Europe wants evidence: the AI Act puts transparency into practice

AI transparency is no longer a matter for another day. Article 50 of the EU Artificial Intelligence Act has applied since 2 August 2026. Businesses need to establish which obligations concern them, based on the system, its use and their role as a provider or deployer.

The requirements are tangible, but the timetable is not uniform. The AI Omnibus, in force since 27 July, sets 2 December 2027 as the application date for the rules covering high-risk systems in Annex III, and 2 August 2028 for those linked to products in Annex I. Those deadlines are separate from the transparency obligations already in effect. European Commission's updated timetable.

What transparency requires now

Article 50 distinguishes between roles and uses; it does not impose an indiscriminate labelling requirement on every application of AI. Its requirements include:

1. Disclosing interaction with AI, unless this is obvious under the circumstances covered by the rules.
2. Enabling technical identification of synthetic content. Providers of certain generative systems must support the detection of artificially generated or manipulated outputs through machine-readable marking, subject to the specified exceptions.
3. Disclosing particular uses. Specific duties apply to emotion recognition or biometric categorisation systems, deepfakes and certain texts published to inform the public on matters of public interest. Text that undergoes human review or editorial control, with editorial responsibility, may be exempt from that labelling requirement.

The Commission sets out these cases in its transparency guide. Systems placed on the market before 2 August also have a limited transition until 2 December 2026 for Article 50(2)'s marking and detection duties. This is not a blanket extension. Official frequently asked questions.

Oversight and penalties: defined responsibilities

Enforcement rests primarily with the competent national authorities. The European AI Office acts in specified cases within its remit. Organisations need to explain which system they use, who is responsible for it and how they meet the obligations that apply. Relying on an external technology provider does not answer those questions.

Article 99 provides for fines of up to €15 million or 3% of worldwide annual turnover for infringements such as breaches of Article 50, and up to €35 million or 7% for the prohibited practices in Article 5. The applicable ceiling and actual penalty depend on the circumstances, with specific rules for smaller businesses. Penalties under the AI Act.

Control over the cloud must also be demonstrated

For Triuvo, the business discussion must reach the underlying infrastructure: what information is sent, where it is processed, who can access it and how long it is retained. A European street address alone cannot answer all of those questions.

Equally, a provider's nationality does not automatically make its service unlawful. Where personal data is involved, international transfers require an assessment of the relevant legal mechanism and safeguards, alongside AI Act obligations. These are related frameworks with distinct requirements. European Commission: international data transfers.

Triuvo's approach: sovereignty that can be verified

Triuvo's strategy places control and traceability at the heart of technology design:

• Aquinas Engine™ and formal logic. Work on deterministic inference aims to provide verifiable traces of logical operations, supporting technical audits and review.
• Triuvo Node™ and local deployment. Local processing or private infrastructure is intended to reduce exposure of sensitive information and establish clear operational boundaries.
• Controlled retention and access. Zero-Retention policies and isolation must be configured and verified in the actual environment, including logs, backups and integrations.

These capabilities can support compliance. They do not replace system assessment, documentation or any required human oversight. No architecture confers automatic regulatory immunity.

Through its plans to establish operations in Spain, Triuvo is building a European base for that vision: innovating with control, and backing it with evidence.