Since yesterday, it is no longer theoretical: Article 50 of the EU AI Act is now in force. Providers of AI systems must actively inform people when they are interacting directly with AI, and mark AI-generated or manipulated content in a machine-readable format. For deepfakes and AI content on matters of public interest, additional disclosure obligations apply to deployers.
This month, the European Commission published the guidelines and a Code of Practice. The easy misconception is: "this only applies to AI specialists or AI companies", but that is not the case. Article 50 affects every company and/or service that publishes, sends or displays AI content to people, including marketing, communications, customer service, HR, public affairs, media, and so on.
A chatbot talking to customers? AI-generated images on social media or in your communications? AI promotional videos? Then this applies to you.
What this means in practice:
1️⃣ Map where AI content is created across your organisation, including by external suppliers.
2️⃣ Introduce a simple process: which content type requires labelling, which requires disclosure, and which requires neither.
3️⃣ Assign an owner for each service and/or content type who is responsible for that decision.
4️⃣ Keep evidence of human review, not because this is mandatory for every piece of content, but because it strengthens your position if you do need to demonstrate it.
5️⃣ Explicitly ask suppliers whether they support machine-readable marking; not every tool does yet. Machine-readable means either a visible or invisible marker, through metadata or a visible or invisible watermark, in such a way that software can classify the content as AI-generated. There is an exception to the marking requirement for systems that were placed on the market before 2 August; they have a grace period until 2 December, but that deadline is approaching quickly. Content from before 2 August does not need to be labelled retroactively.
Fines can reach EUR 15 million or 3% of worldwide turnover. While GDPR caused a major shift for many companies at the time, AI content is still often treated as an afterthought, even though fines can rival with those of GDPR.
Who in your organisation is responsible if marketing publishes an AI-generated video tomorrow? If the answer is "I don't know", there is still some homework to do. 😉
