REGULATORY DECISION BRIEF · 20 AUG / 2026DAILY EDITION · 6 MIN READ
THE AI INSTITUTE / RESEARCH FOR LEADERS
AI Disclosure Is Now an Operating Control
The question is no longer whether to disclose. It is who must disclose what, where, and in which form before the customer sees it.
OUR VIEW
Create one cross-border AI disclosure control with jurisdiction and use-case variants; do not rely on one universal AI-generated label.
Key points
What this paper means for leaders
Treat disclosure as a release control owned across product, legal, communications and operations—not as a line of policy copy.
Map the organisation's role, the audience, the content or interaction, the jurisdiction and the required human-visible or machine-readable signal.
Set a global minimum for customer honesty, then add local controls where laws, platforms and sectors require more.
Require suppliers to preserve provenance, describe their marking capability and notify you when a release changes it.
Test one high-volume customer journey in 30 days before extending the control across markets.
01
The executive decision
Make disclosure part of release—not a disclaimer added later
A customer can now encounter AI in a service conversation, a recommendation, an image, a voice, a video or a document without knowing which part was generated or altered. Regulators are responding, but not with one global rule. The result is an operating question for any organisation that builds, buys or distributes AI-enabled experiences.
In the European Union, Article 50 transparency duties began applying on 2 August 2026. The obligations differ by role and use case: interactive systems must disclose that a person is dealing with AI in defined circumstances; certain generated or altered outputs require machine-readable marking; deepfakes and some public-interest text require disclosure by deployers. The Commission's guidance helps interpret the obligation, while its voluntary code offers a route to operational practice. They are not the same legal instrument. 123
The decision is to make disclosure a release control. Before a product, campaign, customer journey or generated asset goes live, a named owner should know who is responsible, which market is affected, what the audience must see and what the file or platform must carry.
A disclosure policy says what the organisation believes. A disclosure control decides whether the experience is allowed to go live.
02
Why one label fails
The regimes regulate different actors, content and signals
China's measures, in force since 1 September 2025, apply to covered network information service providers and distinguish explicit labels that people can perceive from implicit labels embedded in file metadata. They address text, images, audio, video and virtual scenes, and place duties on both generation services and distribution platforms. 4
California's AI Transparency Act became operative on 1 January 2026. Its covered-provider definition includes publicly accessible generative AI systems above a stated user threshold. It requires a free detection tool, an option for a clear manifest disclosure on certain image, video and audio content, and latent provenance information where technically feasible and reasonable. Its scope is not a universal duty on every business using AI. 5
One control, local variants
EU
Role and use case
AI interaction, machine-readable marking, deepfakes and defined public-interest content.
Applicable lawCHINA
Visible + embedded
Explicit labels and implicit metadata across generation and distribution services.
In-force measuresUS / AU
Mixed obligations
Provider, state, sector and voluntary controls require a scoped market check.
Jurisdiction-specific
03
The operating model
Build a disclosure control plane, not a badge library
Start with a simple matrix. Record the organisation's role—provider, deployer, distributor or buyer—the output or interaction, the audience, the jurisdiction, the human-visible disclosure, any machine-readable mark, the supplier evidence and the person authorised to approve release.
Set a global minimum based on customer honesty: disclose when a reasonable person could misunderstand whether they are dealing with a human or whether consequential material is authentic. Then add the local requirements. This reduces the chance that a compliant experience in one market becomes misleading or unlawful in another.
The control must survive ordinary operations. Labels need to remain present after export, editing, translation, resizing, channel distribution and supplier upgrades. Procurement should therefore require a supplier to explain what is marked, how it is preserved, which formats are supported and what changes when a model or platform release occurs.
04
What technology cannot settle
Detection and provenance help, but they do not decide trust
NIST separates provenance tracking from synthetic-content detection. Provenance can record origin and history; detection tries to classify whether material is synthetic. NIST cautions that transparency may support trustworthiness but does not guarantee it, and that technical measures can create false confidence when authentic material is used out of context. 7
That limit is becoming more important as generation improves. NIST's 2026 evaluation programme tests both generators and detectors and reports that, in an earlier text-summarisation pilot, three generators fooled every detector. The business implication is direct: a detector should inform a control, not stand in for one. 8
Do not promise customers that a watermark proves truth, or that the absence of a mark proves human authorship. The stronger promise is operational: the organisation knows where AI is used, applies the required signals, keeps supplier and release records, and offers a route for questions or correction.
05
Global application
Use a global floor and regional release checks
A global floor makes the customer experience coherent. Regional checks keep it lawful and workable. The EU may focus the analysis on the provider or deployer and the precise Article 50 use case. China may require both a perceptible label and embedded information. California may place the duty on a large provider rather than the enterprise user.
Language and accessibility matter too. A disclosure that is legally present but hidden, ambiguous, untranslated or inaccessible can still fail the customer. Market structure changes implementation: a company distributing through a dominant platform may inherit or depend on that platform's marking system, while a smaller market or lower-connectivity channel may strip metadata during delivery.
The board does not need to approve every label. It should require one accountable standard, an inventory of high-consequence experiences, escalation for unresolved markets and reporting on release exceptions.
06
30-day action
Test the control on one customer journey
Choose one high-volume journey: a service assistant, generated marketing asset, personalised recommendation or automated customer document. Map every market, supplier, content type and hand-off. Identify where a person may mistake AI for a human or generated material for an authentic record.
Define the visible disclosure, embedded signal, evidence record, exception route and owner. Test the experience after translation, export and distribution—not only in the design file. Ask customers or frontline staff whether the signal is noticed and understood without disrupting the task.
At day 30, decide whether to scale, redesign or stop. Scale when the control is understandable, durable and owned. Redesign when metadata disappears, supplier evidence is weak or the wording confuses customers. Stop release when the organisation cannot explain which rule applies or who carries the obligation.
The 30-day request — one customer journey, one jurisdiction matrix, one named release owner and one tested disclosure path.
Research record
Method and limitations
Method
This brief compares EU, Chinese, Californian and US standards sources as at 20 August 2026. It distinguishes applicable law, official guidance and voluntary practice, then translates the differences into one executive release control.
Limitations
This is an executive operating brief, not legal advice. Duties depend on role, use case, audience, content type, jurisdiction, sector and supplier configuration. Official guidance and enforcement practice can evolve. Detection and provenance technologies have material technical limits, and disclosure alone does not make content accurate or safe.
First published 20 August 2026 · Updated 24 September 2026 ·Research period September 2024 – August 2026 · Research current to 20 August 2026 · Version 1.1 · Suggested citation: The AI Institute, AI Disclosure Is Now an Operating Control (2026).
Research