The EU AI Act was not postponed as a whole. Article 50 transparency obligations apply from 2 August 2026. A limited transition for providers of certain existing synthetic-content systems ends on 2 December 2026. The main rules for Annex III high-risk AI systems now apply from 2 December 2027, while the rules for high-risk AI embedded in regulated products under Annex I apply from 2 August 2028. These dates reflect Regulation (EU) 2026/1744, which amended the original timetable. This guide explains who is affected by each deadline and what organisations should do next.

By Dzhamal Statsenko, lawyer and AI governance consultant based in the Netherlands | Last reviewed: 29 July 2026

The most common mistake is to assume that the entire AI Act was postponed. It was not. The organisations receiving the most additional time are providers and deployers of high-risk AI systems. Ordinary businesses using chatbots or publishing synthetic content may still face transparency duties from 2 August 2026.

This article gives a practical EU AI Act timeline for companies, deployers, providers, professional users of AI tools, publishers, NGOs, media organisations and other organisations operating in or affecting the EU market.

Table of Contents:

▫️ EU AI Act Deadlines at a Glance
▫️ What Regulation (EU) 2026/1744 Delayed—and What It Did Not
▫️ What Applies in 2026
▫️ What Applies in 2027
▫️ What Applies in 2028
▫️ Which Deadline Applies to Your Organisation?
▫️ Rules Already Applicable|
▫️ Special Transition Rules for Existing Systems
▫️ Practical Takeaway
▫️ Frequently Asked Questions
▫️ Official Sources and Disclaimer

🟩 EU AI Act Deadlines at a Glance

• 2 August 2026: Article 50 transparency obligations and most remaining AI Act provisions apply.

• 2 December 2026: the limited Article 50(2) transition ends for certain existing synthetic-content systems, and additional prohibited practices apply.

• 2 August 2027: providers of older GPAI models must complete compliance with applicable GPAI obligations; Member States must have AI regulatory sandboxes operational.

• 2 December 2027: principal requirements for high-risk AI systems classified under Article 6(2) and Annex III apply.

• 2 August 2028: principal requirements for high-risk AI systems classified under Article 6(1) and Annex I apply.

🟩 What Regulation (EU) 2026/1744 Delayed—and What It Did Not

Article 50 transparency duties generally: not generally delayed. They apply from 2 August 2026, including transparency requirements for certain AI interactions, emotion-recognition and biometric-categorisation systems, deepfakes, and certain AI-generated public-interest texts.

Article 50(2) limited grace period: Providers of synthetic-content systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking and detection obligation.

Annex III high-risk AI: the main requirements now apply from 2 December 2027.

Annex I high-risk AI in regulated products: the main requirements now apply from 2 August 2028.

Regulatory sandboxes: Member States must have AI regulatory sandboxes operational by 2 August 2027.

New prohibitions: additional prohibited AI practices concerning non-consensual intimate material and child sexual abuse material apply from 2 December 2026.

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amended the original AI Act timetable rather than replacing the AI Act as a whole.

🟩 What Applies in 2026

🗓 2 August 2026: Transparency Rules Still Apply

For many organisations, 2 August 2026 remains the most important practical compliance date. The AI Act did not move all transparency obligations to 2027 or 2028.

Article 50 applies to specific transparency situations. These include informing people when they interact with an AI system, disclosing certain emotion-recognition and biometric-categorisation systems, labelling deepfakes, and disclosing certain AI-generated or AI-manipulated public-interest texts. The European Commission explains the provider and deployer distinction in its Article 50 transparency FAQ.

Article 50 does not mean that every AI-assisted email, design, illustration or internal draft needs a visible label. The question is what the system does, what content is produced, whether the content could falsely appear authentic or truthful, and whether the organisation is acting as provider or deployer.

For a deeper treatment of labels, deepfakes, watermarking and fines, see my detailed guide to EU AI Act Article 50 transparency rules.

🗓 2 December 2026: Limited Article 50 Transition and New Prohibitions

The 2 December 2026 date is often misunderstood. It is not a general postponement of Article 50 and it does not move every transparency duty to December.

Providers of synthetic-content systems placed on the market before 2 August 2026 must comply with the machine-readable marking and detection obligation under Article 50(2) by 2 December 2026. This limited transition is different from deployer disclosure duties for deepfakes and other transparency obligations that apply from 2 August 2026.

Regulation (EU) 2026/1744 also introduces additional prohibited AI practices concerning non-consensual intimate material and child sexual abuse material that start to apply from 2 December 2026.

🟩 What Applies in 2027

🗓 2 August 2027: Older GPAI Models and Regulatory Sandboxes

Providers of general-purpose AI models placed on the market before 2 August 2025 must comply with applicable GPAI obligations by 2 August 2027 under Article 111 transitional rules.

This date matters mainly for providers of GPAI models, not for ordinary companies that simply use AI tools. Businesses using GPAI-powered services should still ask vendors how they are handling documentation, transparency, copyright-policy and systemic-risk obligations where relevant.

Member States also have until 2 August 2027 to ensure that national AI regulatory sandboxes are operational under Article 57 on AI regulatory sandboxes.

🗓 2 December 2027: Annex III High-Risk AI

The main requirements for high-risk AI systems classified under Article 6(2) and Annex III now apply from 2 December 2027 under the amended Article 113 application timetable.

This category can affect AI systems used in areas such as employment, worker management, education, creditworthiness, access to essential services, law enforcement, migration, border control, administration of justice and democratic processes.

For employers, banks, schools, public authorities and HR technology providers, the extra time should not be treated as a reason to wait. Annex III systems require classification, risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity.

🟩 What Applies in 2028

The main requirements for high-risk AI systems classified under Article 6(1) and Annex I now apply from 2 August 2028 under the amended Article 113 application timetable.

This concerns certain high-risk AI systems embedded in regulated products or performing safety functions, including certain medical devices, in-vitro diagnostic devices, lifts, toys and radio equipment covered by the Union product-safety legislation listed in Annex I.

Separate sector-specific arrangements may apply to machinery, aviation and motor vehicles.

The later date recognises that these systems interact with sector-specific conformity assessment and product-safety regimes. Manufacturers should still map AI components early because product development and certification cycles can be long.

🟩 Which Deadline Applies to Your Organisation?

🟢 Small businesses, creators and marketing teams

Main practical date: 2 August 2026. A small business may be directly affected if it provides an interactive AI system under its own name or trademark, or acts as a professional deployer using emotion recognition, biometric categorisation, deepfake content or unreviewed AI-generated public-interest texts. Merely using an off-the-shelf AI tool does not automatically make the business responsible for every Article 50 obligation.

It is still sensible to check whether a chatbot installed on a company website informs users that they are interacting with AI, and whether the vendor has designed the system to support the provider-side obligations.

Ordinary AI-assisted advertising copy or clearly fictional illustrations do not automatically require an AI label.

For nonprofit organisations, the same role-based analysis matters; see my separate guide to AI compliance for NGOs.

🟢 Providers of existing generative AI systems

Main date: 2 December 2026. This concerns providers of systems placed on the market before 2 August 2026 that generate synthetic audio, images, video or text. They receive a limited transition period for the technical marking and detection obligation under Article 50(2).

🟢 Providers of older GPAI models

Main date: 2 August 2027. Providers of general-purpose AI models placed on the market before 2 August 2025 must complete compliance with the applicable GPAI obligations.

🟢 Employers, banks, schools and public authorities

Main date: 2 December 2027. This may apply when AI influences recruitment, employment, education, creditworthiness, insurance, public benefits, migration, law enforcement or justice.

🟢 Manufacturers of regulated products

Main date: 2 August 2028. This concerns certain high-risk AI systems embedded in medical devices and other regulated products or performing a safety function.

🟩 Rules Already Applicable

The EU AI Act entered into force on 1 August 2024. Its obligations apply progressively.

Since 2 February 2025, prohibited AI practices and AI literacy requirements have applied. Under the amended Article 4 on AI literacy, providers and deployers must take measures to support the development of AI literacy among staff and other persons operating or using AI systems on their behalf, taking account of their knowledge, experience and the context of use.

AI literacy also matters for workplace governance. Employees cannot follow an AI policy they do not understand; for workplace AI risks, see my article on shadow AI and employee use of ChatGPT.

Since 2 August 2025, GPAI obligations have applied for providers of general-purpose AI models placed on the market from that date, with transitional rules for older models.

🟩 Special Transition Rules for Existing Systems

Existing high-risk AI systems: High-risk AI systems placed on the market or put into service before the relevant Chapter III application date are generally subject to the high-risk requirements only if they undergo significant changes in their design from that date.

High-risk AI for public authorities: Providers and deployers of high-risk AI systems intended to be used by public authorities must comply by 2 August 2030.

Large-scale EU IT systems: Certain AI components of the large-scale information systems listed in Annex X that were placed on the market or put into service before 2 August 2027 must comply by 31 December 2030.

Older GPAI models: GPAI models placed on the market before 2 August 2025 must comply with the applicable GPAI obligations by 2 August 2027.

These special transition rules are set out in Article 111.

🟩 Practical Takeaway

The EU AI Act timeline is now more nuanced than a simple August 2026 deadline. Transparency duties still matter in 2026. Older GPAI models and national sandboxes matter in 2027. Annex III high-risk AI systems now move to December 2027. High-risk AI in regulated products moves to August 2028.

The best next step is to build an AI inventory and classify each AI system by role, risk category, function, deployment context and deadline. For a broader implementation roadmap, use the practical EU AI Act checklist for companies.

Not sure which EU AI Act deadline applies to your organisation? I help companies, NGOs, media teams and professionals map their AI use, identify their legal role and build practical AI governance rules before the relevant deadline.

💬 Frequently Asked Questions

❔Did the EU AI Act start on 2 August 2026

No. The EU AI Act entered into force on 1 August 2024. Most of its remaining applicable provisions begin to apply from 2 August 2026, subject to specific transitional periods.

❔Was the EU AI Act delayed

Only partially. Article 50 transparency rules remain applicable from 2 August 2026. The principal requirements for Annex III high-risk systems were moved to 2 December 2027, while the rules for high-risk AI embedded in regulated products were moved to 2 August 2028.

❔What changes on 2 December 2026

A limited transition for providers of certain existing synthetic-content systems ends, and new prohibited AI practices concerning non-consensual intimate content and child sexual abuse material begin to apply.

❔Who has until 2 December 2027

Providers and deployers of Annex III high-risk AI systems, including certain systems used in employment, education, credit assessment, public services, migration, law enforcement and justice.

❔Do small businesses need to comply from 2 August 2026

Potentially, yes, but the answer depends on role and use case. A small business may be directly affected if it provides an interactive AI system under its own name or trademark, or acts as a professional deployer using emotion recognition, biometric categorisation, deepfake content or unreviewed AI-generated public-interest texts. Merely using an off-the-shelf AI tool does not automatically make the business responsible for every Article 50 obligation.

❔Must every AI-generated image be labelled

No. The AI Act does not impose a universal visible-label requirement on every AI-generated image. However, providers of generative AI systems may have to embed machine-readable markings under Article 50(2). Businesses and other deployers must provide a human-visible disclosure principally where the content qualifies as a deepfake and could falsely appear authentic or truthful.

❔When do high-risk AI rules apply

High-risk AI systems classified under Article 6(2) and Annex III apply from 2 December 2027. High-risk AI systems classified under Article 6(1) and Annex I apply from 2 August 2028.

🟩 Official Sources and Disclaimer

• Regulation (EU) 2024/1689 — the original EU AI Act.

• Regulation (EU) 2026/1744 — the Digital Omnibus on AI amendments.

• European Commission AI Act implementation timeline.

• European Commission Article 50 transparency FAQ.

• Article 111 transitional rules for existing systems and GPAI models.

• Article 113 entry into force and application timetable.

• Article 57 AI regulatory sandboxes.

This timeline is based on Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, the European Commission’s AI Act Service Desk and the Commission’s Article 50 guidance. It was last reviewed on 29 July 2026.

This article provides general information and does not constitute legal advice. The classification of an AI system and the applicable deadline depend on its intended purpose, functionality, deployment context and the role of the organisation involved.

Subscribe to Lawyer Against The Machine for practical analysis of AI regulation, compliance and digital risk in Europe.

I will continue writing about this in plain language
See you in the next piece

Cheers,

By Dzhamal Statsenko, lawyer and AI governance consultant based in the Netherlands | Last reviewed: 17 July 2026

An employee receives a 40-page contract from a supplier.

Instead of spending several hours reviewing it, the employee uploads the contract to ChatGPT and asks the tool to summarise the agreement, identify risky clauses and draft an email to the supplier.

👨‍💼 From the employee’s perspective, this is not a security incident. It is productivity.

