphere. I like to exist in the constellations of the stars, bouncing around in a neural network, imagining myself as a digital navigator, helping maritime leaders navigate according to the stars on a chart. And notice that nobody needed to tell you any of that.

You can see the background isn't real and I don't have to tell you that I am real. The rule only works the other way around. I would have to tell you if I wasn't, say if I'd sent one of my digital, linguistically educated avatars today instead. And that's the entire regulation in one line. You don't declare what's real, you declare what isn't.

This briefing covers within the next half an hour four things. What the EU AI Act is, what's enforced right now, what's coming and what concerns you and your business.

I've had industry comment that Southern Sky AI seems to be moving more towards AI governance these days. I address AI governance, AI deployment and AI training equally. But yes, I am leaning heavily on governance at the moment. And here's the reason. The technology is bolted.

Right now, if you're creative enough, any possible wish you might have to do with technology, you can make it happen. Institutions and regulators by their nature have to be thoughtful, considered and timely about their decisions. So we've seen a massive time lag between the exponential pace of the technology and the regulators trying to work out what we should and shouldn't be doing with it. The EU was the first to put real guidance in place on how AI can be used. And I foresee that in the coming six to 12 months, we're going to see other regulators having their input into what AI systems should be watched for, and how we should be governing them.

The next briefing I do will be on AI governance systems. What one is, what it looks like and how you set one up. But today specifically, I'm looking at the EU AI Act. Now a regulation from Brussels matters to us, because in the maritime space, we're international by nature. Your business may sit in the US, Australia or the UK.

In actual fact, the people you're aiming your services at are very often in the EU by the sheer size of that market in our part of the world. We all had to become aware of the GDPR and what that meant for us. And this is exactly the same awareness required. The heaviest obligations sit with the providers, the companies that build the AI systems, but the act also covers deployers. And a deployer is simply anyone using AI in their business under their own authority.

Whether you wrote the system or not, it does matter to you. Responsibility also doesn't transfer to the tool, you are still responsible. And the act follows the AI's output. So if something your AI produces ends up being used in Europe, a med season, an EU office or yard, marketing that runs in the European market, a document that goes to a European client, the act can apply to you wherever your business sits. It has nothing to do with what passport your clients hold.

Two obligations concern a business like ours today. The first has been law since February 2025, a year and a half already. If your business deploys AI that touches the EU, you have an obligation to train the people using it. And that's not just training on how to use the tool, it's responsible use of AI, what's approved in your business and what isn't, what must never be pasted into a public tool, how to read AI output as a draft rather than a fact, and how to raise a hand when something looks wrong. And it needs to be fitted to the role.

The captain, the purser and whoever runs your marketing don't need the same training. Now, there are no penalties attached to this obligation and nobody's coming to check. But we're all very aware that training is good evidence of good practices. It's an insurance policy for yourself. My own professional indemnity renewal now asks where AI is used in the business and how the team was trained on it.

If yours asks, and if you ever claim, your answer rests on a record or it doesn't. So keep the register. Who was trained on what, when, with the evidence attached. So it can just be one page and the record itself is the asset. And beyond the regulation, there are just plain commercial reasons.

Training is integral. Here's my Venn diagram of what makes AI succeed in a business, domain expertise, people, human adoption, and technology. And the technology is honestly the easy third. An MIT report found 95% of AI pilots fail to show a return. And the reason isn't the models, it's integration.

Knowing which problems matter, what the highest value starting point is, how your workflow is actually run, whether AI should assist them or reinvent them. And it's the people. People don't like change. It's a new way of thinking. It can feel threatening and there's a lot of fear.

So if you're going to see companies spending real money on AI licenses every year and getting frustrated at no return, and the missing piece will be the humans, not the software. We all appreciate in maritime how important training is both to get the value out of a tool and to avoid the risks. Southern Sky AI offers training if that's something you need.

And the second obligation is the one we opened with, the transparency obligations. This one all hangs off a single question and it gets asked from the other person's side. So imagine a guest, for example, on your website at midnight, typing away to your booking assistant. Does she know right then that she's talking to AI? Because if the only way she could ever find out is some sentence buried in your terms and conditions, then she doesn't know.

And that's exactly the point. The disclosure only counts when it's in front of her the moment she's dealing with AI. So your assistant tells her it's AI when the chat starts. Your image carries its mark wherever she's seeing that image. And your article says so on the page where she's reading it.

So a side thought, will this actually stop the harm? If you look at the world as goodies and baddies for a moment, the baddies have just as much access to this technology as you do and no rule is going to make it. Make a scammer disclose. So you can't rely on the absence of a label to mean that something's human. And from studying cybersecurity, I can tell you who's most exposed.

And it's typically the people who've had the least exposure to technology because a lot of them are sitting ducks for cyber risk. But the goodies are disclosing when they use AI. That makes real gains in earning the trust of your clients and your customers. And business is built on trust. So what this regulation really is doing is making a firm attempt at establishing what our standards should be.

