The rules that travel

A clause adopted in Brussels three years ago will decide, this August, whether the text a chatbot writes for a reader in Jakarta carries an invisible mark saying a machine made it. Nobody in Jakarta voted on this. Nobody there has to. The clause is Article 50 of the EU AI Act, its transparency obligations apply from 2 August 2026, and it binds the company running the model even if that company has never opened an office in Europe. Europe rarely builds the model. It writes the terms on which the model is allowed to reach Europeans — and because no one ships a separate product per market, those terms tend to become the default everywhere.

This is the mechanism Anu Bradford named the Brussels Effect: a single large market with a credible regulator and a non-divisible product exports its rules without exporting a single soldier or a single dollar of aid. GDPR did it to privacy. The AI Act is now doing it to disclosure. The interesting question, as ever, is not whether the rule is in force — it is, on a published timetable — but who it binds, what the operative clause actually requires, and when it bites.

What the text actually says

The reported version of Article 50 is "the EU is making AI label itself." The binding version is narrower and more interesting. The article sets out four distinct transparency duties, and it is precise about which actor each one lands on.

1. Providers of any system that interacts directly with people must design it so a reasonably informed user knows they are talking to an AI — unless that is already obvious.
2. Providers of generative systems must ensure their outputs — text, image, audio, video — are marked in a machine-readable format and detectable as artificially generated, with a carve-out for assistive functions like grammar correction.
3. Deployers using emotion-recognition or biometric-categorisation systems must inform the people exposed to them.
4. Deployers must disclose deepfakes, and disclose AI-generated text published to inform the public on matters of public interest — unless a human took editorial responsibility for it.

Note where the obligations split. The duty to mark outputs at the source falls on the provider — the company that built and shipped the model. The duty to disclose at the point of publication falls on the deployer — the newsroom, the agency, the platform that uses it. That division matters, because it means the heaviest engineering burden lands on a handful of frontier labs, and it is precisely those companies that build one product for the planet.

In force is not enforced

The AI Act has been technically in force since August 2024. Most of it does nothing yet. The statute is built as a sequence of staggered application dates, and the only ones that matter are the ones that switch obligations from dormant to live. For the rules on general-purpose AI models, the obligations became applicable on 2 August 2025 — but the Commission's power to actually enforce them, to demand information, inspect a model or levy a fine, only switches on 2 August 2026. Article 50's transparency duties share that August 2026 date. The penalty ceiling for the model-provider obligations is up to 3% of global annual turnover or 15 million euros, whichever is higher.

The useful question is never whether a rule is in force — it usually is, quietly. It is who is in scope, and what the operative clause requires them to do, by when.

So the honest description of this summer is not "the AI Act takes effect." It is that the grace period ends. The duties have been written, read and lobbied over for a year; what changes on 2 August is that the AI Office acquires teeth. Compliance teams have known the date for years. The date, not the rule, is the load-bearing fact.

Why a third-country firm is in scope

The reason this becomes a global rule rather than a European one is buried in Article 2, the scope clause, and it is worth quoting the operative idea rather than the summary. The Act binds providers placing systems on the EU market irrespective of whether they are established in the Union or in a third country; it binds deployers located in the Union; and — this is the load-bearing limb — it binds providers and deployers located in a third country where the output produced by the system is used in the Union.

Read that last clause slowly, because it is the whole game. Jurisdiction does not follow the company. It follows the output. A model trained in California and hosted in Virginia is in scope the moment its text or image is used by someone in Lisbon. There is no European subsidiary to point at, no server to relocate. The trigger is consumption inside the Union, and a company that serves a global web cannot reliably keep its output out of twenty-seven member states. This is the same output-based, market-location logic that made GDPR inescapable; the AI Act has simply applied it to a different kind of artefact.

One product, every market

Extraterritorial reach on paper would mean little if firms could cheaply build a compliant European edition and a free-wheeling rest-of-world edition. The Brussels Effect works because, for the systems Article 50 targets, they mostly can't — or won't. Marking generative output as machine-detectable is not a regional setting you toggle at the border; it is a property baked into how the model emits content. Building one pipeline that marks everything is simpler and cheaper than maintaining a marked European fork and an unmarked global one, and far less embarrassing to explain. So the European requirement quietly becomes the global behaviour.

You can already watch this happening in the choice of standard. Article 50 describes its marking requirement only in functional terms — machine-readable, interoperable, robust, reliable — and leaves the technology to standards bodies and the Commission's draft transparency code. That code points at C2PA Content Credentials, the cryptographic provenance standard already shipped by Adobe, OpenAI and Google, as an example that meets all four criteria. A standard adopted to satisfy a European clause is on its way to becoming the format your camera and your image editor speak by default. That is the Brussels Effect at the level of plumbing: not a law copied abroad, but an engineering decision made once, for everyone, to clear a European bar.

The de jure version is visible too. The provision sits alongside a voluntary General-Purpose AI Code of Practice that most frontier labs have signed, and legislators in Colorado, Brazil, Canada and Singapore are drafting AI rules that borrow the EU's structure. The point of the Brussels Effect was never that everyone admires Brussels. It is that complying once is cheaper than litigating the difference between markets.

The hole where liability should be

It would be tidy to claim Europe exports everything it writes. It doesn't, and the cautionary case is instructive. The Commission also proposed an AI Liability Directive — rules on who pays when an AI system causes harm. That proposal is now dead. The Commission confirmed its withdrawal through 2025, the notice landing in the Official Journal on 6 October, citing no foreseeable agreement among member states. The Act that disciplines how a system must behave travels the world; the rule that would have decided who compensates you when it misbehaves never made it out of committee.

The contrast tells you what actually travels and what doesn't. A transparency obligation attaches to a product feature, ships inside a global model, and exports itself. A liability regime attaches to twenty-seven national tort systems, satisfies no one, and dies at home. The Brussels Effect is not a general law of European influence. It is specific to rules that bind a non-divisible product — and Article 50 is exactly that kind of rule, while liability was exactly the kind that isn't.

What to watch before August

The summaries will say the AI Act "takes effect" this summer. The text says something narrower and more durable: that on 2 August 2026 the AI Office can begin enforcing transparency duties that bind anyone whose output reaches a European, that the marking burden falls on the model-makers who build one product for the world, and that the format chosen to satisfy a Brussels clause is becoming the global default for proving what a machine made. Watch the standard, not the speeches. The clause was written in a committee room three years ago. The rest of us are about to live inside it, whether or not we ever read it.