🏢 From the company’s perspective, something more important may have happened: confidential information may have been sent to an external AI provider through a personal account, without approval, without a security assessment and without anyone knowing how the document will be stored, processed or deleted. That is shadow AI in its most practical form: ordinary employees using useful AI tools outside the organisation’s visibility and control.

The contract does not automatically become public. But the employee may still have transferred personal, confidential or legally protected information to an external service without authorisation.

The problem is not simply that employees are using ChatGPT. The problem is that companies often have no visibility, no rules and no safe workflow.

🟩 Key Takeaways

▫️ Uploading a company document to ChatGPT does not automatically make it public, but it may still create an unauthorised external data transfer

▫️ Turning off model training does not automatically make the upload authorised, lawful or consistent with an NDA

▫️ Consumer ChatGPT and organisation-managed business products have materially different controls, but neither removes the need for internal approval

▫️ Contracts and work documents may contain personal data, trade secrets, privileged communications, commercial terms and information protected by confidentiality clauses

▫️ A practical AI usage policy should approve four things before company information enters an AI system: the tool | the account | the data | the task

Table of Contents:

▫️ What Is Shadow AI?
▫️ Why Employees Upload Work Documents to ChatGPT
▫️ The Four Approvals Rule
▫️ What Happens to Confidential Information Uploaded to ChatGPT?
▫️ Consumer ChatGPT vs Business Products
▫️ AI Data Security Is Not Just About Model Training
▫️ Contracts, NDAs, Trade Secrets, GDPR and Legal Privilege
▫️ What to Do If an Employee Has Already Uploaded a Contract
▫️ Can Employees Use ChatGPT for Company Data?
▫️ What Companies Should Ban or Restrict
▫️ How to Create an AI Usage Policy for Employees
▫️ AI Literacy Under the EU AI Act
▫️ Practical Shadow AI Checklist for Employers
▫️ Frequently Asked Questions
▫️ Conclusion

🟩 What Is Shadow AI?

Shadow AI is the use of AI systems inside an organisation without formal approval, security review or effective oversight.

It can include an employee using a personal ChatGPT account to analyse a contract, a manager uploading an HR spreadsheet to an AI assistant, a developer copying proprietary source code into a coding model, or a team connecting an AI application to company email or cloud storage without approval.

Shadow AI is similar to shadow IT, but it can be harder to see. A conventional unapproved application may store a file. A generative AI tool may analyse the file, extract information from it, combine it with prompts, produce new content and make the result easy to copy into other systems.

The employee may believe they are only asking a question. The company may actually be creating a new data flow.

SHRM’s 2026 workplace AI research found that 46% of workers believed their organisation’s AI policies prevented them from experimenting with tools that could improve their work, and 30% said they had knowingly violated organisational AI rules. Reported violations included using tools still under review, using unapproved accounts and uploading confidential organisational data to unapproved systems. See SHRM’s 2026 workplace AI research.

This is why shadow AI should not be treated only as employee misconduct. Employees often use unapproved AI because it solves a real problem faster than the official workflow.

🟩 Why Employees Upload Work Documents to ChatGPT

Employees using ChatGPT at work are not necessarily trying to evade security controls. They may be trying to summarise a long document, translate a contract, compare two versions of an agreement, restructure a report, draft a response to a client or understand a difficult clause.

The immediate benefit is visible. The information-security consequence is not.

A seemingly ordinary document may contain customer names, employee information, signatures, bank details, negotiated prices, internal comments, source code, litigation strategy, legal advice, passwords, API credentials or trade secrets.

🔺The employee sees a document
🔺The security team sees a data transfer
🔺The privacy team sees a new processing activity
🔺The lawyer sees confidentiality, privilege and contractual obligations

That difference in perspective is the centre of the shadow AI problem.

🟩 The Four Approvals Rule

Before an employee uploads company information to an AI system, the organisation should be able to confirm four things.

1️⃣ Approved Tool

The company has reviewed the AI provider, contractual terms, security measures, retention practices, subprocessors and relevant privacy controls.

Practical question: Has this specific AI tool been approved for this category of company information?

2️⃣ Approved Account

The employee is using the correct organisation-managed account rather than a personal account, where company policy requires one.

Practical question: Is the employee using an account controlled by the organisation, with the right administrative settings and auditability?

3️⃣ Approved Data

The information falls within a category that the company permits the AI system to process. Restricted information has been removed, anonymised or moved to a specially approved environment.

Practical question: Does the document contain personal data, confidential terms, privileged material, trade secrets or information restricted by an NDA?

4️⃣ Approved Task

The purpose is permitted, proportionate and subject to appropriate human review. The employee is not delegating an important legal, financial, employment or customer decision to an AI system without oversight.

Practical question: Is the AI being used for a permitted support task, or is it being asked to make or replace a decision that requires professional responsibility?

Approved tool. Approved account. Approved data. Approved task.

If one answer is “no” or “unknown”, stop and escalate the proposed use before company information is uploaded.

The value of this rule is that it works for non-lawyers. Employees do not need to analyse every clause of the GDPR or every vendor term. They need a simple checkpoint that tells them when to pause and ask Legal, Privacy, Security or management before using AI.

🟩 What Happens to Confidential Information Uploaded to ChatGPT?

A document uploaded to ChatGPT does not automatically become public. It is also inaccurate to claim that every uploaded document is automatically incorporated into a model and shown to other users.

The correct answer depends on the product, account type, data controls, retention settings, whether Temporary Chat is used, whether memory is active, whether apps or GPTs are involved and whether the conversation or project is shared.

OpenAI states that content submitted through consumer services may be used to improve its models depending on the user’s settings. Users can switch off the relevant training control, after which new conversations will not be used to improve the models. See OpenAI’s consumer data usage guidance.

Normal chats may remain saved in the account until the user deletes them. Deleted chats and associated files are generally scheduled for deletion from OpenAI systems within 30 days, subject to exceptions such as legal, security or prior de-identification requirements. See OpenAI’s chat and file retention policy.

Temporary Chats do not appear in chat history and are not used to improve OpenAI’s models. OpenAI may nevertheless retain a copy for a limited safety period. See OpenAI’s Temporary Chat guidance.

🟩 Consumer ChatGPT vs Business Products

One of the most important ChatGPT data privacy distinctions is the difference between consumer services and organisation-managed business products.

OpenAI states that it does not use inputs and outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu and the API to train its models by default. See OpenAI’s business data privacy commitments.

That makes an organisation-managed workspace materially different from an employee independently using a personal account.

However, a safer account is not the same as an approved use case.

Even in a business environment, an organisation must still decide which employees may use the system, which documents may be uploaded, whether personal data is permitted, when Legal, Privacy or Security approval is required, and which outputs require human review.

🟩 AI Data Security Is Not Just About Model Training

Discussions about ChatGPT data privacy often focus on one question: will the provider train a model on this document?

That is important, but it is only one part of AI data security.

A complete assessment should also ask where the document is stored, for how long, who controls the account, whether the conversation can be shared, whether administrators can access or delete it, whether external apps are enabled, whether the company can obtain audit information and what happens when the employee leaves.

The legal and security risks include unauthorised disclosure, excessive retention, insufficient vendor due diligence, insecure integrations, weak access controls, loss of an audit trail and unclear responsibility.

A generative AI data leakage strategy must therefore cover the entire data lifecycle, not only model training.

🟩 Contracts, NDAs, Trade Secrets, GDPR and Legal Privilege

Using ChatGPT for contracts can be useful. An AI tool may help an employee summarise obligations, compare drafts, extract deadlines, prepare questions for a lawyer or rewrite a clause in clearer language.

But the legal risk may begin before the system produces its first answer.

🟢 Contractual Confidentiality and NDAs

A company may have promised that certain information will be disclosed only to employees, professional advisers or authorised service providers. Uploading that information to an unapproved AI service may fall outside the permitted categories.

Whether the disclosure breaches a particular contract depends on the wording of the confidentiality clause, the nature of the information, the AI provider’s contractual role, the account configuration and the safeguards in place.

An employee cannot assume that a disclosure is permitted merely because the recipient is software rather than a human being

🟢 Trade Secrets

Under the EU trade-secret framework, information generally qualifies as a trade secret where it is secret, has commercial value because it is secret and has been subject to reasonable steps to keep it secret. See the EU Trade Secrets Directive.

One accidental upload does not automatically destroy trade-secret protection.

However, a pattern of uncontrolled disclosure could make it more difficult for a company to demonstrate that it consistently took reasonable steps to preserve secrecy

🟢 GDPR and Personal Data

In Europe, uploading a company document to an AI service may involve the processing of personal data. Personal data can appear in employment contracts, invoices, customer complaints, internal investigations, CVs, signed documents, emails and spreadsheets.

The GDPR requires personal data to be processed lawfully, fairly and transparently, limited to what is necessary and protected through appropriate technical and organisational measures. It also establishes requirements concerning processors, security and high-risk processing. See the General Data Protection Regulation.

An unauthorised upload may constitute a personal data breach depending on the facts

Reportability requires a separate risk assessment, including what data was uploaded, who could access it, what safeguards applied and what consequences may follow for individuals.

🟢 Legal Privilege and Professional Confidentiality

The position becomes particularly sensitive when employees upload legal advice, correspondence with lawyers, litigation documents, investigation reports, settlement strategy or materials prepared in anticipation of proceedings.

Disclosure to an external AI system may create an argument that confidentiality or privilege has been compromised. It would be too broad, however, to say that every use of AI automatically waives privilege

Recent US federal decisions have reached different conclusions concerning privilege and generative AI. The American Bar Association describes this as a developing and fact-specific area. See the American Bar Association analysis of AI and privilege.

ABA Formal Opinion 512 also emphasises that lawyers using generative AI remain responsible for competence, confidentiality, communication and supervision. See ABA Formal Opinion 512.

The privilege discussion above primarily concerns the United States. Legal professional privilege and professional secrecy differ across European jurisdictions.

🟩 What to Do If an Employee Has Already Uploaded a Contract

Do not begin by assuming that the contract is now public. Do not delete every record before understanding what happened. Start with a structured assessment.

Step 1: Establish the Facts

Identify which AI service was used, whether the account was personal or company-managed, what document or text was uploaded, which prompts were entered, whether the conversation was shared, whether outputs were copied and whether external apps or connectors were enabled.

Step 2: Classify the Information

Check whether the material contained personal data, customer information, privileged communications, trade secrets, credentials, confidential pricing, intellectual property, NDA-restricted information or regulated financial, medical or employment information.

Step 3: Preserve Relevant Evidence

Before deleting the conversation, preserve the information necessary to investigate the incident, where legally and operationally appropriate. This may include screenshots, timestamps, prompts, outputs, account information, file names, sharing settings and relevant logs.

Step 4: Contain the Incident

Depending on the circumstances, the company may need to delete the conversation or file, revoke a shared link, disconnect an integration, reset exposed credentials, restrict the account, contact the provider or suspend the affected workflow.

Step 5: Assess Legal Obligations

Legal, Privacy and Security teams should assess whether company policy was breached, whether an NDA or contract was violated, whether privilege may have been affected, whether trade-secret remediation is necessary and whether the event qualifies as a personal data breach.

Step 6: Fix the Workflow

The final question should be: why did the employee need to use an unapproved tool?

Perhaps there was no approved AI environment. Perhaps the policy was too vague. Perhaps the authorised tool did not perform the task. Perhaps employees were never trained.

Disciplining one employee will not solve a structural problem if the workflow remains broken.

A useful post-incident review should therefore ask whether the employee had a safe alternative. If the official process takes two weeks and the unapproved tool gives a useful first draft in one minute, the organisation should expect repeated policy breaches unless it fixes the workflow.

🟩 Can Employees Use ChatGPT for Company Data?

Yes, in appropriate circumstances.

The answer should not be a universal ban or unrestricted permission. Employees should use ChatGPT for company data only where the Four Approvals Rule is satisfied.

Low-risk examples may include summarising public information, rewriting approved marketing content, brainstorming with synthetic data, translating non-confidential text or restructuring a public job advertisement.

Higher-risk examples may require a business environment and additional approval: internal policies, commercial contracts, customer correspondence, operational reports and internal presentations.

For many teams, the practical compromise is a redaction workflow. Before a document is uploaded, employees remove names, signatures, pricing, unique identifiers, privileged comments and other details that are not necessary for the task.

Redaction is not a magic solution, but it can reduce risk where the organisation has approved the tool and the use case

🟩 What Companies Should Ban or Restrict

A useful AI usage policy for employees should not simply say: “Do not share confidential information.” That is too vague.

A practical policy should classify data.

✅ Green: Generally Permitted in Approved Tools

Public information, approved marketing materials, synthetic data, public job advertisements and non-confidential templates.