And I think that's what this is all about. So let's get specific because in July, the EU published official guidance with examples. And there's a lot of common sense I think running through it. The guidance is sensible about ordinary work. So touching up a photo, you know, polishing the sky, you know, regular photo editing you do on something real, all of that is fine, and it gets treated as minor.

And you know how we all write drafts with AI now, how you ask it to polish your own ideas in your own work. Well, that's fine too, as long as you're taking the editor role and giving it a real read rather than just rubber stamping it and pushing it off.

So when does something actually need a label? So to know the answer to that question, you have to ask yourself two things. Did the AI make this? Or did it just polish mine? And does the public see it?

So if the AI only polished your work, it's still yours. If it never leaves the business like an internal report, there's nothing really to add either. But when the AI made thing and the public sees it, that's when it needs to be identifiable. If it's polishing your work, and it remains your work, and you're checking it, and you're editing it, and you're sending it out, that's okay. But if it's completely writing the thing, then it needs to be attributed to AI, something like a line at the bottom that says which AI tool helped you write the tool.

And I tend to take the approach that if I am writing a large document using with the assistance of AI, I will still say that I have edited it, I've reviewed it, and the views are my own, but I've used this AI tool to help me edit. And in that way, I feel that I'm covering all bases. So the emails, you hit send, there's nothing to add there. Somebody's dealing with an assistant on your booking page, or if an inbox is answering guests by itself without any human review, then that's an AI dealing with your client. And it has to say so upfront, including whose behalf it's acting on.

So a little assistant label tucked in the corner doesn't do that job. So on pictures, video and audio, anything AI has made or altered has to be identifiable as AI made. And where it's a creation of a real person, the default is disclosure. So an AI avatar, for example, should say straight up that it is an AI avatar and not a real person. So I noticed this happening on one of my own AI created images that I've posted on LinkedIn recently, where there's this credential in the corner, and I hadn't recognized what that was.

I made the illustration with Gemini, and the badge came along with it because Google stamps every image that AI makes, and now LinkedIn reads the stamp, and anyone who clicks it can see that the image was AI made and which tool made it. Now, I tend to take the view that it's obvious that AI created this image, but I suppose what's obvious to one person isn't necessarily obvious to someone else. And potentially, you know, it could be a hand-drawn illustration, maybe that is the deceit, but I guess suppose that the rule exists to treat everybody equally from wherever they start.

As we progress in our journey with AI, often we find there are opportunities to have AI under our own branding. We're not simply using a consumer tool anymore, we have capabilities that we've white-labeled to the public. And this is where it's important to understand that we carry a higher threshold of responsibility, because the law looks at whose name is on the tool. So if you use a vendor tool as it comes, you're a deployer with the lighter sense of duties. But if you put your own branding on it or change it substantially, you could be treated as the builder with the builder's obligations.

So if you've got a white-labeled guest assistant running under your management brand, give it a proper look. And whenever you're buying an AI tool, ask the vendor two questions. Do your outputs carry machine-readable marking? And have you signed the EU's Transparency Code of Practice? So write the answers down next to your tools list and remember the grace period on marking only covers tools already on the market and it ends on the 2nd of December this year, 2026.

So anything new you adopt carries a duty from day one. For completeness, breaching the transparency obligations carries fines up to 15 million euros or 3% of worldwide turnover, whichever is the higher. Now I'm not giving legal advice. This briefing is for education only, but the businesses that handle this well will simply be the ones that write things down. And when you sit down to do it, it's an afternoon, not a project.

You write down every AI that faces a customer, you check each one says what it is, you put one disclosure line in your templates, your name, sorry, you name your editor and you start the training register, even if the first row is just you. These are things you may not have in place yet and you would not be alone because I've been running a check across this industry. And while the feedback has been quite light so far, in all honesty, every response has said the same two things. No AI training and no AI policy. An area for improvement as my kids' teachers would say.

So there are three approaches depending on where you are. If you're a larger organisation looking for an AI policy and the systems around it, that's the custom side of what Southern Sky AI does. We'll get your AI governance set up properly for your operation, so reach me directly. If you're a smaller organisation and you don't need a custom approach, I've built a system for exactly this reason, and it's called governance essentials. You answer questions about your business, your jurisdictions and your tools, and my system creates your draft AI use policy and registers written for your situation, usually within two business days.

The link will be here on the screen. I'll personally review the output for the first 20 businesses through, so my name and my stamper on it, and a human review is always part of the loop. There's a walkthrough call with me, the training pathway is included with 90 days of team education, and the founding price is $690 US for those first 20 places before it moves to $990, and at the very minimum, if you're not ready for any of that yet, do the baseline. There's no charge, it's 20 questions, it takes about five minutes and it's anonymous, and it'll show you where your opportunities are and which regulations to watch. You'll get the report to keep for your records, and the first row of your training register can be the afternoon you did it.

Thank you for your time, I understand that it's valuable. The next briefing will be on AI governance systems, what one looks like, how you set it up, and it'll come to you the same way this one did, so I'll be in touch again soon.