Producing AI content inside the EU requires three records that most content teams do not have yet: which data goes to which model (GDPR), where every published text came from (AI Act, Article 50) and how generated images stay recognisable (C2PA). None of the three is complicated, but they have to exist before a regulator, a client or your own lawyer asks. This article is the checklist we use ourselves.
1. Data: what goes to the model
Every prompt is a processing operation. For content production the question is not whether you may use AI, but what you put into it.
- No personal data in prompts. Brand facts, product data, public sources and your own tone of voice are enough for almost any text. Customer names, e-mails, reviews with identifiable details and support tickets do not belong there.
- A data processing agreement with every model provider. Also with a gateway that puts several models behind one API: you need to know which providers actually sit behind it and list them in your processing register.
- Transfers outside the EU arranged. US providers operate under the EU-US Data Privacy Framework or standard contractual clauses. Record which of the two applies; some clients additionally require EU hosting.
- EU-hosted models where possible. Several providers offer EU residency for inference. If you promise it, enforce it technically: a setting that restricts model choice to EU-hosted variants, and a log that shows this actually happened.
- Training use excluded. The business APIs of the large providers do not train on your input by default; verify that and put it in the contract.
2. Provenance: where every text came from
Article 50(4) of the AI Act exempts AI text with human editing and demonstrable editorial responsibility from the disclosure duty. "Demonstrable" is the key word. Per published version you want to record:
| Field | Why |
|---|---|
| Model id and mode (live or simulated) | Which system produced the text; needed after a mistake or a regulator's question |
| Hash of the instruction | Proves which instruction was used without storing the full prompt |
| Sources and claims | Which facts came from which source; the basis of a fact check |
| Reviewer and time | The human review the exception asks for |
| Size of the changes | Distinguishes "read" from "edited" |
| Disclosure yes/no | Whether the published page carried an AI notice |
Keep this separate from the CMS, in a log you can export. A CSV per site is enough; what matters is that it exists and was not assembled after the fact.
3. Images: C2PA and not stripping it
For image, audio and video the AI Act asks providers to mark output in a machine-readable way. C2PA (Coalition for Content Provenance and Authenticity) is the open standard most used for this: a signed manifest inside the file stating who or what created the image, which tool, and which edits followed.
Two practical points. First: sign generated images at the moment of storage, with your own certificate, so the manifest also names your organisation as publisher. Second, and this goes wrong more often: many CMSs, image optimisers and CDNs strip metadata when resizing. Test one image from generation to live page and check that the manifest is still in it.
4. Disclosure: what you say and where
Whether you show an AI notice is partly a duty (deep fakes, unedited text on matters of public interest) and partly a choice. Arrange it in two places.
A public transparency page. One page, linked from the footer, that says in plain language: what you use AI for, what is always reviewed by a human, which data never goes to a model, how images are marked, and how someone can report a mistake. Regulators and clients prefer one honest page over a legal annex.
A block on the page itself, where you choose to. A short sentence under the text, with a link to the transparency page. Switch it on per site or per content type; health, money and law are the categories where we always recommend it.
5. Chatbots and agents
If you put a chatbot on your site, Article 50(1) applies: visitors must know they are talking to an AI. A visible name such as "AI assistant" and a first message that says so are enough. Also limit what the bot may promise: prices, stock and legal commitments only from verified sources, and a conversation log in which personal data is not kept longer than necessary.
6. The checklist
Go through these six points; anything you cannot show with a document or an export does not count.
- The processing register lists every model provider, with a basis for transfers.
- Prompts contain no personal data; this is in a written work instruction.
- Per published version: model, prompt hash, reviewer, changes, disclosure.
- Generated images carry a C2PA manifest all the way to the live page.
- A public transparency page exists and is linked.
- Chatbots call themselves AI and promise nothing beyond verified sources.
Conclusion
Compliance for AI content in the EU is bookkeeping, not a brake. If you record the origin of every page, keep personal data out of prompts and sign images, you comply with the AI Act and work more precisely at the same time. Our own approach is on the AI transparency page; how provenance is recorded and exported per page is described under AI content creation in Traze.