Desiree Sainthrope stands at the forefront of the modern legal landscape, serving as a distinguished authority on the intricate intersection of global trade agreements and regulatory compliance. With a career rooted in the meticulous drafting of cross-border frameworks, she has become a vital voice for organizations navigating the tectonic shifts of intellectual property and the rapid ascent of artificial intelligence. Her expertise is particularly relevant today as the European Union unveils its landmark AI Act, a legislative milestone that seeks to balance the breakneck speed of technological innovation with the fundamental need for human transparency and safety. In this conversation, Sainthrope provides a deep dive into the practical realities of the Act’s implementation, the weight of its financial penalties, and the ethical controversies surrounding its delayed rollout for high-risk systems.
The following discussion explores the newly active transparency requirements that compel AI systems to identify themselves to users and the rigorous machine-readable marking standards for synthetic content. We examine the operational hurdles facing companies—including the heavy threat of administrative fines reaching 15 million euros—and the strategic decision by EU lawmakers to postpone high-risk governance until late 2027. The dialogue also touches upon the profound concerns voiced by digital rights advocates regarding vulnerable populations, such as migrants at the border, and the overarching “Brussels effect” that might turn these European standards into a global benchmark for AI governance.
With the recent activation of Article 50, we are seeing a significant shift in how AI systems must present themselves to the public; how do these new transparency layers fundamentally alter the interaction between technology and the everyday user?
This is truly a foundational moment for digital accountability because it forces a level of honesty that has been missing from our online interactions for years. Under Article 50, any AI system designed to interact directly with humans—think of the chatbots you encounter during customer service or the virtual assistants on your phone—is now legally obligated to disclose its non-human nature unless the context makes that blindingly obvious. This isn’t just about a small disclaimer at the bottom of a page; it is about ensuring that a person knows they are engaging with an algorithm rather than a human being. Furthermore, for the creators of “deepfakes” or manipulated media, the Act mandates that synthetic audio, video, and text must be identifiable through machine-readable marking, which is a massive technical undertaking for providers. We are also seeing new protections for biometric data, where systems used to categorize people or detect emotions must explicitly inform individuals that such processing is occurring, creating a sensory awareness of surveillance that simply didn’t exist in the wild west of AI development.
While these rules stop short of a total ban, the administrative fines for non-compliance are quite substantial; what does this mean for the operational strategy of a company that is heavily reliant on third-party AI vendors?
The financial stakes are high enough to capture the attention of any boardroom, with potential fines climbing to 15 million euros or 3 percent of a company’s global annual turnover, whichever represents the larger figure. For most businesses, the immediate impact is less about a transformational shift in their core mission and more about a rigorous, often exhausting, operational audit. They have to comb through their internal processes and customer-facing products to identify exactly where AI is embedded, especially when those tools are sourced from external third-party vendors who may not have built their systems with the EU’s specific transparency requirements in mind. It is no longer enough to simply deploy a clever tool; companies must now ensure that every interaction meets the disclosure threshold to avoid these crippling administrative penalties. This adds a permanent layer of compliance to the product lifecycle, necessitating a shift from “move fast and break things” to a more measured, documented approach to AI integration.
The decision to delay the high-risk governance requirements until December 2027 has sparked intense debate; what was the logic behind this postponement, and how does it relate to the broader economic goals of the European Union?
The postponement of the high-risk obligations—originally intended to apply much sooner—until late 2027 was a strategic, albeit controversial, move intended to balance safety with economic survival. Lawmakers, including Executive Vice President Henna Virkkunen, argued that the technical standards and support tools needed for companies to comply with these demanding rules simply weren’t ready, and forcing them through now would stifle the very innovation the EU hopes to lead. This line of thinking was heavily influenced by Mario Draghi’s 2024 report on European competitiveness, which highlighted how a crushing regulatory burden can hold back growth across the entire economy. By shifting the deadline for systems used in sensitive areas like employment, education, and biometrics, the Commission is essentially providing a three-year “breathing room” for the industry to mature. However, this adjustment is seen by many as a concession to industry lobbying, leaving a vacuum where dedicated risk management and human oversight should have already been established.
Advocacy groups have expressed deep concern that this delay leaves the most vulnerable populations at risk; could you elaborate on the specific dangers identified by critics regarding migration and border management?
The criticism here is sharp and deeply emotional because it involves people in incredibly precarious situations, such as those seeking asylum or navigating the complexities of residence applications. While Annex III of the Act correctly identifies AI used in migration and border control as “high risk,” the 16-month delay in implementing safeguards means these systems will continue to operate without the Act’s strongest oversight mechanisms. Stefi Richani from the Equinox Initiative for Racial Justice has been particularly vocal, arguing that these technologies often carry structural biases that no amount of mere “guideline” can fully fix. There is a very real fear that without immediate requirements for data governance and traceability, automated systems could unlawfully reject asylum claims based on racialized suspicion or personal characteristics. Critics argue that by the time the rules finally take effect in December 2027, irreparable harm may have already been done to individuals who are currently being subjected to opaque, automated decision-making at the borders.
We often hear about the “Brussels effect” in relation to data privacy, but how do you see the EU’s AI Act influencing global standards, particularly when certain deployments fall outside its territorial reach?
The “Brussels effect” is a powerful phenomenon where multinational corporations choose to apply the strictest regulatory standard—in this case, the EU’s—to their global operations rather than maintaining a patchwork of different versions for different markets. We saw this with GDPR, and we are seeing it again as companies prepare their AI disclosure and labeling protocols to meet European standards worldwide to ensure seamless interoperability. However, there is a striking paradox at the heart of this influence: the EU’s strongest protections often stop exactly at its own physical borders. For example, the bloc continues to fund and deploy migration surveillance technology in third countries along transit routes into Europe, and these specific deployments are currently exempt from the AI Act’s reach. This creates a dual reality where the law may set a global benchmark for chatbot transparency, yet fails to provide the same level of protection for people being monitored by EU-funded systems outside of the European continent.
What is your forecast for the evolution of AI compliance as we move toward the final implementation deadlines in 2025 and 2027?
My forecast is that we are entering a period of “regulatory indigestion” where the complexity of the phased rollout will create a significant gap between the leaders in the AI space and the smaller players who cannot afford the legal overhead. By February 2025, we will see the first major wave of enforcement regarding prohibited AI practices and literacy, which will force a massive cleanup of existing algorithms that might be deemed too intrusive or manipulative. However, the true test will be the “shadow period” between now and 2027; I expect to see a surge in litigation and complaints from civil rights groups who will use existing laws like GDPR to fill the void left by the delayed high-risk AI provisions. Ultimately, the success of the Act won’t be measured by the fines collected, but by whether the industry can prove that “innovation without lowering the bar on safety” is a functional reality rather than just a political slogan. We are essentially watching a high-stakes experiment in whether a democratic bloc can successfully leash a technology that moves exponentially faster than the legislative process itself.
