Used AI. You’re on the hook
Your marketing team, or the agency you hired, uses AI to produce the post. They don’t think much of it. Why would they? It has been done this way for months.
You won’t know either, because nobody filled you in. Why would they? You can’t do all the work yourself.
But the post was published by your company.
Your obligations attach to what you publish, not to who invoiced you for the work. So you are the one who gets the first complaint, and the first questions from an auditor.
Under the AI Act you need to be able to show that the review happened. If that review took place inside another company, by staff you do not employ, how do you prove it? And if the agency moves on, who is left to ask?
The questions keep coming. But so do the answers.
What to actually do
Get proof of the review, not a promise of one
A clause saying they reviewed it is the agency asserting something. Better than nothing, but it is not evidence, and it is worthless once there is nobody left to ask.
Make the review say who did what, when, and how
One line in every brief does most of the work: did AI generate or edit any part of this? If so, which parts, and which tool?
Put the record with an independent third party
So that verifying it does not depend on trusting you, or the agency, or anyone with a reason to want a particular answer.
Make it tamper-evident
A record anyone could quietly edit afterwards proves nothing. The point is that a change would be visible.
Make it easy to reach
When an auditor or a client asks, proving how the obligation was met should take minutes, not a weekend of digging through Slack and old drafts.
Worth knowing before you act on any of this
Four things the shorter version of this post would have skipped
Not all of your agency’s output is in scope. Article 50(4) covers text published to inform the public on matters of public interest. A product page or an ad is commercial communication and falls outside it entirely. Say so in your contract. Narrowing the claim honestly is what makes the rest of it credible.
The exemption has two parts, not one. It needs human review or editorial control, and a person or company holding editorial responsibility. Both. A review with nobody accountable for publishing does not get you there.
This is live, not coming. The transparency obligations in Regulation (EU) 2024/1689 have applied since the 2nd of August, 2026.
Who counts as the deployer is not settled. Whether it is the agency running the tool or the client publishing the result has not been tested, and anyone telling you otherwise is guessing. What is not in doubt is where the exposure lands: on whoever published it.
You can outsource the writing. You cannot outsource being the publisher.
To be compliant
We give you a simple, tamper-evident record of who reviewed a piece of AI-assisted content, and when. So “we had a human review this” is not just something you say when a regulator calls. It is something you can prove.
Free for journalists, newsrooms, charities, NGOs and public bodies.