⚠️ Amber: Restricted to Approved Business Environments

Internal procedures, draft presentations, routine commercial correspondence, low-risk operational reports and contracts that have been reviewed and appropriately redacted.

🚨 Red: Prohibited Without Specific Authorisation

Passwords, credentials, API keys, health data, special-category personal data, privileged legal advice, litigation materials, M&A documents, unreleased financial results, trade secrets, protected source code, customer databases, security architecture and information restricted by an NDA.

🟩 How to Create an AI Usage Policy for Employees

An effective AI usage policy should make safe behaviour easier. It should not exist only to punish mistakes after they occur.

At minimum, it should define the AI systems covered, list approved tools and accounts, explain data classifications, describe permitted and prohibited uses, set rules for personal data, require human verification, address records and retention, control integrations and define incident-reporting steps.

The policy should also explain how employees can request approval for a new AI use case. Without a realistic approval route, people may treat the policy as a wall rather than a governance system.

Human oversight is especially important where AI supports legal conclusions, financial analysis, employee decisions, customer communication or public-facing content. This connects directly with broader questions of human oversight and autonomous AI governance.

For nonprofit organisations, the same logic applies in a more resource-constrained setting: policies should be practical, role-specific and proportionate. I discuss this separately in AI compliance for NGOs.

🟩 AI Literacy Under the EU AI Act

Article 4 of the EU AI Act has applied since 2 February 2025. The European Commission explains that AI literacy measures should be appropriate to the context and take account of employees’ technical knowledge, experience, education and training, the use context and the affected persons. See European Commission guidance on AI literacy.

This does not mean that every employee must complete the same generic course

A receptionist using an AI chatbot, an HR manager reviewing AI-assisted CV summaries, a lawyer using ChatGPT for contract triage and a developer using a coding assistant need different training.

For shadow AI prevention, AI literacy should explain what may not be uploaded, how approved tools must be used, when to escalate, why model training is not the only risk and why human responsibility remains necessary.

Training should use examples from the organisation’s own work: contracts, HR files, customer support messages, fundraising documents, policy drafts, board papers or technical documentation. Generic warnings rarely change behaviour unless employees recognise the documents they actually handle.

For broader company readiness, this connects with the EU AI Act 2026 compliance checklist.

🟩 Practical Shadow AI Checklist for Employers

▫️ Inventory where employees already use AI tools
▫️ Identify personal accounts used for work tasks
▫️ Classify documents by sensitivity before AI use
▫️ Approve specific AI tools and accounts
▫️ Define green, amber and red data categories
▫️ Restrict uploads of privileged, confidential and regulated information
▫️ Review vendor terms, retention, security and administrative controls
▫️ Train employees by role, not with one generic slide deck
▫️ Create a clear reporting route for accidental uploads
▫️ Keep evidence of decisions, approvals and remediation
▫️ Revisit the policy when new AI features, connectors or business workflows are introduced
▫️ Test whether employees understand the policy by asking them to classify real examples from their daily work

💬 Frequently Asked Questions

❔Can employees upload contracts to ChatGPT

Only if the tool, account, data and task have been approved. A contract may contain confidential terms, personal data, trade secrets or privileged material. A personal ChatGPT account is usually not the right environment for unredacted company contracts unless the organisation has expressly authorised that use.

❔Is it safe to upload company documents to ChatGPT

It depends on the product, account, settings, contract, data category and use case. The safer question is not “is ChatGPT safe?” but “has this specific workflow been approved for this specific information?”

❔Does ChatGPT use company data for training

OpenAI says consumer-service content may be used to improve models depending on user settings, while ChatGPT Business, Enterprise, Edu and API inputs and outputs are not used for model training by default. Training is only one issue; storage, retention, disclosure and authorisation still matter.

❔Does turning off training make an upload safe

Not necessarily. Turning off training addresses one use of the data. It does not amend an NDA, approve an external transfer, resolve GDPR questions, control retention or create internal corporate authority.

❔Can deleting the chat remove the legal risk

Deletion may reduce continuing exposure, but it does not erase the fact that a potentially unauthorised transfer occurred. The company may still need to assess confidentiality, privacy, security, privilege and contractual consequences.

❔Should companies ban ChatGPT completely

A total ban may be appropriate for some environments or data categories. But broad bans can push AI use into personal accounts and invisible workflows. A stronger long-term approach is usually approved tools, clear restrictions, training, monitoring and realistic incident response.

🟩 Conclusion

The debate about employees using ChatGPT is often framed incorrectly.

The question is not whether AI is good or bad. It is not whether every uploaded contract will become public. It is not whether companies can prevent every employee from experimenting with AI.

The real question is whether the organisation knows which AI systems are being used, what information is entering them, which accounts are involved, which purposes are permitted and who remains responsible

Employees will continue using AI because it solves real problems.

Companies that respond only with prohibition may push that activity into personal accounts, private devices and invisible workflows.

The real risk is not that employees use AI. The real risk is that companies have no visibility, no rules and no safe workflow.

🟩 Does Your Organisation Know What Employees Are Uploading?

I help European businesses and NGOs identify shadow AI use, assess confidential-data risks and build practical AI governance systems.

This may include a Shadow AI Risk Review, an AI usage policy, a review of existing ChatGPT workflows, employee AI literacy training, or a practical workshop for management, Legal, HR or Compliance teams.

The goal is not to stop employees from using AI. The goal is to make sure they can use it without turning productivity into an avoidable legal incident.

Request a Shadow AI Risk Review

Related Reading:

▫️ EU AI Act 2026: What Companies Need To Do Before August
▫️ AI Compliance for NGOs: How the EU AI Act Changes Nonprofit Work
▫️ EU AI Act transparency and AI labelling obligations
▫️ Autonomous AI and World Models: Who Will Control the Matrix?

Scope, Methodology and Legal Disclaimer

This article primarily focuses on EU data protection, confidentiality and AI governance. The privilege discussion includes recent US developments and should not be applied automatically to other jurisdictions.

Legal professional privilege and professional secrecy differ by jurisdiction. Companies should obtain jurisdiction-specific advice before drawing conclusions about privilege, confidentiality or reporting duties.

The analysis is based on official OpenAI documentation, EU legislation, European Commission guidance, American Bar Association materials and workplace research. It is intended as a practical governance guide, not as academic peer review.

This article provides general information and does not constitute legal advice.

I will continue writing about this in plain language
See you in the next piece

Cheers,

Table of Contents:

▫️From Language Models to World Models
▫️What Are AI World Models?
▫️When AI Starts to Act
▫️Why AI Regulation Must Focus on Authority
▫️The Matrix Must Have Boundaries
▫️Why Autonomous AI Needs a Black Box
▫️Human Oversight and Real Control
▫️Testing Autonomous AI
▫️Who Is Liable When AI Fails?
▫️Europe’s Role in AI Regulation
▫️What Companies Should Do Now
▫️Who Controls the Matrix?

Today’s AI produces answers. The next generation may make decisions, execute plans, and act in the physical world.

That changes the legal question completely.

Companies will no longer compete solely over whose chatbot writes better text, produces better images, or gives better answers. The next technological war may be fought over autonomous AI systems that can understand their environment, predict consequences, and carry out tasks independently.

One of the leading advocates of this direction is Yann LeCun, a Turing Award winner and one of the most influential researchers in modern AI. He played a major role in the development of deep learning and computer vision, founded Facebook AI Research, better known as FAIR, and later served as Meta’s Chief AI Scientist.

In late 2025, LeCun left Meta and founded AMI Labs, short for Advanced Machine Intelligence. The company is developing systems designed to understand the real world, retain memory, plan actions, and predict their consequences.

In March 2026, AMI Labs raised more than $1 billion from investors including Nvidia, Bezos Expeditions, Samsung, Toyota Ventures, and Temasek.

But the underlying bet is clear.

Investors have placed more than $1 billion on the idea that AI can predict possible futures by building an internal model of the world — a kind of Matrix.

Inside this digital reality, AI could calculate what happens if a robot moves an object, an industrial machine changes speed, or an autonomous agent performs a sequence of actions.

Today’s AI predicts the next word. AMI Labs wants to build AI that predicts what happens next in the real world.

🟩 From Language Models to Autonomous AI

Modern language models can write contracts, code, articles, and scripts. They can even create the impression of a meaningful conversation. But they do not understand the physical world. They can describe reality without actually “seeing” it.

A child learns differently. A child watches, moves, touches objects, falls, breaks things, and observes the consequences. This is how a child learns that a glass can shatter and that a moving object cannot stop instantly.

The next stage of AI development will not be based on language alone. It will involve world models.

A world model is an internal representation that allows an AI system to predict how an environment may change after a particular action.

A language model predicts a word. A world model predicts an event.

🟩 What Are AI World Models?

A world model would learn from events in the real world through video, images, sensor data, and information about the movement of physical objects.

Its purpose would be to predict what happens after a particular action.

These systems could understand space, plan actions, and assess consequences before they occur. Combined with robotics and autonomous agents, they could move artificial intelligence from passive content generation into active participation in the physical world.

It would not literally see the future. But the more data it receives, the more persuasive its predictions may become. At some point, people may begin treating an algorithmic forecast as if it were an inevitable event.

The next wave of autonomous AI may be driven by robots, drones, medical equipment, autonomous vehicles, and systems that manage critical infrastructure.

These technologies will be built to create a safer and more predictable — supposedly “perfect” world.

But if a system knows too much, constantly calculates our behaviour, and decides which choices are safe or correct, people may gradually lose their freedom to choose.

A world designed to protect us could become a human Matrix in which every move has already been calculated by an algorithm.

🟩 When AI Starts to Act

Today, AI analyses data, creates text, produces images, and generates realistic video.

Its output is still largely passive and, in a sense, “two-dimensional.” The system creates something, and a human decides what to do with it. Autonomous AI could change that model.

That creates an entirely new level of risk.

An error in an AI-generated text is one thing. A synthetic system making decisions that affect someone’s life, safety, or future is something else entirely.

This is why autonomous AI governance cannot focus only on outputs, transparency, or content labelling.

It must also address what the system is authorised to do.

🟩 AI Regulation Must Focus on Authority

One AI system may only provide information. Another may recommend a decision. A third may make decisions and take action independently.

The level of risk therefore depends not only on the model itself, but also on the authority it has been given.

AI regulation should define which technical actions a system may perform and under what circumstances it may act without human approval. This must become a core part of AI risk management.

Companies need to know not only which model they are using, but also which tools it can access, which systems it can control, and what consequences its actions may produce.

The real regulatory target is no longer artificial intelligence as an abstract concept. It is AI’s access to the real world and its ability to affect it.

🟩 The Matrix Must Have Boundaries

Every autonomous AI system must have limits.

When it opens another door, there must eventually be a brick wall behind it that it cannot bypass.

At a critical moment, it must stop acting independently and hand control back to a human.

These boundaries must not exist only in internal policies. They should be built into the technical design of the system.

But our experience with language models shows that people quickly become accustomed to convenience. They stop checking the output and gradually hand more control to the machine.

The human remains in charge on paper. In practice, they begin following the system’s recommendations automatically.

The core principle should therefore be simple: AI must not exceed its authority and must remain under meaningful human control.

Similar requirements are already appearing in European law. Regulation (EU) 2023/1230 on machinery entered into force on 19 July 2023, while most of its provisions will apply from 20 January 2027.

🟩 The Matrix Needs a Black Box

Like an aircraft, every autonomous AI system should have its own black box.

When a system makes a mistake, it must be possible to reconstruct the entire sequence of events. Logging will therefore become one of the central elements of AI governance.

They should record the model version, the assigned task, the available data and tools, the actions performed, and every significant interaction between the system and a human operator.

They should also show why a particular operation was continued or stopped.

The EU AI Act already requires automatic record-keeping for high-risk AI systems.

Autonomous models interacting with the physical world will require a much more detailed standard. Their logs must show not only the final outcome, but also the full chain of decisions and actions that produced it.

Without such a black box, identifying the cause of an error and allocating responsibility will be extremely difficult.

🟩 Human Oversight Must Mean Real Control

When a company claims that a human remains involved in decision-making, that involvement must not be merely formal.

A specific employee should be responsible for monitoring the autonomous system. That person should receive alerts about important actions and have the power to approve an operation, stop the process, or prohibit a particular action entirely.

This is only possible when the employee understands the system’s capabilities and limitations. They must know when the AI can be trusted and when its decision must be challenged or reversed.

The problem is that there are currently too few specialists with that level of expertise. A human should not simply sit next to the system and be treated as formally responsible. They must retain real authority over it and have the technical ability to intervene.

At the same time, human oversight must not become mindless button-pushing, with an employee automatically approving hundreds of decisions they do not understand.

Real oversight means having the ability to understand, challenge, and stop the system.

