AI Content Disclosure: The AI Act’s Second Deadline

On 2 August 2026, Article 50 of the EU AI Act became applicable. Most of the coverage aimed at WordPress site owners — including ours — was about the chatbot: the widget in the corner now has to tell people it is an AI.

That is the visible half. The half that reaches more WordPress sites is the one nobody put a countdown on, because its deadline has not arrived yet. It is 2 December 2026, it is about published content rather than conversations, and if you run any kind of AI writing workflow it is aimed squarely at you.

This piece is the other half of the story. It is not legal advice — we are a plugin company, not a law firm, and if you are operating at any scale in the EU you want a lawyer to read your specific setup. What we can do is read the actual text, check what our own site does, and measure what the WordPress ecosystem has actually built. All three turned out to be more interesting than the summaries.

Two duties, two dates, two different parties

Article 50 is not one rule. It is four, and they do not land on the same person or on the same day. That is the detail that makes most “AI Act checklist” posts unusable — they merge the paragraphs into a single to-do list, and then you cannot tell which items are yours.

The provider/deployer split matters more than it looks. In the Act’s terms a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional capacity.

Install a chatbot plugin and leave it branded as the vendor’s product and you look like a deployer. Rename it “Ask Acme”, restyle it, and put it on your site as your own assistant, and the “under its own name or trademark” clause starts pointing at you. We went through that question in detail in the chatbot disclosure piece, and the practical conclusion was the same one we would give here: the line is genuinely blurry, the disclosure costs you one sentence, so write the sentence rather than the legal memo.

What 50(2) actually says, and why December exists

The text of Article 50(2) is short:

“Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.”

Two words carry the weight. Machine-readable means a human-visible “written by AI” line at the bottom of a post does not satisfy this paragraph — it has to be something a machine can parse. Detectable means the marking has to survive contact with the real world well enough to be found again. The Act asks that the technical solutions be “effective, interoperable, robust and reliable as far as this is technically feasible”, which is the drafters admitting that the technology here is not finished.

There are carve-outs. Systems performing an assistive editing function, or that do not substantially alter the input data or its semantics, are out of scope. So a grammar checker is not caught. A tool that takes your three bullet points and returns a 1,500-word article is.

And the December date: the marking obligation is the only part of Article 50 that got a transition. Systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with it. The Commission has also said content generated before 2 August 2026 does not need to be retroactively labelled, though it encourages it where feasible. That is the deadline nobody is counting down to.

The one that lands on you: Article 50(4)

Paragraph 2 is a duty for whoever builds the generator. Paragraph 4 is the one that reaches the person running the website, and it is worth reading slowly. It covers deployers of an AI system that “generates or manipulates text which is published with the purpose of informing the public on matters of public interest”.

Two qualifiers narrow it. It has to be published to inform the public, and it has to be about matters of public interest. A product description is not obviously either. A news post, an explainer, a health or finance article, a piece of political or civic commentary — those sit much closer to the middle of it.

Then comes the exception, and this is the whole ball game:

“This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.”

The exception is a workflow, not a checkbox

Read that clause again and notice what it is not. It is not “you may use AI if you disclose it”. It is closer to the opposite: you may skip the disclosure if a human actually reviewed the thing and somebody owns the decision to publish it.

That is a description of an editorial process. It has two limbs — a review or editorial control step, and a named person or company holding editorial responsibility — and you either run that process or you do not. There is no setting for it.

Which is exactly the problem with how AI content is usually deployed on WordPress. The dominant pattern is a scheduler: pick keywords, generate on a cron, publish automatically, review never. That workflow is designed to remove the human step, and the human step is the thing the exception is asking for. A site publishing unreviewed generated articles about public-interest topics has to disclose. A site where somebody reads the draft, edits it, and presses publish under their own name almost certainly does not.

So the practical reading is not “the EU is coming for AI content”. It is narrower and more useful: the Act puts a price on the specific thing that made autoblogging attractive, which was removing the human. If your process already has a person in it, you were compliant before you read this, and the honest thing to say is that most WordPress publishers are in that group.

We audited our own site, and it is not a flattering result

Rather than describe the problem in the abstract, we ran the numbers on mxchat.ai. This is a site that publishes frequently, uses AI in the drafting loop, and — as of this week — sells a content generation add-on. If the obligation is awkward for anyone, it should be awkward for us. It is the same method we used when we audited our own options table for exposed API keys, and it produced a similarly uncomfortable answer.

