What an AI Disclosure Record Must Contain

The easiest way to misunderstand AI transparency is to treat it as a sticker: put a notice on the chatbot, mark the synthetic image, add a sentence near the generated report, and move on once legal is calm. The instinct is familiar, and it underestimates the obligations now coming out of Brussels.

On July 20, 2026, the European Commission published guidelines for Article 50 transparency obligations under the EU AI Act. The obligations start applying on August 2, 2026. They cover interactive AI systems, machine-readable marking of AI-generated or manipulated content, deepfakes, emotion recognition, biometric categorisation, and certain AI-generated text on matters of public interest. The Commission's quick facts page puts it bluntly: people should know when they are interacting with AI or exposed to AI-generated content.

For a large company this becomes a checklist problem. The company needs a record of what each disclosure covers, and that record is bigger than any single notice and harder to fake.

A disclosure is useful only if the business can reconstruct how the content was generated, where it travelled, who approved it and whether the audience understood it.

AI-generated work now turns up on ordinary business surfaces such as support chats, sales emails, investor decks and job ads. Most of it is harmless assistance. A smaller share changes how far the audience should trust the message, and the worst of it can deceive, impersonate, or give a false sense that a human exercised judgment.

The hard decision is operational, and the wording of the notice comes later. Some AI-assisted work needs disclosure; other pieces need a provenance record, human editorial control or a machine-readable mark. A few should not ship at all, whatever label they carry.

Why an EU deadline changes practice outside Europe

Article 50 is European law, but its effects travel. Once a major jurisdiction puts a date on transparency, global companies start rewriting product requirements, procurement questions and content workflows. Companies outside Europe feel the pressure through enterprise buyers, platform rules and customer expectations that do not wait for a local statute.

Soft expectations harden in a familiar sequence: a rule appears, vendors add features, buyers ask for evidence, and internal teams need controls. After the first embarrassing incident, a missing control becomes a board question instead of a product backlog item.

Work by the National Institute of Standards and Technology (NIST) on synthetic content points the same way. Watermarking, provenance, detection and authentication answer different trust questions, so one cannot stand in for another. The Coalition for Content Provenance and Authenticity (C2PA) adds the media supply chain: when content can be generated, edited, recompressed and stripped of context, trust depends on a chain of records, since a caption can simply be cropped out.

Handled one output at a time, AI disclosure gets lost in the noise. A company first has to know which of its surfaces carry AI-assisted content before it can decide which of them need governing.

Five lines for the checklist

A practical disclosure checklist has five lines. They are management categories, meant for the team that has to decide whether an AI-assisted piece of work can leave the building tonight; the legal analysis sits alongside them.

With one shared table, product, legal, security, marketing and editorial work from the same record, and the exceptions stop living in people's heads. A generated customer-support summary may need no public label and still need internal logging. An AI-generated public-interest report may need both human editorial control and disclosure. A synthetic executive voice may stay banned from investor communication even though someone could attach a label to it.

Company and audience carry different risks

Executives often talk about AI disclosure as though the company and the audience share the same risk. They don't. The company wants efficiency, scale and lower production cost, while the audience wants to know whether it is dealing with a human, a machine, a simulation, or public-interest text that had real editorial judgment behind it.

Resentment builds in that gap, and grudging disclosure can hurt trust more than keeping AI out of the workflow would have. A notice that appears after the user has already acted feels like a trap. A label that says only "AI assisted", without saying whether anyone checked the facts or claims, tells the reader almost nothing.

A better rule is to disclose at the point where the audience's interpretation would reasonably change. Chat users should learn they are talking to a bot before they rely on its answer. A synthetic video that resembles a real person should be labelled where it is watched, and readers of public-interest text need to be told when no human reviewed it. When AI only helped copyedit a memo a human owns, the public disclosure burden may be lower, though the organization still needs an internal record if the topic is sensitive.

Why this hits marketing and media first

The earliest friction will fall on marketing, communications, media and founder-led publishing. These teams produce high volumes of external content, move quickly and depend on audience trust. They also blur assistance and authorship faster than most regulated workflows, because the tools make the blur easy and the deadlines make it tempting.

A founder can now use AI to draft a market memo, summarise a transcript or polish a partner note. Most of those uses are fine. They become dangerous when the result implies first-hand reporting, personal endorsement, original analysis or editorial review that never happened.

A publication like Strategy Publisher, whose product is its readers' trust, should hold itself to a strict rule. AI can help process source signals and structure drafts, but the public claims stay human-owned: the thesis, the choice of evidence, the source links, the stated limits and the decision put to the reader.

Questions to put to AI vendors

Before relying on any vendor's disclosure feature, buyers should press on a narrow set of questions.

1. Which output types can the system mark in a machine-readable way?
2. When can a mark be lost, stripped, transformed or made unreliable?
3. How does the system distinguish generation, editing, translation, summarisation and retrieval?
4. What logs show who generated, edited, reviewed, approved and published the work?
5. Can policy be applied by channel, geography, audience, topic and risk class?
6. What happens when a user tries to bypass disclosure or impersonate a person, company or public authority?

Once transparency is an operating requirement these are ordinary procurement questions. A vendor that can answer them only with a label has supplied one design component, and the buyer still has to build the rest.

Impersonation belongs in the same policy

Fraud prevention needs the checklist too. The Federal Trade Commission (FTC) rule on government and business impersonation, and its related work on AI-enabled impersonation of individuals, show why: AI makes impersonation cheaper, more believable and easier to industrialise, because simulated voices, images, text and brands all lower the cost of false authority.

Not every synthetic artifact is suspect, but the company needs a sharper line around who may represent it. Who may speak as the company? Which AI systems may use an employee name, customer logo, executive voice or partner endorsement? Which pieces need provenance before release, and which need manual approval from the person being represented?

The most damaging AI incident a company suffers may well be a plausible message that appears to come from someone who never sent it, and a disclosure policy that ignores impersonation will not catch it.

A version for small companies

A small company can run this as a weekly checklist. For every external AI-assisted piece of work, record the channel, audience, AI role, human owner, disclosure status, source-check status and reason for shipping. A spreadsheet is enough.

Three stop rules should be agreed in advance so that nobody negotiates them in the middle of a crisis, and a small team that keeps to them can move quickly without storing up trust problems for later.

1. Do not ship AI-generated public-interest text without a named human owner and source review.
2. Do not simulate a person, customer, partner or authority without explicit permission and visible context.
3. Do not rely on a disclosure label as the only control for a high-trust communication.

Seven questions before content goes public

Before AI-generated content moves into a public or customer-facing workflow, require written answers to seven questions, each owned by a named person.

1. What surface will the audience see, hear or use?
2. Would disclosure change how a reasonable person interprets the work?
3. Is the AI role generation, substantial editing, translation, summarisation, retrieval or ordinary assistance?
4. Who owns factual accuracy, source selection, legal risk and final approval?
5. Can provenance, review and publication state be reconstructed after release?
6. What impersonation, deception or public-interest risk is present?
7. What condition forces the work to be held, relabelled, corrected or withdrawn?

Companies that can answer these move faster, because they stop renegotiating trust from scratch for each piece of content. Routine uses go through without debate; higher-risk uses get disclosure or supporting evidence, and some are held back entirely.

Labels used alone soon become a nuisance people ignore. The cost of producing plausible content keeps falling, and when a particular piece is questioned after release, the checklist behind the label is the record that shows how it was made and who approved it.