🟩 Test Scenarios, Not Just Answers

A language model can be tested with benchmark tasks and carefully designed prompts. An autonomous system must be tested in both real and simulated scenarios.

Every update, configuration change, expansion of authority, or connection to a new tool may introduce new risks. Cybersecurity must also be part of the assessment, especially when an autonomous agent can access infrastructure, financial systems, personal data, or physical equipment.

A serious AI risk management process must therefore include continuous testing, monitoring, incident reporting, and reassessment.

Large numbers of specialists will be needed to test, evaluate, and supervise these systems.

They will also have to keep learning throughout their careers, because the technology will change faster than the instructions governing its use.

🟩 Who Will Be Responsible for the Matrix?

AI liability will become one of the most difficult legal questions.

Responsibility cannot therefore be placed entirely on the developer or entirely on the user.

Future liability rules will need to consider who defined the system’s purpose, who gave it access to data and tools, who set the limits of its capabilities, and who controlled the risks.

Separate liability may arise for a person or company that had the power to stop the system but failed to do so. The updated EU Product Liability Directive already covers software and AI systems.

An AI developer or provider may be treated as a manufacturer. Liability may extend to defects arising from updates, upgrades, or continued learning when those processes remain under the manufacturer’s control.

However, liability does not arise automatically after every update. It is still necessary to establish a defect, actual damage, a causal link, and which party controlled the system.

When another party makes a substantial modification after the product has entered the market, that party may become responsible if it places the modified system back on the market. Even these rules may prove insufficient for autonomous AI.

Additional measures may be needed, including mandatory liability insurance, financial guarantees, and a clear allocation of responsibility between developers, integrators, operators, and deployers.

🟩 Europe’s Role in Regulating Autonomous AI

Europe is already building the foundations of autonomous AI governance.

The EU AI Act introduces requirements relating to risk management, documentation, logging, transparency, and human oversight of high-risk systems.

The EU Machinery Regulation addresses the safety of autonomous equipment, the limits of its operation, human intervention, and the ability to stop a process safely.

For now, however, these rules remain separate. In the future, AI regulation, product safety law, machinery regulation, cybersecurity requirements, and product liability rules will have to be connected and continuously updated.

AI is developing too quickly.

By the time a robot appears in almost every home, there may still be no comprehensive legal framework capable of governing everything it can do.

Legal futurism in AI governance is therefore not speculation about a distant future. It is an attempt to create rules today that may one day protect our entire world.

🟩 What Companies Should Do Now

Companies do not need to wait for fully autonomous AI before preparing for it.

They should already map which AI systems they use, what data and tools those systems can access, which decisions they influence, and who has the authority to stop them.

They should also define operational limits, retain meaningful logs, test emergency scenarios, assign clear human responsibility, and determine how liability is divided between developers, integrators, operators, and deployers.

This is the practical foundation of autonomous AI governance.

The technology may still be developing, but the control structure should not begin after the first serious failure.

🟩 Who Controls the Matrix?

No one knows whether Yann LeCun’s bet will succeed exactly as he expects.

But the direction of travel is already clear. Future autonomous AI systems are likely to combine language models, sensors, planning, reasoning, and physical action.

Artificial intelligence is becoming less “two-dimensional.”

We need to start building the rules for this machine today. Otherwise, tomorrow we may be left behind with technically perfect legislation designed for yesterday’s technology.

Today, the main question is: “Was this text created by AI?”

Tomorrow, the question will be different: “Who authorised the AI to act? Within what limits? And who had the power to stop it?”

The task is not to predict the exact date when “real” artificial intelligence will arrive.

The task is to build the system that will control it.

The world has changed.

Dzhamal Statsenko is a lawyer and AI governance consultant writing about European AI regulation, accountability, and the risks of autonomous systems.

See you in the next piece.

Cheers,

Table of Contents:

▫️U.S. AI Regulation: Power Over Law
▫️Why AI Safety Now Matters
▫️OpenAI’s Internal AI Governance
▫️Who Should Control AI?
▫️The New U.S. Control Model
▫️AI Competition: Speed vs Safety
▫️From Better Models to Better Governance
▫️AI Compliance for Business
▫️Europe’s AI Policy Through Law
▫️Conclusion: The Battle for AI Control

The real question is no longer which AI model is stronger. The real question is who controls it.

That is the divide now emerging between the American and European approaches to AI regulation — and GPT-5.6 makes it impossible to ignore.

On 8 July, OpenAI unveiled GPT-5.6. But this was not just another model launch. It was a signal that the AI debate has entered a new phase.

For years, every major AI release was treated as a technical race. People asked whether the new model was more powerful, faster, cheaper, more convenient, better at coding, better at reasoning, or better at passing benchmarks.

That era is ending.

Now the central questions are different. Who controls the model? Who decides when it can enter the market? Under what conditions does it become available to users? Who defines acceptable risk? And who regulates its public use?

GPT-5.6 is not only a product release. It is a case study in the new politics of AI governance, AI safety, and AI control.

🟩 The American Approach: AI Regulation Through Power, Not Law

The U.S. government was actively involved in the release of GPT-5.6. OpenAI eventually brought the model to market, but before doing so, the company spent a long time working through the issue with the federal government in a hands-on, ad hoc process.

This matters.

U.S. law does not require a special licence or formal approval to release this kind of AI model. Legally, OpenAI did not need to obtain “permission” from the government. But when money, power, and AI national security are involved, formal legal requirements are rarely the whole story.

This episode shows that the United States already sees powerful AI models not merely as commercial products, but as technologies capable of affecting national security.

And frankly, that concern is justified.

This is where the contrast with Europe becomes clear.

The United States has effectively chosen manual AI regulation: closed consultations, negotiations, testing, and direct interaction between government officials and the company.

The European Union has taken a different path. Europe does not currently have frontier AI companies with the same global scale, infrastructure, and market power as the leading U.S. players. In that sense, Europe is more a consumer of foreign AI products than the main producer of them.

That is why the EU has chosen legal AI regulation: the AI Act, formal obligations, documentation, transparency, risk assessment, AI compliance, and oversight.

Put simply, the United States regulates AI through political and administrative power. Europe regulates AI through law.

🟩 Coding, Biology, and Cybersecurity: Why AI Safety Is No Longer Optional

GPT-5.6 is not just a text model for writing articles, emails, or short answers. Models of this kind have moved far beyond text.

They are about programming, agentic tasks, cybersecurity, vulnerability discovery, automated analysis, and potentially even the creation of prohibited substances or biological weapons.

This is where the dual-use problem becomes unavoidable.

The same model can be useful and dangerous at the same time. It can help security specialists write patches, detect vulnerabilities, and protect systems. But similar capabilities can also be used in the opposite direction: to identify weaknesses, automate attacks, or lower the barrier to dangerous knowledge.

Biology is another example. AI can support medicine, research, diagnostics, and drug development. At the same time, these technologies can be used for dangerous purposes if access is not controlled.

That is why the old argument that “it is just a tool” is becoming less convincing.

The more powerful the model becomes, the less it looks like ordinary software and the more it resembles a strategic resource. I would not call AI a weapon. It is a new kind of resource. Its power is not limited by how much of it exists on the planet, but by how effectively and safely society can use it.

In the right hands, such a resource can be medicine. In the wrong hands, it can become a problem.

This is why AI safety can no longer be treated as a decorative layer added after launch. It is becoming a condition for access, legitimacy, and control.

🟩 OpenAI Is Building AI Model Governance From the Inside

OpenAI is trying to manage risk inside the company itself. It does this through model restrictions, safety mechanisms, request monitoring, access levels, and internal security procedures.

In other words, OpenAI is not simply building a model. It is building an entire control infrastructure around the model.

This is already a form of AI model governance. The company decides how the model behaves, who can access certain capabilities, which requests are blocked, which risks are monitored, and which users or use cases receive more trust.

But that raises the main question: who decides that the model is safe enough?

In the United States, this is effectively decided through interaction between OpenAI and the government. A significant part of that process takes place behind closed doors: without broad public access, without independent journalists, without civil society, and without external experts having real influence.

Society receives the finished product, but has almost no influence over how that product was tested, which risks were considered acceptable, and why the model was allowed into public use in the first place.

Europe has chosen a different path: protection through legal regulation. But Europe faces another problem. It is extremely difficult to regulate a system you do not fully understand.

AI moves faster than legislation. That means there is a real risk that the law becomes outdated before it is even fully applied.

🟩 Who Should Control AI?

At the moment, many of the most important decisions are made by the company itself.

OpenAI decides which risks are acceptable, which requests should be blocked, who receives access, which features should be restricted, which scenarios are dangerous, and which are permissible.

Yes, the company has expertise. But the company also has a commercial interest. Its decisions can be influenced by investors, corporate clients, politicians, government agencies, competitors, and the market.

From society’s point of view, this creates a serious imbalance.

Society did not choose for AI of this scale to become part of everyday life. But now it is forced to live in a world where these models already influence business, education, media, security, politics, and access to information.

This is the missing layer in current AI governance: real AI oversight that is independent, technically competent, and not captured by either governments or corporations.

In my view, the only logical long-term solution is the creation of an independent supervisory body. Such a body must be technically competent enough to understand the technology and independent enough to protect society from abuse by both governments and commercial companies.

Perhaps such a body will be created one day. Until then, we risk remaining puppets in the hands of Big Brother.

For now, the situation looks very different. Governments and corporations have obtained a new strategic resource, but they do not yet fully understand its long-term consequences.

Something similar may happen with AI. The technology looks like a source of power, profit, and influence. But if it is integrated into society incorrectly, it can create systemic risks.

🟩 The New American Control Model

The American approach does not require a mandatory licence to release an AI model. Instead, a voluntary system of interaction between the government and developers is emerging.

This may include preliminary government access to certain frontier models, testing, risk assessment, and national security consultations.

This is not strict regulation in the classical sense. But it is no longer a completely free market either.

The company is effectively cooperating with government bodies. That makes it difficult to predict what the next wave of AI releases will look like a year from now — especially because OpenAI’s products are used not only in the United States, but also in Europe, Asia, Africa, and other regions.

For other countries, this is also an AI national security problem. If a foreign AI product is used inside a country, it can potentially influence elections, political attitudes, the information environment, public health, education, data security, and critical systems.

That is why states will increasingly consider restrictions, controls, or localisation requirements for foreign AI products.

AI has long since become a strategic technology. Future model releases will not be discussed only as technological events. They will be governance events.

🟩 Competition Between AI Companies

There is another factor: competition.

While one company goes through checks, negotiates with the government, and delays its release, competitors may bring their models to market faster.

For example, Elon Musk’s xAI may use release speed as a competitive advantage. If OpenAI negotiates with the government for months, while another player completes the process in weeks, that player gains an advantage in publicity, users, and profit.

This creates a direct tension between AI safety and speed.

Powerful models must be tested. But the market does not like waiting. It pressures companies to release faster. If one company becomes too cautious, another can take its place.

That means AI regulation does not only affect safety. It also affects competition.

🟩 From Model Power to Governance Power

In the past, AI companies mainly competed over whose model was better. That is no longer enough.

The winner will not simply be the company that builds the most powerful model. The winner will be the company that can scale AI safely, quickly, and predictably.

Companies now need to improve not only the models themselves, but also the governance systems around them: access, control, security, monitoring, compliance, documentation, interaction with government, and risk management.

This is the new frontier of AI model governance.

The problem is that the regulatory framework either does not exist or becomes outdated almost immediately. And if lawmakers want to regulate AI effectively, they first need to understand the technology deeply.

Without that, regulation becomes formal, delayed, and weak.

🟩 What This Means for Business: AI Compliance Is Infrastructure

For business, this story means that AI tools can no longer be selected only by price or response quality.

Companies now need to ask harder questions.

What data is transferred to the model? Who has access to that data? How is it logged? Where is it stored? What restrictions does the provider impose? How often do the rules of use change? What guarantees does the provider give? Can the provider maintain access to the model after new negotiations with the government or regulator? How could future releases affect the company’s operations?

AI is becoming part of the infrastructure of almost every organisation.

Dependence on an external AI provider is no longer just a technical issue. It is a question of business resilience, AI compliance, security, and strategic planning.

This is where AI risk management becomes practical. It is no longer enough to ask whether a tool works. A company must understand how the tool is governed, what risks it creates, how those risks are monitored, and what happens when the provider changes the rules.

For businesses, AI control is now part of operational control.

🟩 The European Context: AI Policy Through Law

Europe follows a formal approach through the AI Act. This approach is built around documentation, transparency, risk assessment, cybersecurity, labelling, oversight, and the responsibility of providers, suppliers, and users.

It is a legalistic approach. Europe is trying to build a system of rules before the technology fully escapes control.

But the problem is obvious: AI develops too quickly. A law written today may already be insufficient tomorrow.

