PPROMPT WORKBOOK Build a prompt
Workflow

Editorial responsibility for AI content

This is the only place in the AI Act where doing the right thing leaves you with less to do, not more. It is worth understanding precisely.

This is information, not legal advice. Every rule below is cited to its source and reflects the position on 25 August 2026. This area is moving quickly, and a decision that matters for your organisation should be checked by someone with legal responsibility for it.

The honest part first: nobody is requiring this of you

The human oversight requirements sit in Article 14, the logging requirements in Article 12, and the duties on the organisation using a system in Article 26. All three apply to high-risk systems, and all three were pushed to 2 December 2027. A site that publishes guides is not a high-risk system. None of those provisions ask anything of you.

We lead with that because the rest of this page would otherwise read as scare copy, and there is no shortage of that about AI regulation already. The argument here is a different one. There is exactly one provision that rewards having a real editorial process, and four unrelated sets of rules that point at the same workflow.

Article 50(4)

The exemption

The duty to disclose AI-generated text does not apply "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content".

The Commission's Article 50 FAQ
Three conditions
  • Genuine examination of the substance
  • By someone with relevant knowledge
  • Someone holds ultimate responsibility
  • That responsibility can be found from outside

What counts as review

The Commission has spelled the conditions out, and they are stricter than most people assume. Human review is described as a deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge. Editorial control means control exercised in practice, by someone with the authority to approve, alter or reject the substance. Editorial responsibility requires a person or organisation holding ultimate legal responsibility for the publication.

And what explicitly does not count: superficial, solely formal, or procedural checks. Spell-checking is the example given.

Notice what follows logically. A publishing tool with nothing but a Publish button records nothing. From the outside there is no difference between a person who read the piece carefully and a person who clicked. If the exemption is going to be relied on, that difference has to be visible somewhere.

This carries the exemption

  • A named person checks the factual claims
  • That person can change or stop the piece
  • There is a record of who, when, and what changed
  • Responsibility is stated publicly, with a contact route

This does not

  • A spell-check and a quick skim
  • Approval with no power to alter the substance
  • "Someone looked at it" with no trace of who or when
  • Publish first, review on complaint
Which text triggers the duty at all? Only text published to inform the public on matters of public interest. The Commission's list runs to politics and democratic processes, public administration and services, the administration of justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific or cultural developments. Writing about health, consumer rights or regulation — as this page does — is inside it. Straight product copy usually is not. The four Article 50 duties and who each one lands on are set out separately.

Google measures the same things, and is stricter

Google's position has been stable since February 2023: the focus is on the quality of the content rather than how it was produced. The line is drawn at automation used primarily to manipulate search rankings.

Two parts of that guidance point straight at the same workflow as Article 50. The "Who, How, Why" self-assessment asks explicitly whether it is self-evident to visitors who authored the content, whether bylines lead to further information about the author, whether the use of AI generation is self-evident, and whether you explain why automation was useful. And the quality rater guidelines describe "an abundance of content with little effort or originality with no editing or manual curation" as the defining attribute of spammy websites — scaled content abuse, a category raters are told to mark Lowest.

But be fair to Google here. When the site reputation abuse policy was tightened on 19 November 2024, Google added that a violation stands "regardless of whether there is first-party involvement or oversight of the content". Human review does not, on its own, clear you with Google. Editorial control is a necessary condition, not a sufficient one.

That does not weaken the argument so much as sharpen it. The panel is not a stamp that makes content acceptable. It is the place where someone decides whether the content is worth publishing at all — and the only place that judgement can happen at any volume.

Newsrooms settled this argument a long time ago

The Associated Press instructs its journalists that any output from a generative AI tool should be treated as "unvetted source material". Not as a finished piece with errors in it, but as raw material from a source nobody has checked yet. That is an accurate description of what a model hands you.

The Paris Charter on AI and Journalism, signed by Reporters Without Borders and sixteen partners in November 2023, puts human decision-making at the centre of both long-term strategy and daily editorial choices, and states that media outlets assume editorial responsibility including in their use of AI.

More useful than either is what the Reuters Institute observed across newsrooms in 2025 and 2026: the shift from guidelines to architecture. Policies written in a document turned out not to survive contact with volume. What worked was building the constraint into the workflow — and one newsroom went as far as limiting how much AI-assisted output a single editor is expected to review, on the grounds that review fatigue is a predictable failure and not a personal one.

None of this binds a guide site. But it is the accumulated answer to the same question we are asking, from people who have been asking it for a century.

