A vote most American creative businesses missed

Here’s what actually happened, and when. On December 9, 2023, negotiators from the European Council and the European Parliament reached a provisional political agreement on the Artificial Intelligence Act after a marathon trilogue process that ran through June, July, September, October, and December of that year (European Parliament). That agreement was a milestone, but it wasn’t law. It was a handshake on the shape of the thing.

The next real step came on February 13, 2024, when the Parliament’s Internal Market and Civil Liberties committees voted 71 to 8, with seven abstentions, to formally endorse the negotiated text (TechCrunch). That’s not a rubber stamp. It’s the committee-level confirmation that clears the path to a full plenary vote, expected in the weeks ahead, followed by final Council endorsement. When that happens, the EU will have the first comprehensive, binding law anywhere built specifically to govern artificial intelligence, not as an amendment to an existing privacy or consumer statute, but as its own standalone framework.

We’re publishing this the same week the committee vote cleared, before the plenary vote has happened and before the Act has a final regulation number. We’re not going to tell you the law has passed. It hasn’t, not yet. What we can tell you, with confidence, is that the direction is set. The vote count made that plain.

“The EU doesn’t need every country to adopt its rules. It just needs enough of the world’s biggest companies to build to them once.”

Why a haus with zero EU offices is paying attention

Some of you reading this run a small studio in Seal Beach. Some of you run a marketing team inside a company that ships product to twelve countries. The reach of this law depends on where you sit, but the honest answer is that it reaches further than most American business owners assume.

If your business works with a client based in the EU, processes the data of EU residents, or ships a product or campaign that touches EU markets, provisions of the Act can apply to you directly, regardless of where your office sits. That’s not a loophole. It’s how the regulation was built, following the same extraterritorial logic that made GDPR a global compliance question in 2018 rather than a European one.

But the direct-applicability question isn’t even the main reason to care. The bigger reason is what this law signals about where AI governance is headed everywhere, including here.

The Brussels effect: how one region’s rulebook becomes everyone’s rulebook

There’s a term for what’s about to happen, and it didn’t originate with us. Legal scholar Anu Bradford named it the "Brussels effect" in her 2020 book of the same title: the pattern where EU regulation becomes the de facto global standard, not because other governments adopt it, but because global companies find it cheaper to build one compliant version of a product than to build fifty (Bradford). GDPR is the textbook case. Most American companies didn’t wait for a US privacy law. They rebuilt their consent flows, their data policies, and their cookie banners to EU standards because maintaining two separate systems cost more than compliance did.

AI governance is on the same track. A creative business that never signs a single EU client can still feel the downstream effect when the platforms, tools, and ad networks it depends on rebuild their defaults to satisfy the strictest market they serve. When Meta, Google, and Adobe adjust how their AI tools handle disclosure, training data, and content labeling to satisfy EU requirements, those adjustments tend to ship everywhere, not just to European accounts. The standard doesn’t stay in Brussels. It rides the product.

What the Act actually asks for, in plain language

Strip away the legal architecture and the AI Act sorts artificial intelligence into risk tiers. Practices considered an unacceptable risk, like manipulative systems designed to exploit vulnerabilities or indiscriminate biometric scraping, get banned outright. High-risk uses, the kind that touch hiring, credit, law enforcement, or critical infrastructure, face documentation, human oversight, and risk-management requirements before they can ship. Limited-risk systems carry a transparency obligation: tell people when they’re talking to a chatbot, and label content that’s been AI-generated or manipulated. Everything else, the low-stakes tools most of us already use daily, stays largely unregulated.

That third tier is the one creative businesses should read twice. Disclosure and labeling requirements for AI-generated content aren’t a side clause. They’re a direct line to how agencies, studios, and in-house teams produce work. A brand running AI-generated visuals, AI-assisted copy, or synthetic voiceover into EU markets is going to need to say so, plainly, where the audience can see it.

What it signals for disclosure, everywhere

We’ve said this before, in this Journal and inside our own practice: the tool was never the problem. Misrepresenting how the work got made is the problem. That’s not a legal position we adopted because Brussels told us to. It’s the standard we set for ourselves before this law existed. What the AI Act does is take a principle we already hold and turn it into a compliance requirement for a continent’s worth of business, which tends to be how ethical defaults become industry defaults.

“The Act takes a principle conscientious creative businesses already hold and turns it into a compliance requirement. That’s how ethical defaults become industry defaults.”

We credit our work "Crafted by HAUS XXIV. Human-led, AI-assisted." on client-facing pieces, not because a regulator required it, but because the reader deserves to know how the work was built. Watching the EU write that same instinct into binding law tells us the market is catching up to where the honest end of the industry already stood. For regulated, education, and nonprofit clients especially, this is worth sitting with. The conviction behind disclosure doesn’t change. The volume of how loudly we perform it should stay measured, human, and specific rather than defensive or alarmist.

The build ahead

The timeline from here matters as much as the vote did. If the plenary and Council steps clear as expected, the Act’s first binding provisions, the outright bans on unacceptable-risk practices, would take effect roughly six months after formal entry into force, with the fuller framework phasing in across the following years, into 2027 (TechCrunch; Pinsent Masons). That’s a long runway. It’s also a short one, if your business hasn’t started asking how it discloses AI involvement in its own work.

We’re not waiting for a mandate to keep doing what we already do. Long before any regulator asked, we built our AI disclosure line into how we present client work, because the standard we hold ourselves to was never going to be the minimum one. That’s the whole point of building bold instead of building safe. The defiant don’t need a law to tell them the truth is owed. But it’s worth noticing when the rest of the world starts writing it down.