EU AI Act transparency rules explained by Alan Thornton

This ChattingGPT episode covers the EU AI Act transparency rules and what they mean in practice. It is written for directors and operations leaders at engineering, architecture and construction firms in Ireland and the UK.

Host Maryrose Lyons, founder of the AI Institute, speaks to Alan Thornton, founder of Tipcan Solutions. Tipcan is an AI governance platform that acts as a system of record for AI trust across multiple jurisdictions.

^{What is shadow AI and why does it put your firm at risk?}

Shadow AI is AI use inside a company that the business does not know about. Alan Thornton named it as the primary risk: staff putting information that should stay private into AI tools, outside any oversight.

The conversation gave a familiar example of someone finishing extra work at home on a free account. Alan said the risk applies whatever the size of the organisation. It grows when leaders have less visibility of what people are doing with AI.

Shadow AI also sits inside ordinary software. Department heads may use tools with AI built in, such as an HR product that screens CVs. Depending on how the tool is used, that can move a firm into the high-risk category.

High-risk obligations cover decisions about people, with hiring as one example discussed. Alan gave 2 December 2027 as the compliance date. That is time to prepare, but only for leaders who know where AI is already in use.

^{When does AI-assisted content need a label under the EU AI Act?}

AI-generated or AI-supported text needs a transparency label when it is published in the public interest. These Article 50 rules came into force from 2 August. Alan placed them in the limited risk level, which also covers general purpose AI use and deepfake or synthetic media.

The episode drew the line with two examples. A general design blog post written with AI help does not currently need a label, according to Alan. A post praising a local councillor for supporting building initiatives does need one if AI was involved in producing it.

The label must appear at the first point of interaction. That means at the top, alongside the title, with wording such as AI-supported or AI-generated. A note at the bottom of the page does not meet that standard.

Alan tied the labelling question to accountability. As he put it:

'So, the human in the loop piece is fantastic because obviously an AI or an autonomous system can't be accountable for anything.'

Firms can read more in the AI Institute's guide to what the EU AI Act means for construction firms in 2026. The conversation also noted that UK firms whose clients or content reach the EU need to be aware of these rules.

^{Does human oversight exempt your content from the transparency rules?}

Human oversight can exempt AI-assisted text from a transparency label, but only when it is genuine. Alan Thornton said the exemption applies where there is real editorial oversight, or a human willing to take responsibility for the content.

Copying and pasting AI output straight onto a website does not qualify. A marketing lead or director who reviews, edits and signs off a piece is in a different position. The European Commission AI regulatory framework sets out the risk levels and transparency obligations behind this.

The exemption covers text, not images. If graphics are AI-generated, Alan said firms simply need to tell people. A 30-slide deck needs the label on the first slide, and a public website should carry one wherever AI had a heavy hand.

^{How do you inventory your AI use cases for the EU AI Act?}

List each AI tool and use case in a dedicated governance system, with a risk category, a reason for that category and a named owner. Alan described this inventory as the foundation for evidence if a regulator or complainant asks.

He was direct about the tooling:

'So, for example, a Microsoft Excel sheet's not going to work here or a Google Doc is not going to work for this, okay? You're going to need something else and you would input information in relation to that AI use case.'

What each record needs

Each entry should hold the points Alan listed:

• The risk categorisation, such as limited or minimal risk, with an assessment of why that level was chosen.

• A description of what the system is used for, and its purpose.

• A named responsible individual, such as the head of marketing for marketing use cases.

• Dates showing when it was listed, categorised and assigned.

Firms then map the risk and log any transparency labels tied to the use case. Alan said the evidence should be tamper-evident, using methods such as blockchain or cryptographic hashing. For firms that want a heavier standard, he named ISO 42001, the global standard for AI management systems.

Alan's platform, ai-compliance.app, covers the EU, UK, Vietnam, China and Singapore. Maryrose Lyons said the AI Institute is road testing it. It records and organises governance evidence, and it does not replace the human oversight the rules require.

Alan said a first log can be completed in around 60 minutes, but he was clear that governance is ongoing work. Maryrose said the AI Institute adapted its existing agent governance process for transparency in an afternoon. For wider context, see the guide to AI governance for construction firms.

What fines apply under the EU AI Act transparency rules?

The top-level fine for a transparency breach is 15 million euros or 3% of global annual turnover. Alan Thornton explained it this way:

'So, the August 2nd deadline that has passed, that's from a transparency breach perspective, has put a top-level fine of 15 million euros in place or 3% of global annual turnover.'

Alan said the amount depends on how serious the breach is and on the size of the organisation. A separate provision, Article 99 section 5, covers supplying incorrect, misleading or incomplete information to those who request it.

That matters for firms that wait until a request arrives. As Alan put it:

'So when you supply that false information in a panic essentially, the top level fine for that is 7 and 1/2 million euros or 1% of turnover.'

Anyone can complain to the relevant authorities, including a competitor. Alan said he had raised this risk in marketing and advertising, where AI-generated images or video may lack labels.

When does AI use become high risk, and how will Ireland enforce it?

AI use becomes high risk when it affects people's rights, such as screening CVs for hiring. Alan Thornton gave 2 December 2027 as the compliance date, and he said the use, not the tool, sets the category.

His example was an HR team using an enterprise AI assistant to sift CVs. That creates a high-risk use inside the organisation by default. A firm using a third-party product with AI features can also cross over, depending on how it deploys the feature.

High-risk work is more involved than labelling. Alan described these steps:

• A conformity assessment and a quality management system.

• A CE mark for the use case.

• Registration in the EU database of high-risk systems.

• Bias controls, human oversight, and logs that show how any decision was overruled.

National sandboxes are meant to help firms work through these steps alongside the regulator. Alan said they have been pushed back to August 2027, with limited places.

On enforcement, Alan said Ireland has a national AI office, with 15 bodies feeding into it. Examples he gave were the commerce regulator for marketing and the central bank for finance. Spain, by contrast, runs one central office. The conversation raised concerns about budget and AI skills across those bodies, while stressing that businesses with high-risk use cases must comply regardless.

What this means for built environment leaders

Directors and operations leaders at engineering, architecture and construction firms save time and make better decisions when they know where AI is already in use. A clear record replaces guesswork if a regulator, client or competitor asks questions. Human judgement stays at the centre of every step.

• Find out which AI tools staff and departments already use, including software with AI built in, before drafting any policy.

• Label AI-generated or AI-supported content published in the public interest at the top of the page, and name a person who reviews and signs off the text.

• Record each use case in a dedicated governance system with a risk category, a reason, a named owner and dates. Alan Thornton was clear that a spreadsheet or Google Doc will not work.

• Check any AI used in hiring, such as CV screening, against the 2 December 2027 high-risk date.

• Keep records accurate and complete before any request arrives, because supplying false information carries a top-level fine of 7.5 million euros or 1% of turnover.

Firms that want structured support can explore AI adoption for the built environment at the AI Institute.

Want the full conversation? Watch the full episode on Chatting GPT.