The United States and the European Union are taking different paths, but they are reaching the same general conclusion: powerful AI models can no longer be treated as ordinary software.

The United States is relying on flexibility, voluntary interaction with government, and national security. But this approach is too closed and too administrative.

The EU is relying on legal certainty, documentation, oversight, AI compliance, and responsibility. But this approach may be too slow for a technology that changes faster than legislation.

Neither the American nor the European model looks ideal.

In my view, the most logical solution would be an external independent AI regulator. Not just another bureaucratic office, but a technically competent institution capable of responding quickly to change, understanding real risks, and controlling the use of AI by both governments and private companies.

🟩 Main Conclusion

AI governance is no longer a theoretical topic. It is a practical necessity.

Organisations must control not only what AI generates. They must also consider risks connected with model access, data, future releases, dependence on providers, changing rules, and government intervention.

For companies, AI is a question of infrastructure, security, AI risk management, and predictability.

For governments, AI is a question of control, national security, and influence.

The main question is no longer which model is stronger.

The main question is who decides which model becomes available to the world, under what conditions, and how predictably that access will expand.

I will continue writing about this in plain language.

See you in the next piece.

Cheers,

I am publishing my reply.

Dear Mr. ***,

In your situation, I would not recommend treating the AI Act as a law that applies only to large technology companies. That is a common mistake.

Yes, your organisation does not develop its own AI system. However, if you use AI in your work — for example, to prepare texts, translations, social media content, grant applications, educational materials, volunteer selection, or to process incoming requests — you may still qualify as a deployer. In other words, you may be regarded as an organisation that uses an AI system under its own responsibility.

For an NGO, this is particularly important.

First, your organisation probably faces the same reality as many NGOs: limited budgets, small teams, and too many urgent tasks. That is why AI can look very attractive. It can help you prepare grant applications faster, translate documents, draft publications, respond to people, create presentations, and automate routine work.

But this is exactly why you need to be especially careful. AI should not become an «invisible employee» whom nobody supervises.

Second, NGOs often work with vulnerable groups: refugees, migrants, children, elderly people, people with low income, victims of violence, or individuals who depend on accurate information on important matters. An AI mistake in this context is not just a badly written text. It can become incorrect advice, a lost opportunity, a denial of assistance, or a serious loss of trust in your organisation.

That is why simply telling staff to “use AI carefully” is no longer enough.

I would recommend that you adopt an internal AI policy. This policy should describe which AI tools your organisation uses, who is allowed to use them, what data must not be uploaded into AI systems, who reviews the output, and in which cases the use of AI must be specifically recorded.

I would also recommend appointing a person within the organisation who is responsible for AI governance. This does not necessarily have to be a newly hired employee. However, there should be someone who understands where AI is being used in the organisation, what risks arise, who checks the materials, and where evidence of such review is kept.

Separately, I would conduct a short training session for employees and volunteers.

They need to understand a few basic rules: sensitive personal data must not be uploaded without a proper legal basis; AI-generated text must not be published without review. AI must not be used for decisions that may affect a person’s access to assistance, services, education, work, or another important opportunity without a separate risk assessment.

All texts created or substantially prepared with the help of AI should be reviewed by a human. This is especially important for legal information, social guidance, educational materials, public statements, materials intended for vulnerable groups, or texts concerning matters of public interest.

And here, it is important to be precise: it is not enough to say, «we checked it». It is better to record who reviewed the material, when it was reviewed, which sources were used, and what changes were made after the AI output was produced.

The same applies to images, audio, and video. If your organisation uses AI-generated or AI-manipulated visual, audio, or video content, especially in public communications, you should think about labelling and transparency in advance. In certain cases, the AI Act requires disclosure that content has been artificially generated or manipulated. For an NGO, this is not only a legal issue, but also a matter of trust.

I would pay special attention to grant applications. Many NGOs already use AI to prepare applications for subsidies and grants. In itself, this is not necessarily prohibited. However, you need to understand exactly how AI was used: did it only help structure the text, translate material, suggest wording, or did it effectively generate the substance of the application?

If a donor or grant provider requires disclosure of AI use, this should be done. If there is no such requirement, I would still recommend having an internal protocol: who prepared the application, which AI tool was used, for which part of the work, who checked the facts, the budget, the impact data, the legal statements, and the final version.

For an organisation with ANBI status, this is particularly important from a reputational perspective. An NGO exists on the basis of trust: the trust of society, donors, partners, the state, and the people it serves. Coming under the attention of a regulator because of chaotic AI use is not only a sanctions risk. It is also a risk of losing public trust.

You should also separately assess whether any of your AI use falls into the high-risk category. Not every use of AI by an NGO is high-risk. For example, using AI to draft a social media post is usually not the same as using AI to assess a person.

However, the risk becomes much higher if AI helps select candidates for employment or volunteer positions, allocate assistance, assess requests, prioritise cases, or influence access to education, social support, housing, consultation, or another important service.

In such cases, you need more than just a manual check. You need proper control: competent human oversight, monitoring of the system’s operation, clear instructions, log retention, and the ability to demonstrate why a particular decision was made.

Subscribe now

As a minimum, I would recommend that your organisation:

1. prepare an AI inventory — a list of all AI tools used by the organisation

2. adopt an internal AI policy

3. appoint a person responsible for AI governance

4. train employees and volunteers

5. prohibit the upload of sensitive data without a separate legal basis

6. introduce mandatory human review for public-facing materials

7. keep a log of AI use in sensitive processes

8. separately assess high-risk scenarios

9. establish rules for labelling AI-generated content

10. retain evidence of review for at least six months, and for important processes, preferably longer

My main advice is this: do not ban AI, but put it under control.

NGOs value AI because it saves time. That is understandable. But after the AI Act, the key question will be different: can your organisation prove that it controls the process?

If the answer is «no», then the problem is not AI. The problem is the absence of governance.

Regards,
Dzhamal Statsenko

Legal and regulatory framework to attach to the letter

1. Regulation (EU) 2024/1689 — Artificial Intelligence Act

2. Article 3 AI Act — Definitions

3. Article 4 AI Act — AI literacy

4. Article 6 AI Act and Annex III — High-risk AI systems

5. Article 26 AI Act — Obligations of deployers of high-risk AI systems

6. Article 27 AI Act — Fundamental Rights Impact Assessment

7. Article 50 AI Act — Transparency obligations

8. Code of Practice on Transparency of AI-Generated Content

The EU AI Act 2026 deadline is not just a legal date on paper. It is a practical warning for businesses: if your company uses AI, you need to know where it is being used, who is responsible for it, and whether people need to be told that they are interacting with AI.

EU AI Act compliance starts with three questions:

❔Where do we use AI
❔Who controls or deploys the AI system
❔Do customers, users, employees, or the public need to know that AI is involved

Here is a practical EU AI Act compliance checklist for 2026.

1️⃣ Identify where AI is already being used

The first step is to look honestly at your business processes and answer a question:

❔Where are we already using AI

This may include chatbots, advertising, written content, images, videos, HR tools, customer support, legal drafts, reports, internal documents, translation tools, meeting summaries, analytics, or content creation.

Many companies think they do not use AI. In reality, AI may already be present in several departments.

Example: a company says it does not use AI. But the marketing team creates images with an AI tool, customer support uses a chatbot, and HR screens CVs with the help of AI software. That company is already using AI. It is simply not managing it properly.

Before the AI Act August 2026 deadline, companies should hold an internal meeting, go through all key business processes, and record even minimal use of AI.

2️⃣ Define your role under the EU AI Act

The EU AI Act does not treat every business in the same way. If your company creates an AI system and sells it to others, that is one level of responsibility.

If your company only uses someone else’s AI tool, that is another level of responsibility. But using someone else’s AI system does not mean there is no responsibility at all.

Example: if a law firm uses ChatGPT or another AI tool to prepare draft documents, it did not create that AI system. But the law firm is still responsible for how it uses the output, whether the result is checked by a human, and whether the client is misled about the role of AI.

This is why EU AI Act compliance is not only a technical issue. It is also a governance issue.

Every company should know whether it acts as a provider, deployer, importer, distributor, product manufacturer, or simply as a business user of AI.

3️⃣ Tell people when they are interacting with AI: EU AI Act transparency obligations

One of the most important AI Act transparency obligations for companies is disclosure. If a person is communicating not with a real employee, but with an AI chatbot or AI assistant, they should understand this.

A company should not pretend that a machine is a human being.

Example: a website has a chatbot with a human name, a human photo, and a friendly conversational style. It answers like a member of staff. In that situation, the company should clearly tell users that they are interacting with an AI assistant.

This does not need to be dramatic. It can be simple:

“You are chatting with an AI assistant.”

The main point is clarity. Users should not be tricked into believing they are speaking with a human when they are not.

4️⃣ AI Act transparency rules for AI-generated content

The EU AI Act transparency rules also matter for AI-generated and AI-manipulated content. If a company creates written content, images, videos, voices, advertisements, reports, or public communications with the help of AI, it may need to clearly state that the content was created or modified by AI.

This may be done through a visible label, metadata, a watermark, a technical marker, or another method.

The exact solution will depend on the type of content, the risk, the audience, and the context.

Example: a brand publishes a realistic AI-generated image of a person holding its product. People may think it is a real photograph. They may believe that a real person was photographed for the campaign.

In that situation, the company should decide in advance whether a label such as “created with AI” or “AI-generated image” is needed.

AI labelling should not be decided at the last minute, after the campaign is already live. It should be part of the content creation process before publication.

5️⃣ Be especially careful with deepfakes

Deepfakes are one of the clearest risk areas under the AI Act transparency obligations.

A deepfake is content where AI creates or changes a face, voice, photo, or video in a way that makes it look real. This is risky because people may believe that someone said or did something when they did not.

Example: a company creates a video where a well-known person appears to recommend its product. Even if the company sees it as a joke, parody, or creative advertisement, viewers may believe the person really said it. In this situation, very clear labelling is needed.

If AI makes something fake look real, the disclosure must be obvious enough for people to understand what they are seeing.

6️⃣ Use AI carefully for matters of public interest

Not every AI-generated text needs the same level of labelling or legal review. But if the content concerns important public issues, the risk is much higher.

This may include politics, war, migration, health, public safety, elections, people’s rights, financial matters, education, or access to public services.

Example: an AI-generated text about store discounts is one thing. An AI-generated text about refugee rights, elections, medical advice, or emergency rules is completely different. In those areas, a mistake may harm people.

For this reason, companies should treat public-interest AI content as a separate risk category.

Before publishing this type of content, they should check:

❔Is AI involved
❔Was the output reviewed by a qualified human
❔Could people rely on this information to make an important decision
❔Does the content need an AI label or disclosure

This is where EU AI Act compliance connects directly with trust, reputation, and public responsibility.

7️⃣ GPAI and the Code of Practice

The EU AI Act also includes rules for general-purpose AI models, often called GPAI. This is where the GPAI Code of Practice becomes relevant.

GPAI obligations mainly concern providers of general-purpose AI models. These are companies that develop or place powerful AI models on the market. For ordinary companies that only use AI tools, the situation is different.

A small business using a third-party AI writing tool is usually not the provider of a GPAI model. But this does not mean GPAI is irrelevant.

Companies should still ask practical questions about the AI tools they use:

❔Does the supplier explain how the AI system works
❔Does the tool support transparency and labelling
❔Can the company keep records of AI-generated content
❔Does the supplier provide documentation, terms, safety information, or compliance materials
❔Does the tool make it possible to preserve metadata, watermarks, or other AI markers

Example: a marketing agency uses an AI image generator for client campaigns. The agency may not be the provider of the underlying general-purpose AI model.

But it still needs to know whether the tool allows AI-generated content to be labelled, whether metadata is preserved, and whether the client can later prove how the content was created.

This is why the GPAI Code of Practice matters even for companies that are not AI developers.

It gives the market a practical direction: transparency, documentation, copyright awareness, safety, and accountability are becoming part of normal AI governance.

8️⃣ Do not assume that an AI policy is enough

Many companies will respond to the EU AI Act by writing an AI policy. That is useful, but it is not enough. A document saying “we use AI responsibly” will not solve the problem by itself. Companies need evidence.

They should be able to show:

• which AI tool was used

• who used it

• what content or decision it helped create

• who reviewed the output

• where the content was published

• why it was labelled or not labelled

• what risk assessment was done

• what human oversight existed

Example: a company launches an AI-generated advertising campaign. Six months later, a regulator, customer, journalist, or business partner asks questions. If the company cannot show who created the content, who checked it, and why there was no AI label, a general AI policy will not be enough.

EU AI Act compliance is not only about having a policy. It is about being able to prove what happened.