The 14 is the interesting number, because at first glance it looks like partial compliance. It is not. Every one of the 14 mentions AI because the article is about AI — “all AI-generated CSS goes through multiple security validation layers”, “redistributing AI-generated wealth”, “AI-generated explanations for each product”. Not one of them is a statement about who or what wrote the page they appear on.

That is a distinction worth carrying into your own audit. A text search for “AI-generated” across your database will return hits on any site that writes about technology, and every one of those hits is a false positive for this purpose. The question is not whether the phrase appears. It is whether the phrase is describing the page it sits on.

Meanwhile 17 posts carry a _mxchat_generated flag in post meta, which means the database already knows they came out of a generator. The information exists. It has simply never been surfaced to a reader or to a machine — which is a fair description of where most of the WordPress ecosystem is right now.

And we are not going to claim the exception covers us cleanly, because this article is the case in point. It was drafted by an automated agent that runs our SEO operations, and it went live without a person reading it first. A named human holds editorial responsibility for this site and reviews what the agent published, but that review happens after the fact, not before. Whether that sequence satisfies “human review or editorial control” is precisely the question you do not want to be arguing retrospectively.

So we took the other option and disclosed it — see the note at the foot of this page. “We believe we are inside an exception” is a weaker position than “we said so”, it depends on a process holding up rather than on a fact being true, and it costs one sentence to avoid. That is the trade every publisher now has to make deliberately instead of by default.

Nobody has built the tooling yet, and that is measurable

If the obligation is real and the deadline is in December, you would expect a plugin ecosystem to have appeared. We queried the WordPress.org plugin API on 7 August 2026 to find out.

Every disclosure plugin in that list was added to the directory within the last seven weeks, three of them in the fortnight either side of the deadline. Between them they have roughly 150 active installs. The single most popular AI content generator on WordPress has 100,000 — a ratio of about 660 to 1 between sites generating content and sites running any tooling to label it.

Install counts on WordPress.org are rounded into buckets, so treat those figures as orders of magnitude rather than precise numbers. The order of magnitude is the point. This is a market that does not exist yet, arriving four months before a deadline, and none of these plugins has enough of a user base to have been tested in anger. If you are waiting for the obvious plugin to install, you are waiting for something that has not been written. Core is not about to hand it to you either: WordPress’s AI work so far has gone into an abilities registry and editorial guidelines rather than content provenance, as we found when we went through what actually merged for 7.1.

The penalty figure most coverage gets wrong

You will see €35 million or 7% of global turnover attached to AI Act articles constantly. That tier is real, and it is not this one. Article 99(3) sets €35m / 7% for breaches of Article 5, the prohibited-practices list — social scoring, certain biometric surveillance, manipulative systems.

Transparency breaches sit one tier down. Article 99(4) covers non-compliance with a list of provisions that explicitly includes Article 50, and the ceiling there is €15,000,000 or 3% of total worldwide annual turnover, whichever is higher.

There is a further detail that matters far more to a WordPress site owner than the headline, and it is almost never quoted. Under Article 99(6), where the offender is an SME, the fine is capped at the lower of the two figures rather than the higher. For a small agency or a solo publisher, the meaningful ceiling is a percentage of turnover, not a number with seven zeros. That does not make it free. It does mean the €15m figure is not your number, and neither is €35m.

What “machine-readable” would even mean for a blog post

The 50(2) marking obligation is a provider duty, so strictly it belongs to whoever ships the generator rather than to you. But it is worth understanding what is coming, because it will arrive inside the tools you use.

The emerging answer is C2PA, the Coalition for Content Provenance and Authenticity standard, marketed to end users as Content Credentials. It attaches a cryptographically signed manifest recording what made a file, which tools touched it, and whether AI was involved. Adobe, Microsoft, Google, Meta and OpenAI all back it, and it works reasonably well for images because an image is a file with somewhere to put metadata.

Text on a web page is harder. A blog post is not a file handed to a reader; it is HTML assembled on request, and there is no settled convention for signing a paragraph. The Commission has run a Code of Practice on Transparency of AI-Generated Content to work this out — first draft December 2025, a second draft in March 2026, covering 50(2) and 50(4) in separate sections that providers and deployers can sign independently. Adherence is voluntary; the Commission’s own FAQ says so plainly, while noting that those who decline have to demonstrate compliance some other way and may see more questions asked.

The realistic near-term answer for a WordPress site is unglamorous: a visible byline statement, plus structured data in the page that names the tool. It is not a signed manifest, and it will not be what the standard eventually settles on. It is considerably better than nothing, and it takes an afternoon.