Frameworks

The standards say how

Neither is mandatory. Both are useful because they have already answered the question of what has to be recorded.

ISO/IEC 42001

A management system for AI. The relevant controls cover named roles with defined authority, ongoing operation and monitoring, event logs with a retention period, and documented intended use.

NIST AI RMF

The GOVERN function requires, among other things, that roles and responsibilities for human-AI configurations and oversight are defined and documented, that an inventory of AI systems exists, and that there are procedures for decommissioning safely.

The AI Act as a template

Article 12(3)(d) requires logs to identify the natural persons involved in verifying results. That provision reaches only one system type, remote biometric identification, but it shows what the EU thinks a log should be able to answer. Article 26(6) sets retention at a minimum of six months. Both are high-risk duties, but the numbers are the EU's own view of what adequate traceability looks like.

The anatomy: what the panel actually needs

The rest of this page is a specification. It is written to be implementable in any publishing tool, and to cover the conditions set out above.

Roles, with real authority

No shared accounts. Every action has to resolve to one authenticated natural person, or there is no natural person to point at.

  • Responsible editor. One named person per site. Final publishing authority, can unpublish anything, signs off new uses of AI. The name and a contact route belong in public.
  • Reviewer. Can approve, alter or reject the substance. That last verb is what separates the role from a button.
  • Subject checker. Optional, per topic. Fact-checking for anything touching health, law or safety.
  • Contributor. Can generate and edit drafts. Cannot publish.

States

No AI-generated text should be able to move straight from draft to published. That should be technically impossible rather than merely discouraged — a rule that exists only in a document is not a control.

  1. Draft to review queue

    The draft enters a queue. The queue has an owner, not just a status.

  2. Under review, then approved, rejected or escalated

    Rejection requires a reason. Those reasons are what later demonstrate that the review was real.

  3. Published, corrected, republished

    Corrections are a state of their own, not a silent edit. Readers should be able to see that something changed.

  4. Unpublished, and only then deleted

    Unpublishing should be one click and take effect immediately. Deletion belongs to the editor alone.

Fields per version

Three groups. Provenance says where the text came from, review says what was done to it, and presentation is what the reader sees.

  • Provenance: whether the content is AI-generated, which model and version, which prompt, when, which sources informed it, and what proportion of the text a human actually changed. That last number is the single best indicator of whether the review was substantive.
  • Review: who reviewed, when, how deeply (fact-checked, copy-edited, rewritten, rejected), which claims were checked against which source, any notes, and who holds editorial responsibility for the publication.
  • Presentation: a byline with a name and a link to an author page, a short note on how the piece was made, the date of last review visible to the reader, and the date the next review falls due.

The audit log

One line per action: timestamp, who and in which role, what was done, which object and which version, what changed, which model was involved if any, and a reason where the action was to reject or unpublish.

The log has to be append-only. No role edits or deletes a line, the editor included. A log that can be edited by the person being checked is not evidence. Retention should be at least six months, which is the EU's own minimum for high-risk systems, and in practice the lifetime of the site — storage costs nothing next to being unable to answer a question two years later.

Note that the log holds personal data about your own staff. A lawful basis and a deletion routine need to exist; the AI Act itself carves out data protection law on exactly this point.

What separates a real panel from a rubber stamp

Three things most people skip

A cap on how much one person approves

Approval degrades into stamping once volume is high enough. The Reuters Institute describes a newsroom that introduced limits on how much AI-assisted output its staff are expected to review, for precisely that reason. It also addresses automation bias, which the AI Act itself calls out.

A kill switch and bulk unpublish

When a model or a prompt turns out to have produced a systematic error, everything derived from it has to come down together — filtered by model, date or prompt version. Without that, the only remedy is going through the pages by hand.

Metrics that expose stamping

Rejection rate per reviewer, median share of text edited by a human, time from generation to publication, and corrections per hundred published pieces. A rejection rate near zero and a turnaround near zero mean the same thing.

Why it is worth the trouble

Four reasons, and only one of them is legal.

Article 50(4) grants a concrete exemption from the disclosure duty to anyone with human review and editorial responsibility. Google asks explicitly who wrote the content and how it was made, and reserves its lowest rating for work published with no editing or manual curation. The AI management standards require named roles, event logs and documented intended use. And the press has demanded the same thing since long before any of the rest existed.

None of them obliges an ordinary site to build this. But all four point at the same place, and it is the only place where a claim of editorial control can become something more than a claim.

Sources