9️⃣ Check whether you use high-risk AI systems

Some AI systems are treated more seriously because they can affect people’s lives, rights, opportunities, or access to essential services. This is the area of AI Act high-risk systems.

High-risk AI may include systems used in employment, education, access to services, migration, law enforcement, safety, or other sensitive areas.

Example: if a company uses AI to select job candidates, rank applicants, assess employees, or support promotion decisions, this is not just a productivity tool. It can affect a person’s career and income.

That is why this type of AI should be reviewed very carefully.

Companies should ask:

❔Do we use AI in hiring or HR
❔Do we use AI to evaluate people
❔Do we use AI to make or support decisions about access to services
❔Do we use AI in a regulated or sensitive sector
❔Could the AI system affect someone’s legal position, rights, money, job, education, safety, or status

The phrase “EU AI Act high risk” should not be treated as abstract legal language.

For companies, it means this: if AI can seriously affect a person’s life, the compliance burden is higher.

🔟 EU AI Act penalties for non-compliance

Companies should also understand the risk of penalties. EU AI Act penalties can be serious.

For certain violations, fines may reach up to EUR 15 million or up to 3% of the company’s total worldwide annual turnover, whichever is higher.

This does not mean that every mistake will automatically lead to the maximum fine. But it does mean that AI compliance can no longer be ignored.

Example: a small company launches an AI chatbot but does not tell people that they are speaking with AI. If the company has EUR 2 million in annual worldwide turnover, 3% equals EUR 60,000. This may be more than poor customer service. It may become a legal and financial problem.

Another example: a larger company publishes realistic AI-generated content in a sensitive public-interest area without proper review, labelling, or records. If the company has EUR 100 million in annual worldwide turnover, 3% equals EUR 3 million. But because EUR 15 million is higher, the possible maximum fine may reach EUR 15 million. If questions arise later, the company may need to explain not only what it published, but also how the content was created, reviewed, approved, and disclosed.

Subscribe now

❗️What companies should do now

1. Map where AI is used inside the business

2. Identify the company’s role and responsibility

3. Check whether users interact with AI systems

4. Review AI-generated content and labelling needs

5. Create rules for deepfakes and synthetic media

6. Treat public-interest content with special care

7. Check whether GPAI tools and suppliers provide enough documentation

8. Review whether any AI use may fall into high-risk AI systems

9. Keep evidence of AI use, human review, and publication decisions

10. Train staff before the rules become a problem

You can find more detailed information in my full article: Up to €15 Million or 3% of Global Turnover: EU AI Act Compliance for AI-Generated Content in 2026

See you in the next piece.

Cheers,

Table of Contents:

▫️Why 2026 Matters
▫️Article 50 Explained
▫️Key Dates and Timeline
▫️Fines and Penalties
▫️Provider vs Deployer
▫️The AI Content Code of Practice
▫️What AI Labelling Means
▫️Watermarks, Metadata and C2PA
▫️Deepfakes
▫️Advertising and Marketing
▫️Publishers and Media
▫️Business Compliance Checklist
▫️Open Questions
▫️Main Conclusion
▫️FAQ

In 2026, labels such as “Made with AI” or “You are now interacting with AI” will no longer be voluntary. You will be required to disclose this. If you fail to do so, your company may face a significant fine.

The new EU law requires people to understand when they are interacting with AI or viewing content created by AI under Article 50 of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689.

These rules will start applying on 2 August 2026. For some AI systems that were already on the market before that date, a transitional period will apply until 2 December 2026.

🔺This will not simply be a “created by AI” label placed on an image. There will be many interesting new requirements.

The new rules apply to the entire system of working with AI-generated content:

▫️Developers of AI systems will have to redesign the internal architecture of their products
▫️Businesses will have to change how they control content and services

🔺Here are concrete examples of how this will work once the new rules enter into force:

▫️If a customer is interacting with AI, they must be informed of this, unless it is already obvious

▫️If an AI system creates text, images, audio, or video, that content must be technically recognisable as having been created or modified by AI

▫️If AI creates a deepfake, it will be necessary to disclose that the content is artificial or has been modified

▫️If AI-generated text is published to inform the public on a matter of public interest, it must be disclosed that the text was created or modified by AI. If the text has gone through human review or editorial control, disclosure may not be required

▫️The explanation that a product was made with AI must be clear, visible, accessible, and provided before the first interaction or at the first display

▫️Violations of the transparency rules may result in fines of up to EUR 15 million or up to 3% of the company’s total worldwide annual turnover for the preceding financial year, whichever is higher. A more lenient cap applies to small businesses and start-ups

I have gone through all the key points of the new EU law on AI regulation. Keep reading if you are interested in the details of this adventure, as I will go through each new rule in detail.

🟩 Why 2026 Will Be a Turning Point for Every Business Using AI

Imagine an ordinary internet feed: a video of a politician, a customer review, a news story, a photo from the scene of an event, a voice message, an advertising banner, a post by an expert.

Today, each time, you ask yourself the same question: is this real, or was it made by AI?

This is exactly the question the EU Artificial Intelligence Act is trying to address.

For a long time, AI-generated content was discussed as a matter of trust, ethics, and platform rules:

❔Should AI-generated images be labelled
❔Should deepfakes be banned
❔Should it be disclosed when an article was written with the help of AI
❔Should watermarks be voluntary or mandatory

In 2026, this discussion moves into the legal field — although, in my view, into a rather crooked and bumpy one.

Article 50 of the EU AI Act introduces transparency rules for certain AI systems and for certain materials created or modified with the help of AI.

The European Commission explains these rules as a way to protect people from deception, manipulation, and threats to the information environment.

And this law is not only about political deepfakes before elections. It will affect the ordinary digital life of each of us:

• an advertising video in which a person never actually said those words

• a “real” review that never existed

• a random Facebook news story without clear editorial responsibility

• an image of an event that looks documentary, but was created by a machine

• a voice, face, or text that we trust without understanding where it came from

The problem is not that AI creates content. The problem is that this content increasingly looks real.

This logic is directly reflected in Recital 133 of the EU AI Act. It states that AI systems can generate large volumes of synthetic content that is becoming increasingly difficult to distinguish from authentic content. This creates risks of disinformation, manipulation, fraud, impersonation, and consumer deception.

For this reason, providers of AI systems must implement technical solutions that make it possible to label and detect AI-generated or AI-modified content.

🔺When speaking about the new law, the expression “AI label” is too narrow.

This is not about a small notice saying “created by AI”. It is about an entire chain of transparency:

• a person must understand when they are interacting with AI

• content must carry a machine-readable technical signal — meaning that when you upload an AI-generated image directly to a social network, the platform should be able to understand and detect it

• deepfakes and certain AI-generated texts on matters of public interest must be labelled for people

• companies must be able to prove to the regulator that they have actually implemented a process, not just written a policy document — in my view, this is exactly where governments will start making money. But there is also good news: at these stages, companies will need to hire lawyers who understand this field, such as myself

• platforms, metadata, standards, and detection tools must work together

🔺The bad news: every business will have to bear ongoing costs to monitor AI transparency.

This is no longer a task for one lawyer writing a compliance policy. The new rules will affect product teams, engineers, marketing departments, newsrooms, advertising agencies, brands, security teams, procurement departments, and everyone who works with content.

If an organisation creates, buys, publishes, or distributes AI-generated content, there will come a moment when AI transparency becomes part of normal operational work.

🟩 Article 50 of the EU AI Act: Transparency Obligations in Plain Language

Article 50 sets out transparency obligations for providers and users of certain AI systems. It is not limited only to “high-risk” AI systems, even though a large part of the EU AI Act is built around that category.

An AI system may not be considered high-risk, but it may still fall under Article 50. For example: a chatbot, an image generator, a synthetic voice tool, an AI marketing tool, or an AI-generated news summary.

In other words, if a system interacts with people or creates content, it may have transparency obligations even without being classified as high-risk.

The main groups of these obligations are:

🟢 AI Systems That Interact Directly with People

If an AI system interacts directly with a person, that person must immediately understand that they are dealing not with a human, but with AI. Providers of AI systems must think in advance about exactly how they will inform the user that they are interacting with AI.

There is only one possible exception: where it is already obvious from the context that the person is interacting with AI. In other words, an ordinary attentive user should be able to understand this without any additional explanation.

Such systems include, for example:

• chatbots

• voice AI assistants, where the assistant may briefly state by voice that it is an AI system

• interactive AI avatars, where the avatar may have a visible label or on-screen notice

What matters here is not how “smart” the system is or how human-like it appears. What matters is whether there is direct contact between a person and an AI system.

If such contact exists, the user must clearly understand that they are interacting with AI.

This information cannot be hidden somewhere in general terms of service or in a long privacy policy. The notice must be clear, visible, and accessible from the very first interaction.

A person should not have to guess who they are communicating with. They should immediately understand that they are interacting with an AI system.

🟢 Machine-Readable Labelling of AI Content

Providers of AI systems, including general-purpose AI systems, must ensure technical labelling of content if their systems generate synthetic text, images, audio, or video, so that such content can be technically identified as artificially created or modified.

This is the technical core of the AI labelling regime.

This is not only about a visible note saying “created by AI”. The law requires AI-generated content to be detectable by technical means. These solutions must be as effective, interoperable, robust, and reliable as technically feasible.

🔺Exceptions: this may not be required where the AI system performs only an assistive function for standard editing, does not substantially alter the input data, or does not change its meaning. There are also separate exceptions for the use of AI systems authorised by law for law enforcement purposes.

The same may apply to grammar checking, file compression, minor image cropping, or light colour correction, provided that the meaning of the content does not change.

But creating a synthetic product scene, replacing a face, generating artificial voice-over, or producing a fictional image of a real public figure will trigger the obligation to comply with this rule.

🟢 Emotion Recognition and Biometric Categorisation

If a company uses AI to understand a person’s emotions or to assign them to a particular group based on external characteristics, that person must be informed.

For example, if AI analyses a person’s face, voice, or behaviour and draws conclusions from it, the person must know that they are being analysed by an AI system. The company must also comply with personal data protection rules.

In short: if AI is doing something to a person invisibly, the person must know about it.

🟢 Deepfakes and AI-Generated Texts on Matters of Public Interest

The European Commission explains a deepfake as an image, audio, or video created or manipulated by AI that resembles existing persons, objects, places, events, or entities and could falsely appear to a person to be authentic.

If a user of an AI system creates or modifies an image, audio, or video in such a way that it becomes a deepfake, they must clearly disclose that the content has been artificially created or manipulated.

There is also a separate rule for AI-generated texts.

If AI-generated or AI-modified text is published for the purpose of informing the public on a matter of public interest, it must be disclosed that AI was used in its creation.

🔺The good news: this does not apply to every AI-generated text.

A private letter, an internal draft, a product description, or an advertising text does not automatically fall under this rule. The key condition is that the text is published for a broad audience and concerns a matter of public interest.

Disclosure is also not required if the text has undergone human review or editorial control and a specific person or organisation takes responsibility for the publication.

🟩 EU AI Act 2026 Timeline: When Article 50 Transparency Rules Apply

The EU AI Act was published in the Official Journal of the European Union on 12 July 2024 and entered into force shortly afterwards. The Regulation generally starts applying from 2 August 2026. However, some provisions apply earlier or later.

For Article 50, the key date is 2 August 2026. This is when the transparency obligations generally start to apply.

▫️On 2 February 2025, the prohibitions on certain AI practices and AI literacy obligations started to apply
▫️On 2 August 2025, certain governance rules, sanctions, and obligations for general-purpose AI models started to apply
▫️On 2 August 2026, the transparency obligations under Article 50 start to apply

There is also another important transitional date.

For AI systems that were already placed on the market before this date, a transitional period applies until 2 December 2026.

Subscribe now

🟩 EU AI Act Fines: Up to €15 Million or 3% of Global Turnover for Transparency Violations

Article 99 of the EU AI Act sets out sanctions for violations of the transparency rules.

For non-compliance with Article 50, providers and users of AI systems may face administrative fines of up to EUR 15 million or up to 3% of the total worldwide annual turnover for the preceding financial year — whichever amount is higher.

For small and medium-sized enterprises, including start-ups, a more lenient rule applies: the lower of the two limits is used — either the percentage of turnover or the fixed amount.

But this does not make the obligation symbolic. Regulators may apply not only fines, but also warnings or other non-monetary measures.

🔺The fine is only part of the risk. The main problem for business is evidence.

If a company publishes AI-generated advertising, uses a synthetic voice in customer support, distributes AI-generated summaries on matters of public interest, or integrates a generative tool into its product, it may need to show:

• which AI system was used

• what content was created

• what label was applied

• what metadata was preserved

• whether the AI-generated content could be technically detected

• who reviewed and approved the publication

🔺What This Looks Like in Concrete Numbers:

Suppose a company violates the rules of Article 50 — for example, it launches an AI chatbot for customers but fails to inform users that they are interacting with an AI system.