What to actually do before 2 December

1. Work out which lane you are in. Does a human read and approve every generated post before it publishes, and is there a named person who owns that decision? If yes, you are relying on the 50(4) exception and your job is to make that process real and documented. If no, you have a disclosure duty on public-interest content.
2. Audit properly, not with a text search. Grepping for “AI-generated” gave us 14 hits and zero disclosures. Look instead for the marker your generator leaves in post meta — ours writes _mxchat_generated — which tells you what was actually machine-written rather than what merely mentions machines.
3. Write the sentence once and template it. “This article was drafted with AI assistance and reviewed and edited by [name] before publication” does more work than a badge, because it asserts the review step the exception turns on.
4. Do not retrofit the archive in a panic. Content generated before 2 August 2026 is not covered by the retroactive marking obligation. Fix the workflow that produces new posts first.
5. Check your chatbot separately. It is a different paragraph, a different party and a deadline that has already passed. Ours failed its own audit when we checked — the full walkthrough is here.
6. Do not buy a compliance plugin yet. Nothing in the directory has the install base or the review history to be worth trusting with a legal obligation. A sentence in your template is more reliable than an untested plugin.

Where this leaves the AI-content question

The instinctive reading of a regulation like this is that it is bad news for AI-assisted publishing. We do not think that survives contact with the text. Article 50 does not restrict how much AI content you publish, does not require approval, and does not stop you generating a post a day.

What it does is attach a condition to the specific configuration where nobody looks at the output — and that configuration was already producing the content that gives AI publishing its reputation. The rule and the quality incentive point the same direction, which is rarer than it sounds.

We build tools in this space. MxChat’s content features generate drafts, and we ship them precisely as drafts, with a review step in front of publishing — not because of the AI Act, but because generated copy that nobody reads is how you end up with the wrong price in a pricing table, which has happened to us. The regulation has now made an editorial habit into something closer to a legal position. That is a reasonable place for it to land. The generation tooling, review step included, ships with MxChat Pro.

The AI Act is not the only EU deadline arriving in 2026. The Cyber Resilience Act’s reporting duty starts on 11 September, and unlike the disclosure rules above it lands on the people who make the software rather than the people who publish with it — including free WordPress plugins that funnel to a paid tier.

Frequently asked questions

Does the EU AI Act apply if my site is not in the EU?

It can. The Act reaches providers and deployers outside the EU where the output of the system is used in the Union. A US-hosted WordPress site with EU readers is not automatically outside its scope. Whether anyone enforces against a small overseas publisher is a separate question from whether the obligation exists.

Do I have to label every AI-assisted post?

No. Article 50(4) reaches text published to inform the public on matters of public interest, and it does not apply where the content underwent human review or editorial control with a person or company holding editorial responsibility. Most WordPress publishers with a real editing step fall inside that exception.

Is a footer line saying “written with AI” enough for Article 50(2)?

Not on its own — 50(2) asks for marking in a machine-readable format. A visible line addresses the human-facing side of transparency and is worth having, but it is not what that paragraph is asking for. In any case 50(2) is a provider obligation, so for most site owners it will arrive as a feature of the tools they use.

What happens on 2 December 2026?

The transition period for the 50(2) marking obligation ends. Systems placed on the market before 2 August 2026 had until that date to comply. The other Article 50 obligations, including the chatbot disclosure and the deployer duties, have applied since 2 August 2026.

What are the actual fines for getting this wrong?

Article 99(4) sets the ceiling for Article 50 breaches at €15,000,000 or 3% of total worldwide annual turnover, whichever is higher. The €35m / 7% tier that appears in most coverage belongs to Article 5 prohibited practices, not to transparency. For SMEs, Article 99(6) caps the fine at the lower of the two figures rather than the higher.

Does this apply to AI-generated images too?

Yes — 50(2) covers synthetic audio, image, video and text alike, and image marking is the part where the technical standards are furthest along, since C2PA works well on files. If you generate featured images with AI, that content is in scope for the marking obligation on the same December timeline.

Disclosure: this article was drafted by an automated AI agent that operates this site’s SEO workflow, and published without prior human review. Editorial responsibility for mxchat.ai is held by Maxwell Reynolds. The legal analysis is a reading of the primary sources cited below, not advice.

Sources: Regulation (EU) 2024/1689 Articles 50 and 99; European Commission guidance on transparency obligations under Article 50; WordPress.org plugin API, queried 7 August 2026. Site figures are from a first-party audit of mxchat.ai on 7 August 2026. This article is informational and is not legal advice.