What you cannot backdate: a daily publisher between 2 August 2026 and 2 December 2027

An unsupervised publisher has an awkward arithmetic. Obligations arrive on dates; output arrives on a schedule. The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. Starting on 2 December 2027, high-risk AI systems will be subject to strict obligations before they can be put on the market. Between those two dates a daily pipeline does not pause, and everything it emits either carries a record or does not.

Two fixed dates, one uninterrupted cadence

Look at what cadence does to volume. The Tatano Energy platform publishes eight SEO articles every day across seven languages and four separately indexed country domains, with manual intervention required: zero. The Matthieu Pesesse platform publishes articles autonomously, daily, at roughly zero hours of weekly content operations. The property that makes both worth building is that nobody has to touch them. That same property means nobody is deciding, item by item, what evidence gets kept.

Retrofitting is a review project

Compliance work splits into two kinds. One kind is a switch flipped once: a notice on a chat surface, a response header, a configuration value. The other kind is a per-artefact record, and it exists only for artefacts produced after it was added. Flip the switch late and the job is done. Add the record late and you own a backlog of everything already published, in every language, with no reviewer assigned to it.

That backlog is not conceptually hard; it is unfunded. Nobody re-reads a corpus that accumulated at eight articles a day in seven languages to work out which parts were model-written and which were edited afterwards. A date on a calendar does not create review capacity. The practical question is therefore not whether a given system is in scope today, but which fields you will wish had been written on every row.

Write the record when the artefact is made

The AI Act states that providers of generative AI have to ensure that AI-generated content is identifiable, and that when using AI systems such as chatbots, humans should be made aware that they are interacting with a machine. Both are cheaper as write-time behaviour than as a later sweep. Identifiability attached at generation is a field on the row that produced the text. Attached afterwards, it is an inference about your own archive.

Media leaves your site, so the record has to travel

Generative media makes the asymmetry concrete. The Tatano Energy work includes multi-language generative video campaigns, and a video does not stay where it was published. At the heart of the C2PA specification is the Content Credential, a cryptographically bound structure that records an asset's provenance, carrying assertions about origin, modifications and use of AI. It travels with the file. A file shipped without one cannot be amended in place once it has been distributed.

Grounding narrows what you would have to defend

The OWASP misinformation entry covers the other half. Misinformation occurs when LLMs produce false or misleading information that appears credible, and overreliance occurs when users place excessive trust in LLM-generated content, failing to verify its accuracy. The stated mitigations are retrieval-augmented generation, retrieving relevant and verified information from trusted external databases during response generation, and tools and processes to automatically validate key outputs, especially in high-stakes environments.

Automatic validation has a side effect worth naming. A human reading leaves nothing behind unless someone writes it down; an automated validator leaves a row per item by construction, recording what was checked, on which output, with what result. At a daily cadence that is the only form of evidence that keeps up with production. Choose validators whose verdicts you would be willing to show, and store them beside the artefact.

What to add before the next date

Three things are cheap now and expensive later. Make generated artefacts identifiable at the moment of generation rather than at review time. Make provenance travel with media that leaves your infrastructure, because you control the file only once. Keep machine-readable validation results per output, so that answering a question later is a query rather than a recollection. None of the three depends on how a system is eventually classified.

Content Credentials do not provide value judgements about whether a given set of provenance data is true, and C2PA is explicit that it is not a cure-all for misinformation. A validation row is not a verdict either. What both buy is the ability to answer questions about output nobody is looking at any more. Decide what you want written down, then confirm the pipeline writes it before the next publishing cycle runs.

Sources

European Commission (Shaping Europe’s digital future) — AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

OWASP Gen AI Security Project — LLM09:2025 Misinformation — https://genai.owasp.org/llmrisk/llm092025-misinformation/

C2PA — C2PA and Content Credentials Explainer (2.4) — https://spec.c2pa.org/specifications/specifications/2.4/explainer/Explainer.html

Neurolinks case study — Four markets, one codebase — https://neurolinks.be/work/tatano-energy

Neurolinks case study — A personal brand that publishes itself — https://neurolinks.be/work/matthieu-pesesse-media