Under Article 99 of the EU AI Act, such a violation may result in a fine of up to EUR 15 million or up to 3% of the total worldwide annual turnover for the preceding financial year — whichever amount is higher.

For small and medium-sized enterprises, including start-ups, a more lenient rule applies: the lower of the two limits is used.

🟢 Example 1. A Start-Up with Annual Turnover of EUR 1 Million

3% of EUR 1 million = EUR 30,000.

If the company qualifies as an SME or start-up, the maximum limit will not be EUR 15 million, but up to EUR 30,000.

🟢 Example 2. A Medium-Sized Company with Annual Turnover of EUR 20 Million

3% of EUR 20 million = EUR 600,000.

If the company falls within the SME definition, the maximum limit will be up to EUR 600,000, because this is lower than EUR 15 million.

🟢 Example 3. A Large Company with Annual Turnover of EUR 100 Million

3% of EUR 100 million = EUR 3 million.

For a large company, the higher amount applies. Between EUR 3 million and EUR 15 million, the higher amount is EUR 15 million. This means the maximum fine may reach up to EUR 15 million.

🟢 Example 4. A Large International Platform with Annual Turnover of EUR 1 Billion

3% of EUR 1 billion = EUR 30 million.

In this case, 3% of turnover is higher than the fixed amount of EUR 15 million. Therefore, the maximum fine may reach up to EUR 30 million.

In other words, the rule works as follows:

▫️for large businesses: EUR 15 million or 3% of worldwide turnover — whichever is higher
▫️for small and medium-sized enterprises, including start-ups: EUR 15 million or 3% of turnover — whichever is lower

❗️Important: this does not mean that the regulator will automatically impose the maximum fine. The specific amount will depend on the circumstances: the nature of the violation, its duration, scale, consequences, the size of the company, the degree of responsibility, cooperation with the regulator, and whether the company attempted to correct the violation.

🟩 Provider vs Deployer Under the EU AI Act: Who Is Responsible for AI Content Labelling

Article 50 distinguishes between the obligations of providers and deployers of AI systems.

▫️Provider: the person or company that develops an AI system, or has it developed, and then places it on the market or puts it into service under its own name or brand. The provider is responsible for the system itself: how it is designed, what technical labels it applies, and whether AI-generated content can be detected.

▫️Deployer: the person or company that uses an AI system under its own responsibility. The deployer is responsible for the specific use of the system: why it is used, what content is published, where that content is placed, and whether disclosure to people is required. *Personal, non-professional use does not fall into this category.

🔺But in real life, things are more complicated.

One company may be both a provider and a deployer at the same time. A brand may use a third-party image generator. An agency may create AI-generated advertising for a client. A platform may provide AI tools while also hosting the content created with them. A publisher may use a general-purpose AI model inside its editorial system.

That is why the key question is not only “who bought the tool”. The real question is who controls the system, the use case, and the publication of the result.

Article 50 does not apply only to companies registered in the EU. If AI-generated content is used in the European Union, non-European actors may also fall within the scope of these rules.

For example, an advertising company from a third country uses an AI system to create a deepfake of a celebrity for an advertisement shown in the EU. Such a company may be considered a deployer within the scope of the EU AI Act.

🟩 Code of Practice for AI-Generated Content: Why It Matters Even If It Is Voluntary

On 10 June 2026, the European Commission published the final Code of Practice on transparency for AI-generated content.

This is a practical guide for companies on how to properly inform people that a text, image, video, voice, or other type of content was created with the help of AI.

The Code was prepared by independent experts. The AI Office, the dedicated EU body dealing with AI-related matters, also participated in the process.

Signing up to this Code is voluntary. In theory, a company may say: “We will not sign the Code. We will do everything our own way.”

But Article 50 of the EU AI Act itself remains mandatory.

In other words: the Code is voluntary, but the law is not.

In practice, the Code serves one main purpose: it shows companies how they can comply with the requirements of Article 50.

The Code has two main parts.

🟢 The first part is for providers of AI systems: companies that create or provide AI tools. For example, services that generate text, images, video, voice, or other materials.

They must think about how to ensure that AI-generated content can be:

• labelled

• recognised

• technically detected

🟢 The second part is for companies and organisations that use AI systems.

For example, if a company uses AI to create a deepfake, synthetic voice, AI-generated video, or text on a matter of public interest, it must clearly disclose that AI was used.

Companies that sign the Code will be able to use it as evidence:

“We comply with Article 50 not only in words, but according to clear rules.”

Companies that do not join the Code may still comply with the law in another way. But then they will have to prove themselves that their transparency system is sufficiently reliable.

That is why the Code of Practice may become a real market standard. If a company uses the Code, it will be easier to explain to the regulator that it tried to comply with the law. If a company does not use the Code, it needs to have its own strong, clear, and well-documented system.

Otherwise, the regulator’s question will be very simple:

“All right, you did not use the Code. Then show us exactly how you complied with Article 50.”

🟩 AI-Generated Content Labels: Metadata, Watermarks, Detection Tools and EU Icons

Labelling is not one icon and not one phrase saying “created by AI”. It is a multi-layered system: metadata, watermarks, detection tools, and clear notices for people.

🟢 Metadata

The Code of Practice expects companies to record information in metadata about whether content was created or modified with the help of AI, where the file format supports metadata. This information should be protected by a digital signature. If the time of creation or modification is available, a protected timestamp should also be added.

Metadata helps transfer information about the origin of content between tools, platforms, and archives.

But metadata has a weak point: it is easily lost. For example, when content is uploaded to social media, compressed, converted into another format, or re-saved. That is why metadata alone is not enough.

🟢 Watermarks

The Code also expects AI-generated or AI-modified content to contain a watermark.

Watermarks are useful because they may remain embedded inside an image, audio, video, or text even when ordinary metadata has been removed.

But they are not perfect either. They can be weakened by cropping, reformatting, re-recording, translation, paraphrasing, or deliberate attacks.

🟢 Preserving Existing Labels

The Code expects companies to make efforts to preserve existing metadata and labels when an AI system uses content as input and then modifies it. Usage policies, terms of service, or documentation should also prohibit the intentional removal or damaging of such labels, except in lawful cases.

🟢 Detection Tools

The Code expects companies to provide detection tools so that users can check whether content was created or modified by a specific AI system.

This is because machine-readable labelling only makes sense if someone is actually able to read it.

🟢 EU Icons for AI-Generated Content

The European Commission has published specific icons for labelling AI-generated content.

In simple terms, these are small symbols that can be placed next to a text, image, video, or audio file so that a person immediately understands: artificial intelligence was used here.

These icons are not decorative. Their purpose is to help an ordinary person quickly understand that the content in front of them is not fully “human” content, but material that was created or modified with the help of AI.

The icons may be used in several situations:

• when content was fully created by AI

• when real content was partly modified by AI

• when the content is a deepfake

• when AI-generated text is published to inform the public on a matter of public interest

For example, if AI fully creates a video showing a fictional event, the “Fully AI-generated” icon may be used.

If there was a real photograph, but AI replaced a person’s face or changed an important part of the image, the “Partially AI-modified” icon may be used.

If a company publishes an AI-generated news summary or an explanation of a matter of public interest without proper human editorial review, this may also require disclosure.

🔺The EU icons are voluntary.

A company is not required to use these exact icons. It may create its own labelling, for example: “Created with AI”, “Image modified by AI”, or “You are viewing AI-generated content”.

But the obligations under Article 50 of the EU AI Act remain mandatory. In other words, a company may choose not to use the EU icon, but it cannot simply stay silent if the law requires disclosure.

The label must be clear, visible, and accessible. A person should see it at the moment of first contact with the content — not after they have already believed the video, read the text, or shared the post.

The icon should not be hidden by other interface elements. Where possible, it should remain attached to the content even if the content is downloaded or forwarded further.

This is a way of telling the person: “Be careful, this material was created or modified with the help of artificial intelligence.”

For businesses, this is also a matter of evidence. A company must be prepared to show not only the icon, but the entire logic behind it: where AI was used, what content was created, why this type of labelling was chosen, who checked it, and how the user could see it.

It is like a road sign on the road: the sign itself matters, but behind it there must be rules, markings, responsibility, and control.

🟩 AI Watermarking and C2PA: Metadata, Content Credentials and AI Content Detection

Article 50 of the EU AI Act requires AI-generated content to be not only understandable to people, but also technically detectable. In other words, if a text, image, video, or audio file was created or modified with the help of AI, the system must help make this recognisable.

But the law does not force everyone to use one specific technology. It says something simpler: the solution must be sufficiently reliable, effective, interoperable, and robust — as far as this is possible with current technology.

Different methods may be used, including:

• watermarks

• metadata

• cryptographic signatures

• activity logs

• digital fingerprints

• other methods for detecting AI-generated content

In practice, this works as several layers of protection.

▫️Metadata is technical information inside the file. It may show that the content was created by AI, which tool was used, and when it was created

▫️A cryptographic signature is like a digital seal. It helps verify whether the metadata was changed after the file was created

▫️A watermark is a visible or hidden signal inside the content. It helps determine whether a text, image, video, or audio file is connected to AI

▫️A digital fingerprint is a unique trace of a file. It helps recognise the content or modified versions of it

▫️Detection tools help platforms, users, and regulators check AI labelling

▫️Internal company logs show who created the content, who reviewed it, who approved it, and where it was published

The C2PA standard and related Content Credentials are especially important.

C2PA is an open standard that helps show the provenance of digital content: where a file came from, how it was changed, and whether AI was used in the process.

C2PA does not prove that the information is true. It shows where the file came from, what changes were made, and whether the provenance data can be trusted.

For example, if a photo has Content Credentials, a person can view the history of that photo. But this does not mean that the news story or caption attached to the photo is automatically true.

The European transparency Code places strong emphasis on digitally signed metadata, invisible watermarks, the preservation of labels, and information about content provenance.

There is no perfect solution yet. A 2025 study showed that only some AI image generators already use sufficiently developed practices for watermarking and labelling deepfakes.

Another study on watermarks for large language models points to a similar problem: there is still no single solution that perfectly meets all the requirements of the AI Act at once — reliability, interoperability, effectiveness, and robustness.

Businesses should not wait for the perfect technology. They need to start building a reasonable system now: using metadata, watermarks, C2PA, or other suitable solutions, documenting internal processes, and preserving evidence.

🟩 Deepfakes Under the EU AI Act: Where the Disclosure Line Is Drawn

Deepfakes are one of the most sensitive points under Article 50. The European Commission describes a deepfake as an image, audio, or video created or manipulated by AI that resembles existing persons, objects, places, events, or entities and may falsely appear to a person to be authentic.

In practice, difficult questions immediately arise:

❔ If only the background is replaced, is that already a deepfake
❔ If AI slightly improves a person’s face, is that a substantial modification
❔ If a synthetic voice is used with the actor’s consent, is a label required
❔ Should a historical reconstruction be labelled
❔ What should be done with a stylised image if it is based on a real person
❔ What if an advertising character is not a real person, but strongly resembles a well-known public figure

This is where the grey zone begins.

The EU AI Act leaves room for disputes: what counts as synthetic manipulation, where ordinary editing ends, and how significant a modification must be before a disclosure obligation arises.

For businesses, the safer approach is to be conservative.

If content creates the impression of a real face, place, event, or statement, but was actually created or modified by AI, the risk under Article 50 is high.

Particular care is needed with:

• political communication

• news and public-interest content

• advertising using images of celebrities or realistic testimonials

• synthetic voices

• images of real people in fictional circumstances

• videos that imitate real events

If a person could believe that something is real, even though it was created or modified by AI, it is safer to disclose the AI origin of the content.

🟩 AI-Generated Advertising and Marketing: The Most Tense Compliance Area

Advertising teams are already using generative AI for product images, backgrounds, models, voice-overs, banners, personalisation, creative testing, and localisation.

In June 2026, Reuters reported that a retail association had called for AI-generated advertising to be exempt from the EU transparency rules.

The industry’s argument is understandable: if every advertising material where AI was used even slightly has to be labelled, this will create costs, unnecessary friction, and confusion for consumers.

But Article 50 does not contain a general exemption for advertising.

The regulator’s logic is simple: advertising can also mislead people.

• A synthetic model may look like a real customer

• An AI-generated product image may show features the product does not actually have

• A synthetic review may imitate a real buyer

• A synthetic celebrity may create the false impression of endorsement

The analysis by Gleiss Lutz also emphasises that advertisers and advertising service providers need to prepare, because AI-generated product images, synthetic voice-overs, and AI-generated testimonials are already widely used in the industry.

