Standardising AI-generated content: what the EU code means in practice

AI-generated content needs more than a disclaimer

AI-generated content is now part of normal digital work. It appears in social posts, web copy, customer service replies, reports, images, videos, internal documents and public information. The question is no longer whether organisations will use it. The question is whether people can understand when AI has been used, what role it played, and who remains responsible for the final output.

This is where standardisation matters.

The European Commission’s Code of Practice on transparency of AI-generated content, published in June 2026, gives providers and deployers of generative AI systems a practical framework for meeting the AI Act’s transparency obligations. The code is voluntary, but the underlying Article 50 transparency requirements are legal obligations.

For most businesses, the useful lesson is bigger than regulation. AI content needs a system. Not a vague “we use AI sometimes” note. Not a hidden process. A system that makes marking, labelling, review and accountability visible enough for people to trust the content they are seeing.

What the EU code is trying to standardise

The code is structured around two broad groups: providers and deployers.

Providers are responsible for generative AI systems themselves. The code focuses on technical marking and detection, including machine-readable signals that help identify content as artificially generated or manipulated.

Deployers are the organisations and people using generative AI systems to create or publish content. The code focuses on labelling and disclosure, especially for deepfakes and certain AI-generated or manipulated text that informs the public on matters of public interest.

That split is important. The company building the model does not have the same responsibilities as the team publishing an article, campaign, public statement or image. But both sides need to make AI use easier to identify and explain.

Marking, labelling and disclosure are different jobs

One reason this topic gets messy is that people use marking, labelling and disclosure as if they mean the same thing. They overlap, but they are not identical.

• Marking is usually technical. It can include metadata, watermarking, fingerprinting or other machine-readable signals.
• Detection is about whether systems, platforms or verification tools can identify generated or manipulated content.
• Labelling is what a person sees. It tells the audience that content was generated, manipulated or AI-assisted.
• Disclosure explains the role AI played and, where needed, who reviewed or approved the final output.

A practical AI content workflow needs to think about all four. Otherwise you end up with a label that looks tidy on the surface but no reliable process underneath it.

Why this matters for ordinary content workflows

It is easy to think this only applies to deepfakes, synthetic media or large AI providers. Those are important, but the operational issue is wider.

Many organisations already use AI to draft blog posts, summarise reports, create graphics, rewrite emails, generate campaign concepts or prepare customer-facing information. Some of that content may be low risk. Some of it may affect decisions, trust, reputation or public understanding.

The problem is not simply that AI might be involved. The problem is when nobody can answer basic questions afterwards:

• Was this generated, edited or only assisted by AI?
• Which tool was used?
• Was the output reviewed by a human?
• Who approved the final version?
• Were facts, claims, sources and risks checked?
• Does the audience need a visible label or explanation?

If those answers are unclear, the organisation does not have an AI content system. It has scattered AI use.

The public-interest text point is worth noticing

The EU code highlights AI-generated or manipulated text that informs the public on matters of public interest. That matters because not all text carries the same level of risk.

An AI-assisted internal meeting summary is not the same as a public health update, legal guidance, financial communication, political message or news-style article. The closer content gets to public understanding, rights, safety, democratic debate, regulated advice or high-impact decisions, the more important review and accountability become.

The code also recognises that human review and editorial responsibility can matter. The principle is useful beyond the legal wording. Human review should not be treated as a sign that the AI system has failed. In mature workflows, it is part of the control structure.

What standardisation looks like in practice

For a business using AI in content, standardisation does not have to mean a 70-page policy nobody reads. It means making repeatable decisions visible.

A practical system might include:

• A simple taxonomy for content: AI-generated, AI-assisted, human-authored with AI support, or manually produced.
• Rules for when a visible label is required.
• A review checklist for public-facing content.
• A record of which tools were used and who approved the final output.
• Clear boundaries for sensitive, regulated or public-interest topics.
• Version control so content can be traced from draft to publication.
• Guidance for images, audio, video and text, because the risks are not identical.

This is the kind of work I mean by Human-Engineered AI. The point is not to make AI use scary or bureaucratic. The point is to design the workflow around real people: the team creating the content, the audience receiving it, and the person accountable when something goes wrong.

Providers need technical controls; deployers need operational controls

Providers may need to think about machine-readable marking, detection interfaces, interoperability, robustness and technical reliability. Those are model and platform questions.

Deployers need something different: operational control. They need to know where AI enters the workflow, what the output is used for, who reviews it, and how the audience is informed when disclosure is needed.

That distinction prevents a common mistake: assuming the tool will solve the governance problem. Even if a platform adds watermarking or metadata, the publishing organisation still needs its own process. A technical signal does not decide whether a blog post, report, campaign or public statement has been properly checked.

Deepfakes and manipulated content need stronger treatment

The code gives particular attention to deepfakes and manipulated content. That makes sense. Synthetic images, audio and video can create a false impression of real people, places, events or statements.

For organisations, the practical lesson is to avoid burying disclosure where nobody sees it. If content could reasonably make someone believe something artificial is authentic, the label needs to be clear at the point of exposure, not hidden in a footer or policy page.

The same principle applies to less dramatic content too. If AI meaningfully shaped a public-facing asset, the disclosure decision should be intentional rather than accidental.

A simple AI content governance checklist

If you are using AI in marketing, communications or public information, start with a small checklist.

1. Classify the content. Is it AI-generated, AI-assisted, edited from AI output, or manually created?
2. Assess the risk. Is it public-facing, sensitive, regulated, persuasive, or connected to a matter of public interest?
3. Define the review step. Who checks accuracy, tone, sources, claims and context?
4. Decide the label. Does the audience need a visible disclosure, and where should it appear?
5. Keep a record. Note the tool, reviewer, approval date and final version.
6. Review the system. Check whether labels, records and review steps still work as tools and rules change.

This is not only about avoiding regulatory problems. It is about protecting trust. People are more likely to accept AI-assisted content when they can see that a human being, team or organisation has taken responsibility for it.

Where this connects to digital systems

Standardising AI-generated content is not just a legal task. It is a digital systems task.

The labels, metadata, review notes, publishing workflow, content management system, team responsibilities and audience experience all need to fit together. If one part is missing, the whole process becomes harder to trust.

For example, a content team might use AI to draft an article, a human editor to review it, a CMS field to record the AI-use category, and a publishing checklist to decide whether a disclosure appears on the page. That gives the team a repeatable system. It is much stronger than relying on individual memory or hoping everyone makes the same judgement every time.

The practical takeaway

The EU code is a reminder that AI transparency has to move from principle into practice. A vague instruction to “be transparent” will not carry the work. Organisations have to decide what transparency looks like inside the workflow.

That means clear labels where needed, technical marking where appropriate, human review where the stakes are higher, and records that show how content moved from AI-assisted draft to approved publication.

AI-generated content will only become more common. The organisations that handle it well will not be the ones with the longest policy documents. They will be the ones with practical systems that make responsible behaviour easy to repeat.

Standards describe what good looks like; keeping to them as systems change is the harder part. Our research on production AI reliability covers that, and AI governance for small businesses turns it into review points a small team can actually keep.

Claire Nicholson Digital can help design those systems, from Human-Engineered AI setup and content workflows to governance and digital implementation that keeps human judgement visible.