How to Disclose AI-Generated Content Under the EU AI Act

Article 50 of the EU AI Act became enforceable on 2 August 2026, and it applies to your business whether you run a small blog or a mid-sized e-commerce operation. The obligation is straightforward in principle: if you deploy AI systems that interact with users, generate content, or produce deepfakes, you must tell people about it, clearly and upfront. Getting that right in practice takes more than adding a footnote to your terms and conditions.

This guide walks you through every step of building a compliant AI-generated content disclosure process on your WordPress site, from understanding what the law actually requires to documenting your approach so you are ready if a national authority comes calling.

What the EU AI Act requires for content disclosure

The EU AI Act’s transparency obligations are concentrated in Article 50, which sets out four distinct duties covering different AI use cases. Providers of interactive AI systems (such as chatbots) must design those systems to disclose that users are interacting with AI. Providers of generative AI systems must mark outputs in a machine-readable format. Deployers using emotion recognition or biometric categorisation systems must inform the people being assessed. And deployers who publish AI-generated content on matters of public interest, or who create deepfakes, must disclose this to their audience.

One point that trips up many SMB owners: Article 50 obligations are not limited to high-risk AI systems. They apply to any AI system used in the four situations the article covers. A business with no high-risk AI classification may still carry significant Article 50 obligations. The European Commission published its final guidelines on AI transparency on 20 July 2026, giving organisations a practical reference point. Non-compliance carries fines of up to €15 million or 3% of global annual turnover, whichever is higher, with the lower figure applying to SMEs and start-ups.

The Act also reaches beyond EU borders. Any organisation deploying AI systems that reach EU audiences falls within scope, regardless of where the business is headquartered. If your WordPress site serves readers in Germany, France, or any other EU member state, Article 50 applies to you.

Identify which of your content falls under the Act

Start by auditing every piece of content your organisation publishes and every AI tool involved in producing it. Article 50 covers four content modalities: audio, image, video, and text. Not every AI-touched asset triggers a disclosure obligation, so your goal is to sort content into three categories: clearly in scope, clearly out of scope, and uncertain.

1. Map your AI tools to content outputs. List every AI system your team uses, whether that is a large language model for blog drafts, an image generator for social graphics, a chatbot on your website, or an AI video tool. Record what each tool produces and where that output is published.
2. Apply the three-part test for text. AI-generated text falls under Article 50(4) only when it meets all three criteria: it is AI-generated or AI-manipulated; it is published (accessible to a large, indefinite audience); and it is published with the purpose of informing the public on matters of public interest. The Commission Guidelines define “public interest” broadly to include health, environment, consumer protection, and economic or political developments.
3. Check for deepfakes separately. A deepfake is AI-generated or manipulated image, audio, or video content that resembles real persons, objects, places, or events and could pass for authentic. The deepfake rules apply even without any intent to deceive, and they apply even to artistic or satirical works, though with a reduced rather than eliminated disclosure duty.
4. Identify what is out of scope. AI that performs only assistive editing functions, such as grammar correction or spell-checking, and does not substantially alter the meaning of the content, does not trigger Article 50. Clearly stylised illustrations that no reasonable person would mistake for authentic also generally fall outside the deepfake definition.

After completing this audit, you should have a documented list of content types and the Article 50 obligation, if any, that applies to each. Content generated before 2 August 2026 does not need to be labelled retroactively, though the Commission encourages deployers to do so where practical. The audit output becomes the foundation for every step that follows.

Choose the right disclosure method for each content type

With your content inventory complete, select a disclosure method that matches each content modality. The Code of Practice on AI-generated content, assessed as adequate by the Commission on 8-9 July 2026, mandates a layered approach combining digitally signed metadata, imperceptible watermarking, and optional fingerprinting or logging as a fallback. No single technical solution currently meets all the required criteria of being effective, interoperable, robust, and reliable, which is why the layered approach is required.