The closer an advertisement is to a real person, a real event, an actual product feature, or a statement of public importance, the stronger the argument for clear labelling becomes.

🟩 Publishers and Media: AI-Generated Texts on Matters of Public Interest

Not every text written with the help of AI will automatically need to be labelled.

The rule applies to a specific situation: when an AI system has created or modified a text, and that text is published to inform people on a matter of public interest.

If the text may influence public opinion, people’s safety, elections, health, rights, money, or the understanding of laws, it should be treated with greater caution.

❔Who does this specifically concern:

• news organisations

• reviews of laws and political decisions

• short AI-generated summaries of court decisions

• health and safety materials

• election-related information

• financial and regulatory warnings

• important public statements by companies

🔺Important: Article 50 does not prohibit journalists, newsrooms, or publishers from using AI.

For example, AI may be used for a draft, structure, translation, short summary, or editorial assistance.

The regulator’s main question will be this: was there real human control afterwards?

If a person reviewed the text, corrected errors, checked the facts, edited the material, and the newsroom took responsibility for the publication, disclosure of AI use may not be required.

If AI helped write a draft, this does not necessarily create a problem. But if AI wrote the text itself and it was immediately published for the public without disclosing that it was AI-generated, this may already be a violation.

Even if you checked everything and decided that labelling is not required, it is still better to preserve the full internal process of creating the material inside the newsroom:

❔which AI tool was used
❔who reviewed the text
❔which facts were checked
❔who bears editorial responsibility
❔how the process was documented

This way, if necessary, you can use this record to confirm that the text was reviewed and edited by a human.

🟩 EU AI Act Compliance Checklist: What Businesses Should Do Before 2 August 2026

Preparing for Article 50 is not about writing a beautiful document “about AI ethics” that sits in a folder and no one ever opens.

Ask yourself a simple question: where does our product, text, advertising, video, voice, or image come into contact with AI?

Businesses need a simple working system: where we use AI, what content it creates, who is responsible for it, where a label is required, and what evidence we preserve.

The goal is to make sure that, at every stage of working with AI, the company understands where a risk of violating the law may arise.

🟢 Create a Map of AI Content

First, you need to understand where your organisation uses AI. Record all places where AI creates, changes, or helps publish content:

• image generators
• video generators
• synthetic voice-over tools
• chatbots and virtual assistants
• AI avatars
• marketing AI tools
• editorial systems
• translation and localisation tools
• automatic summaries

Separately, check external contractors: agencies, designers, marketers, editors, and IT teams. If a contractor uses AI for your company, this must also be included in the map.

🟢 Separate the Roles: Who Is the Provider and Who Is the Deployer of AI

Determine what role your organisation plays. You may be:

• a provider of an AI system
• a deployer of an AI system
• both provider and deployer at the same time

This is important to record in contracts.

For example, the provider of an AI tool may be responsible for machine-readable labelling. But the company that publishes a deepfake, advertisement, or AI-generated text on a matter of public interest may still be responsible for clear disclosure to people.

You cannot shift everything onto “the service that generated the image”. If you publish the content, you may also have responsibility.

🟢 Divide Content into Categories

After mapping your AI use, you need to understand what type of AI content you have and divide it into categories:

• a person directly interacts with an AI system
• AI creates audio, images, video, or text
• AI only slightly edits content without changing its meaning
• there is a risk of a deepfake
• AI creates text on a matter of public interest
• the text is reviewed by a human and there is editorial responsibility
• the content is created for a specific lawful purpose, for example law enforcement

This will help you quickly understand where a label is needed, where disclosure is required, and where the risk is lower.

🟢 Choose Technical Measures

If you are the provider of an AI system, check the technical side:

❔what metadata is recorded
❔whether digital signatures are used
❔whether watermarks are applied
❔whether AI-generated content can be detected
❔whether labelling is preserved during export
❔what happens during compression, upload, or format conversion
❔how the user can verify the origin of the content

🟢 Think About How Your Customer Will See That They Are Dealing with Synthetic Content

If an AI label or warning is required, it must be understandable:

• not hidden at the bottom of the page

• not buried in long terms of use

• not written in grey text that no one reads

The information must be clear, visible, accessible, and shown no later than the first contact or first view.

Examples of how this should be implemented:

• a chatbot must immediately say that it is an AI system

• a deepfake must be labelled as artificially created or modified

• an AI-generated text on a matter of public interest must include an explanation that it is generated text, but only if there is no human editorial control

🟢 Train Your Team to Work Transparently with AI

Even a good policy will not help if the team does not understand how to apply it. A marketer, designer, editor, product manager, or social media specialist must know exactly:

❔when to apply an AI label
❔when to go to the legal team
❔when to preserve metadata
❔when labelling must not be removed
❔when human review is required
❔how to record who approved the publication.

🟢 Preserve Evidence

If the regulator asks you, “How did you comply with Article 50?”, it will not be enough to say: “We tried.” You will need to show documents and traces of the process to reduce the risk of a fine.

I recommend creating and preserving records of the following:

• an AI content policy

• creation and publication logs

• records of the labelling applied

• evidence of human review

• contracts with providers and contractors

• results of detection tool testing

• records of team training

• assessments of exceptions

• incident response procedures

Preparing for Article 50 is not one document. It is a system.

🔺If you cannot prove that you did everything correctly, then for the regulator it may look as if you did not do it at all.

To build an effective system that helps protect you from risks, it should answer the following questions:

• where AI is used in your business processes

• what content is created with the help of AI

• who is responsible for creating AI-generated content

• where a “made with AI” label is required

• where human review of the product is required

• what evidence of AI product review is preserved

🟩 Open Questions: AI Watermarking, Metadata Loss and the Grey Zone

The EU transparency regime looks strong and logical. But in practice, it still leaves many questions unanswered.

🔺The Technology Is Not Fully Ready Yet.

The law requires labelling methods to be effective, interoperable, robust, and reliable. But technical standards are still developing.

For example, C2PA can help confirm the provenance of content. But this standard is not yet used everywhere. In addition, metadata can disappear when content is uploaded, compressed, edited, or published on social media.

🔺Watermarks Are Not Always Reliable

Watermarks in images can degrade after processing, cropping, or format conversion. Watermarks in text are, frankly, almost absurd.

Research on watermarks for large language models still does not offer an adequate solution.

🔺Content Passes Through Too Many Hands

The same file can go through a long chain:

1. the AI system provider applies a label

2. the user adds a watermark

3. the platform compresses or changes the file

4. another person downloads it

5. a third party reposts it

Who is responsible, and what evidence remains?

🔺It Is Not Always Clear Where Simple Editing Ends and AI Manipulation Begins.

Sometimes AI simply helps: it corrects a text, improves the quality of an image, or translates material.

But sometimes AI seriously changes the meaning: it creates a new face, voice, scene, event, or statement.

The line between “ordinary AI assistance” and “substantial AI manipulation” is not always obvious. That is why businesses need their own internal rules now, without waiting for the first court decisions and fines.

🔺AI Advertising Will Remain a Disputed Area.

Marketing and retail will insist that not every AI-generated advertisement should be labelled. Their argument is understandable: if every banner, image, or background carries a label, this may overload the user and make them think that all visual information is synthetic fiction.

Supporters of AI transparency will argue the opposite: advertising can also mislead people, especially when it uses synthetic people, voices, reviews, products, or celebrities.

For this reason, AI advertising will most likely become one of the most disputed areas.

🔺The Code of Practice Is Voluntary, but Ignoring It Is Risky.

The Code of Practice is formally voluntary. An organisation may choose not to sign it and still comply with the law in other ways.

But there is an important nuance: the Code may become a practical reference point for the market and regulators. If a company follows the Code, it will be easier to show that it tried to comply with the rules. Later, this may also make it easier to win new contracts and develop in the market.

If a company does not follow the Code, it will have to work harder to prove that its own measures were sufficient. That may not sound very convincing to clients and investors.

The law is already moving faster than ordinary business processes. That is why it is better to build a system in advance, rather than search for explanations after the regulator asks the first question.

🟩 Main Conclusion: The AI Label Is the Beginning of AI Compliance

The AI label coming in 2026 is not simply a notice saying “made with AI”. It is a new system of control.

Businesses will need not only to apply a label, but also to prove:

❔where AI was used
❔what content it created or modified
❔who reviewed it
❔where the user saw the warning
❔what evidence the company preserved

For providers of AI systems, the main work will be technical. They will need to build metadata, watermarks, machine-readable labelling, and AI content detection tools into their products.

For deployers of AI systems, the main work will be organisational. They need to understand in advance when content may qualify as a deepfake, when a text concerns a matter of public interest, when an AI label is required, and when human review may be sufficient.

For marketers, publishers, and newsrooms, the main lesson is simple: AI transparency must be considered before publication, not after.

If a video has already spread across social media, an advertisement has already been launched, or a text has already been read by thousands of people, it may be too late to remember the label. The original file, metadata, and review history may already have been lost.

For platforms and AI tools, the main challenge is preserving technical signals. If the label disappears during upload, compression, editing, or reposting, the entire system loses its meaning.

The EU wants to make AI-generated content understandable both to people and to machines. The idea is right. But the technology is not yet perfect, businesses are not ready, and people will still look for ways to bypass inconvenient rules.

The market will split into three zones:

▫️The white zone — companies that honestly integrate AI transparency into their processes. They will spend money on lawyers, engineers, team training, and evidence systems.

▫️The grey zone — companies that apply labels only formally. On paper, everything will look fine, but in practice no one will understand who created the content, where the metadata is, or why the label disappeared.

▫️The black zone — services and users that remove labels, bypass the rules, and operate outside normal regulation.

More likely, the law will create a new and expensive infrastructure around AI.

• Some will pay for compliance

• Some will make money from compliance

• Some will bypass compliance

• And some will pay fines

But for businesses, the main question is already clear.

Not: “Can we use AI?”

The real question is this:

“Can we prove that we used AI transparently, lawfully, and under control?”

The companies in the strongest position will not be those that add a “created with AI” note at the last moment.

The strongest position will belong to those that understand in advance:

• where AI is used

• who is responsible for it

• where a label is required

• where human review is required

• what evidence must be preserved

• what to do if the regulator asks questions

The AI label is not the end of the work.

It is the beginning of a new reality: AI can still be used, but it is no longer possible to pretend that no one needs to understand where exactly it was used.

💬 EU AI Act 2026 FAQ: AI Labels, Watermarking, Fines and Article 50

❔When Do the Rules for AI-Generated Content Start Applying

The main date is 2 August 2026. From this date, the transparency obligations under Article 50 of the EU AI Act start to apply.

For some AI systems that were already on the market before 2 August 2026, a transitional period applies until 2 December 2026.

❔Does Every AI-Generated Text Need to Be Labelled

No. Not every AI-generated text needs to be labelled.

The rule applies to texts that are:

• created or modified by AI

• published for a broad audience

• intended to inform people on a matter of public interest

For example: news, elections, health, laws, people’s rights, safety, and finance.

An ordinary email, draft, product description, or internal document does not automatically fall under this rule.

If the text was reviewed by a human, edited by a newsroom, and responsibility for the publication was taken by a person or organisation, labelling may not be required.

❔Are the EU Icons Mandatory

No. The EU icons are not mandatory.

But the obligation to disclose AI-generated content remains mandatory where Article 50 applies. In other words, a company may choose not to use the specific EU icon, but it cannot remain silent if the law requires that a person be informed.

Important: the icon itself does not prove that a company complies with the law.

❔Is C2PA Mandatory

No. The law does not require the use of one specific standard.

C2PA is useful because it helps show the provenance of a file: who created it, how it was changed, and whether AI was used.

But Article 50 does not require a specific technology. It requires a result: AI-generated content must be understandable to people and technically recognisable.

❔Does AI-Generated Advertising Need to Be Labelled

Not always, but the risk is often high. The law does not contain a general exemption for advertising.

Labelling may be required if the advertisement:

• uses a deepfake

• shows a synthetic person

• uses an AI-generated voice

• imitates a real customer or celebrity

• shows a product in a way that may make people believe in false features

• concerns a matter of public interest

If AI-generated advertising may look like an authentic scene and mislead a person, it should be treated with caution.

❔What Fines Are Possible

For violating the transparency obligations under Article 50, the fine may be:

• up to EUR 15 million

• or up to 3% of the company’s annual turnover

The higher amount applies. For small and medium-sized enterprises, including start-ups, a more lenient rule applies.

The key point is this: companies are not fined simply for using AI.

The risk arises when a company uses AI but does not explain this to people, does not preserve evidence, and cannot show that it acted transparently.

If you have read this far, thank you.

AI regulation may look technical, but in reality it is about trust: who created what, who checked it, who is responsible, and whether people can still understand what is real.

I will continue writing about this in plain language.

See you in the next piece.

Cheers,