The AI rules a Trust & Safety team should know

If your company puts a chatbot in front of users or lets them generate images, AI rules reach your team, even if nobody there calls it AI safety. The work usually lands on whoever already handles the Digital Services Act or the Online Safety Act, on the theory that they clearly enjoy this sort of thing.

This is a summary, not legal advice. Check dates with counsel before you plan around them, because they've already moved once.

The EU AI Act, in order

Here's when each part applies:

• February 2, 2025: a short list of banned practices, such as social scoring and AI that manipulates people in ways that cause them harm.
• August 2, 2025: duties for companies that build general-purpose AI models, such as technical documentation and, for the largest models, risk assessment.
• August 2, 2026: transparency duties under Article 50. That means telling people when they're talking to an AI, marking AI-generated content, and labeling deepfakes.
• December 2, 2027: duties for high-risk AI systems, moved from August 2026 by the AI Omnibus.

Like the Digital Services Act, it reaches companies outside the EU when their AI is used there.

What Article 50 means for a platform

• If people talk to a bot, they have to be told it's a bot, unless that's already obvious.
• Images, audio, video and text made by an AI system have to be marked in a machine-readable way, so they can be detected as AI-made later.
• A company that publishes a deepfake, or AI-written text on a matter of public interest, has to say so, with some exceptions.

The first two land on whoever built the AI feature, and the third on whoever publishes with it. On a platform that's often the same company, so check which role your team is in for each feature.

Keeping up

The rules keep moving as guidance and codes of practice land. The guides below cover the rest of what reaches a Trust & Safety team.