Modality-specific disclosure requirements

Each content type has its own prescribed disclosure format under the Code of Practice:

• Images: Display a visible AI icon alongside the image. C2PA Content Credentials (cryptographic provenance metadata) are identified as a practical method for satisfying the machine-readable marking requirement.
• Video: Include a disclaimer at the beginning of the video or display a persistent AI icon in a fixed position throughout.
• Audio: Play an audible disclaimer. For long-form or background audio, the disclosure must be repeated at later points in the content, not only at the outset.
• Text (public interest): Display a clear, visible label indicating the text is AI-generated. A standardised EU visual label using the letters “AI” (localised as “KI” in German, “IA” in French) has been proposed under the Code of Practice.

The editorial responsibility carve-out for text

Deployers of AI-generated text published on matters of public interest can avoid the disclosure obligation if two conditions are met: the content has undergone genuine human review (deliberate examination of the substance by a person with relevant professional knowledge and judgment), and a natural or legal person holds editorial responsibility for the publication. The Commission Guidelines interpret this exception narrowly. A quick proofread does not qualify as genuine human review. If you intend to rely on this carve-out, you need a documented editorial process and a named person or entity assuming full responsibility.

One important distinction: as a deployer, you cannot rely solely on machine-readable metadata embedded by the AI provider to fulfil your own disclosure obligation. Your disclosure must be independently perceivable by users without any technical tools.

Add disclosures to your WordPress content workflow

Translating Article 50 requirements into your day-to-day WordPress publishing process is where compliance becomes practical. Several WordPress plugins now address this directly, and choosing the right one depends on which obligations apply to your content mix.

1. Install a purpose-built Article 50 plugin. Legibright AI Act Compliance (free on WordPress.org) adds a chatbot disclosure notice, a checkbox in the post and page editor to flag AI-generated content and images, and a compliance dashboard. AIActify adds the official EU pictogram from the Code of Practice plus Schema.org and IPTC metadata, with a paid upgrade for automatic content detection and an audit trail. EU AI Act Ready covers text, images, audio, and video disclosure plus AI chatbot disclosure, and includes a readiness score and exportable compliance report.
2. Configure chatbot disclosure. If your site runs an AI-powered chat widget, configure it to display a clear AI disclosure at the moment of first interaction. This must be a visible, upfront interface element, not a notice buried in your FAQ or privacy policy.
3. Mark AI-generated posts at the time of creation. Use the plugin’s editor checkbox or metadata field to flag each post, page, or image as AI-generated at the point of publication. Plugins like StudioMeyer Transparency Toolkit include a bulk-action feature for marking multiple posts at once, which is useful if you are catching up on a backlog.
4. Embed machine-readable metadata in images and media. For images and video, ensure your AI generation tool or image editor writes C2PA-compatible metadata. Check that your WordPress media library preserves this metadata on upload, as some image optimisation plugins strip metadata by default.
5. Verify the disclosure appears at first exposure. After configuring each disclosure type, view the content as a logged-out visitor and confirm the label or notice appears before or at the moment of first engagement, not after scrolling or clicking through.

If you are producing AI-generated content at scale, a managed workflow makes a measurable difference. WP SEO AI’s Scaling Content Output service integrates AI content production with human editorial oversight inside WordPress, which supports the kind of genuine human review that the editorial responsibility carve-out requires. That said, every step above is achievable with the free plugins listed, and the guide works without any additional service.

Document your compliance process for audit readiness

Implementing disclosures is only half the work. National market surveillance authorities in each EU member state have enforcement responsibility for Article 50, and they can request evidence that your disclosures are compliant. The gap between having a disclosure in place and being able to demonstrate compliance to an auditor is where organisations face their greatest legal exposure.

1. Create a content inventory log. Maintain a running record of every AI system used in content production, the type of content it generates, and the disclosure method applied. A simple spreadsheet works. Record the tool name, content type, publication URL, disclosure method, and the date disclosure was implemented.
2. Document your editorial review process. If you are relying on the editorial responsibility carve-out for any AI-generated text, write down the review process: who reviews, what they check, and how editorial responsibility is assigned. The burden of proof rests with you to show the review took place.
3. Keep records of provenance markings. Save evidence that machine-readable metadata was embedded in your media files. Most C2PA-compatible tools generate a log or certificate; store these alongside your content inventory.
4. Record exception analyses. For any content you have decided falls outside Article 50 scope (for example, AI-assisted grammar editing or clearly stylised illustrations), document the reasoning. If a competent authority questions your classification, you need a paper trail showing you applied the three-part test deliberately.
5. Set a review cadence. Article 50 obligations and Commission guidelines can be updated as AI technology advances. Schedule a quarterly review of your compliance documentation to catch any changes that affect your content workflows.

