AI Act, okay. But could it be investigated?
An auditor asks: “Prove to me that this specific piece of content was marked on the day you published it.”
Can you?
But will anyone actually come and check?
In short, yes and the methodologies already exist for it as they were built way before the AI Act.
The longer answer is more useful, so here it is.
First things first, what we go over is what an auditor would do, not just for the AI Act, but also for every other act out there in the EU.
On a Monday, your national market surveillance authority goes to work and gets an email about a complaint. This could be from a journalist, or a regular citizen who hates AI content, or more importantly, your competitors.
The risk is “is there anybody who points at me”.
Under other articles, these complaints then get reviewed as the law requires and then you get a letter.
This letter will contain requests for information listing what they want, the deadline is usually between two and four weeks.
This deadline is your entire case. What you can produce then is your defence. Important to note, what you can’t produce is a gap. If you start labeling images as the deadline is on, the auditor will flag them as trying to hide evidence. There is no difference between “we did it but can’t prove it” and “we did not do it”.
You won’t get your systems compliant and verifiable in those weeks.
What they likely ask for is for you to list:
- Every AI system you use in the business and what it is used to produce (text, image, video, audio etc.)
- Are you a provider or a deployer? (link to our previous article).
- Proof of disclosures, what the user sees so they can determine if it’s meeting obligations.
- For AI content, they will ask why you deem it human-made, what review or changes have been added to it.
- Then they will ask for when the review of the content was done, who decided and who is the one taking responsibility for it.
What a breach costs:
Article 50 breaches are on the higher tier, with up to 15 million euro or 3% of your global annual turnover, whichever is more.
Realistically, enforcement will be slow to start. But as we have seen, even GDPR with its hidden implications is enforced. Do you think your publicly available and publicly seen articles will survive an auditor, who is looking to get companies compliant?
To meet your obligations
We give a simple, tamper-evident record of who reviewed a piece of AI-assisted content and when, so “we had a human or AI review this” isn’t just something you say when a regulator calls, it’s something you can prove.
Free until 2 December 2026.
