AI Disclosure Is Now an Operating Control

A customer can now encounter AI in a service conversation, a recommendation, an image, a voice, a video or a document without knowing which part was generated or altered. Regulators are responding, but not with one global rule. The result is an operating question for any organisation that builds, buys or distributes AI-enabled experiences.

In the European Union, Article 50 transparency duties began applying on 2 August 2026. The obligations differ by role and use case: interactive systems must disclose that a person is dealing with AI in defined circumstances; certain generated or altered outputs require machine-readable marking; deepfakes and some public-interest text require disclosure by deployers. The Commission's guidance helps interpret the obligation, while its voluntary code offers a route to operational practice. They are not the same legal instrument. ¹²³

The decision is to make disclosure a release control. Before a product, campaign, customer journey or generated asset goes live, a named owner should know who is responsible, which market is affected, what the audience must see and what the file or platform must carry.

China's measures, in force since 1 September 2025, apply to covered network information service providers and distinguish explicit labels that people can perceive from implicit labels embedded in file metadata. They address text, images, audio, video and virtual scenes, and place duties on both generation services and distribution platforms. ⁴

California's AI Transparency Act became operative on 1 January 2026. Its covered-provider definition includes publicly accessible generative AI systems above a stated user threshold. It requires a free detection tool, an option for a clear manifest disclosure on certain image, video and audio content, and latent provenance information where technically feasible and reasonable. Its scope is not a universal duty on every business using AI. ⁵

Australia's AI-specific position is different. The voluntary AI safety standard says organisations should disclose AI-enabled decisions, interactions and generated content, with the mechanism chosen for the use case and stakeholders. The standard itself does not create new legal duties, although existing privacy, consumer, employment and sector rules may still apply. ⁶

Start with a simple matrix. Record the organisation's role—provider, deployer, distributor or buyer—the output or interaction, the audience, the jurisdiction, the human-visible disclosure, any machine-readable mark, the supplier evidence and the person authorised to approve release.

Set a global minimum based on customer honesty: disclose when a reasonable person could misunderstand whether they are dealing with a human or whether consequential material is authentic. Then add the local requirements. This reduces the chance that a compliant experience in one market becomes misleading or unlawful in another.

The control must survive ordinary operations. Labels need to remain present after export, editing, translation, resizing, channel distribution and supplier upgrades. Procurement should therefore require a supplier to explain what is marked, how it is preserved, which formats are supported and what changes when a model or platform release occurs.

NIST separates provenance tracking from synthetic-content detection. Provenance can record origin and history; detection tries to classify whether material is synthetic. NIST cautions that transparency may support trustworthiness but does not guarantee it, and that technical measures can create false confidence when authentic material is used out of context. ⁷

That limit is becoming more important as generation improves. NIST's 2026 evaluation programme tests both generators and detectors and reports that, in an earlier text-summarisation pilot, three generators fooled every detector. The business implication is direct: a detector should inform a control, not stand in for one. ⁸

Do not promise customers that a watermark proves truth, or that the absence of a mark proves human authorship. The stronger promise is operational: the organisation knows where AI is used, applies the required signals, keeps supplier and release records, and offers a route for questions or correction.

A global floor makes the customer experience coherent. Regional checks keep it lawful and workable. The EU may focus the analysis on the provider or deployer and the precise Article 50 use case. China may require both a perceptible label and embedded information. California may place the duty on a large provider rather than the enterprise user. Australia may require the organisation to connect voluntary AI guidance to existing law and sector expectations.

Language and accessibility matter too. A disclosure that is legally present but hidden, ambiguous, untranslated or inaccessible can still fail the customer. Market structure changes implementation: a company distributing through a dominant platform may inherit or depend on that platform's marking system, while a smaller market or lower-connectivity channel may strip metadata during delivery.

The board does not need to approve every label. It should require one accountable standard, an inventory of high-consequence experiences, escalation for unresolved markets and reporting on release exceptions.

Choose one high-volume journey: a service assistant, generated marketing asset, personalised recommendation or automated customer document. Map every market, supplier, content type and hand-off. Identify where a person may mistake AI for a human or generated material for an authentic record.

Define the visible disclosure, embedded signal, evidence record, exception route and owner. Test the experience after translation, export and distribution—not only in the design file. Ask customers or frontline staff whether the signal is noticed and understood without disrupting the task.

At day 30, decide whether to scale, redesign or stop. Scale when the control is understandable, durable and owned. Redesign when metadata disappears, supplier evidence is weak or the wording confuses customers. Stop release when the organisation cannot explain which rule applies or who carries the obligation.