The Code of Practice requires signatories to develop and maintain internal compliance documentation proportionate to the size and resources of the deployer. For an SMB, this does not need to be an extensive legal document. A maintained spreadsheet, a written editorial policy, and a folder of metadata certificates will satisfy the proportionality standard while giving you a credible response if authorities ask.

Verify your disclosures meet regulatory standards

Before treating your compliance process as complete, test each disclosure against the Article 50(5) standard: information must be provided “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure” and must conform to applicable accessibility requirements. Vague labels or disclosures buried in terms and conditions do not meet this threshold.

Run through this verification checklist for each content type you have configured:

• Timing: Does the disclosure appear before or at the moment of first exposure, without requiring any user action?
• Clarity: Does the label clearly indicate the content is AI-generated, rather than using ambiguous terms like “AI-assisted” or “AI-enhanced”?
• Accessibility: Is the label perceivable by users with disabilities? For audio content, is there an audible disclosure? For visual labels, do they meet contrast standards?
• Independence: Does your user-facing disclosure stand on its own, without requiring users to have any technical tools to detect it?
• Audience calibration: The Commission Guidelines assess the “obvious interaction” threshold against a reasonably well-informed person from your actual audience. If your audience includes children, elderly people, or people with disabilities, apply a lower threshold for what counts as obvious.

Adherence to the Code of Practice is the only current EU-wide tool assessed as adequate for demonstrating Article 50 compliance, but it does not constitute conclusive evidence of compliance. Competent authorities retain the ultimate responsibility for assessing whether requirements have been met. If you choose not to sign the Code of Practice, you will need to demonstrate compliance through alternative means and may face greater regulatory scrutiny.

Common EU AI Act disclosure mistakes to avoid

Article 50 became enforceable just days before this guide was written, and several patterns of non-compliance are already visible from compliance analysis and Commission guidance. Knowing these in advance saves you from fixing avoidable problems under time pressure.

• Assuming the Act was delayed. Headlines about the EU Digital Omnibus deferring high-risk Annex III system deadlines led many organisations to assume the entire Act was pushed back. Article 50 transparency obligations were not deferred. They became enforceable on 2 August 2026 as scheduled, with only a four-month grace period (until 2 December 2026) for the machine-readable marking obligation under Article 50(2) for generative AI systems already on the market before that date.
• Treating disclosure as a documentation task rather than a UX task. A chatbot disclosure buried in an FAQ page technically exists but does not meet the “clearly informed at first interaction” standard. Disclosure must be a visible, upfront interface element.
• Relying on provider-level disclosure as a deployer. If you deploy an AI tool built by a third party, the provider’s machine-readable metadata does not substitute for your own user-facing disclosure. Both obligations exist independently.
• Using vague labels. Terms like “AI-assisted” or “AI-enhanced” may not satisfy Article 50 requirements if they fail to distinguish AI-generated content from human content that was lightly refined with AI tools. Use specific, unambiguous language.
• Misclassifying deepfakes. Deepfake rules apply to any photorealistic AI-generated content resembling real people, places, or events, regardless of intent to deceive. Clearly stylised illustrations generally fall outside the definition, but when in doubt, apply the label.
• Invoking the editorial responsibility carve-out without documentation. Having a human glance at AI text is not sufficient. Genuine review requires deliberate examination of substance by a person with relevant professional judgment, and a named entity must hold editorial responsibility. Document every step of this process.
• Overlooking accessibility requirements. Every disclosure must be perceivable by users with disabilities. Check that visual labels meet contrast standards and that audio content carries an audible disclosure.
• Conflating Article 50 with the high-risk AI compliance workstream. Article 50 applies regardless of whether your Annex III high-risk classification review is complete. These are separate compliance workstreams and should be managed independently.

The Article 50 transparency rules are now in force, and the practical guidance from both the Commission and the Code of Practice is detailed enough to act on today. Work through each step in this guide, keep your documentation current, and review your setup quarterly as the regulatory landscape continues to develop.

This content was generated with the help of AI and it may contain mistakes