The notice or the marker: two transparency duties that land in different code

Two sentences in the AI Act's transparency rules usually arrive as a single engineering ticket, and the ticket is usually wrong. One says humans should be made aware that they are interacting with a machine so they can take an informed decision. The other says providers of generative AI have to ensure that AI-generated content is identifiable. The first is about a conversation. The second is about an artefact that will outlive it.

Two obligations, two targets

The interaction duty attaches to a session: a person opens a chat and needs to know, while deciding what to do with the answer, that the counterpart is a machine. The content duty attaches to output: an article, an image, a video, identifiable as AI-generated wherever it ends up. The Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions, so both are present-tense questions, not roadmap items.

The notice lives in the session, the marker lives in the file

A chat notice can be rendered by the front end, because the front end is where the human is. Output identifiability cannot work that way, because the asset leaves. C2PA addresses this with the Content Credential, a cryptographically bound structure that records an asset's provenance, carrying assertions about origin, modifications and use of AI, meaning how the asset was authored. The marker has to be attached where the asset is produced, not where it happens to be displayed.

Unsupervised publishing removes the person who would have explained

In Tatano Energy, four country domains are indexed separately, seven languages are served, eight SEO articles are published every day, and manual intervention required is zero, alongside multi-language generative video campaigns. In the Matthieu Pesesse platform, articles publish autonomously on a daily basis, with weekly content operations time of about zero hours. In both, no reviewer is standing next to the output to answer whether it was machine-written. Whatever marks it has to be produced by the pipeline itself.

Multiply by languages and domains before you call it done

A notice that renders correctly in one locale is not a notice that renders in seven. An asset marked at the publish step on one domain is not marked on four. The counts in those case studies are the real test surface: four domains, seven languages, eight articles a day. Transparency work that is manually applied scales to zero of that, which is a design constraint rather than a compliance detail.

A marker is not a verdict about the content

Provenance data is not a quality claim. C2PA states plainly that Content Credentials do not provide value judgments about whether a given set of provenance data is true, and that the specification is not a cure-all for misinformation but seeks to mitigate against its threats in the digital domain. Treat an attached credential as a record of how something was made. It says nothing about whether the sentences inside it are correct.

Disclosure does not address overreliance

OWASP describes misinformation as occurring when LLMs produce false or misleading information that appears credible, and overreliance as users placing excessive trust in generated content and failing to verify its accuracy. A banner saying you are talking to a machine does not interrupt that. The recommended mitigations are structural: retrieval-augmented generation drawing on relevant and verified information from trusted external databases, and tools and processes that automatically validate key outputs, especially in high-stakes environments.

What that means for the build order

Put the interaction notice in the response surface rather than in a layout that one locale can drop. Put the output marker in the publish step, so an asset cannot be emitted without it. Add automatic validation for the outputs that matter most, since nobody is reading all eight a day. And keep 2 December 2027 on the calendar: from that date, high-risk AI systems face strict obligations before they can be put on the market.

Takeaway

Ask two separate questions of any generative feature. Does the human in front of it know it is a machine, in every language it answers in? And does the thing it produces stay identifiable after it leaves your site? The answers live in different code paths, and a credential that survives the journey still makes no claim about accuracy. That gap is what automatic output validation and grounded retrieval are for.

Sources

European Commission (Shaping Europe’s digital future) — AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

OWASP Gen AI Security Project — LLM09:2025 Misinformation — https://genai.owasp.org/llmrisk/llm092025-misinformation/

C2PA — C2PA and Content Credentials Explainer (2.4) — https://spec.c2pa.org/specifications/specifications/2.4/explainer/Explainer.html

Neurolinks case study — Four markets, one codebase — https://neurolinks.be/work/tatano-energy

Neurolinks case study — A personal brand that publishes itself — https://neurolinks.be/work/matthieu-pesesse-media