How to document and certify AI-generated content, step by step

Compliance with the EU AI Act isn’t something you tack on once a file is finished. For an agency, a production company, a brand or a newsroom, the work has to start before anyone opens an AI tool.

Article 50 of the AI Act sets out transparency obligations for certain AI systems, and for content that has been generated or manipulated with AI. Those obligations have applied since 2 August 2026 (Regulation (EU) 2024/1689 of the European Parliament and of the Council).

Documenting each stage of a project is what lets you show which technology was used, what human involvement there was, and why a piece was labelled — or wasn’t — before it went out.

Here’s a practical, step-by-step way to document AI-generated content so your organisation can meet the Article 50 requirements now that they’re in force.

Step 1. Identify the content and its purpose#

Start by defining what you’re producing: text, image, video, audio, an advert, editorial content or corporate material.

Record its purpose too, along with the channels it will run on, the audience it targets, and which organisation is accountable for it. This context is what determines whether the transparency obligations apply at all.

Step 2. Record the AI tools you used#

For each project, log:

• The provider and the specific tool.
• The model used.
• The account or licence type.
• The date of production.
• The contractual terms in force at the time.

Account type matters more than most teams assume. It can affect what you’re allowed to use commercially, how your data is handled, and what guarantees the provider actually gives you.

Step 3. Document your input materials#

When you document AI-generated content, keep the texts, images, videos, audio, documents and databases that were fed into the system.

Record where each item came from, along with any licences, permissions, image rights and personal data involved. Running material through an AI tool doesn’t waive the intellectual property or data protection obligations attached to it.

Step 4. Keep your prompts and intermediate outputs#

Traceability needs to cover the instructions sent to the system, the different versions of those instructions, the outputs generated, and anything that got discarded along the way.

That trail is what makes it possible to reconstruct how a piece evolved, and to separate what the model produced from what a person decided.

Step 5. Evidence the human involvement#

Identify who selected, edited, corrected and signed off on the final result.

This matters most for text published to inform the public on matters of public interest. To qualify for the labelling exemption, a piece needs genuine human review or editorial control, with someone accountable for what gets published.

Step 6. Decide whether it needs a label#

Images, video and audio that amount to deepfakes must disclose that they were artificially generated or manipulated. Under the EU AI Act’s Code of Practice on Transparency of AI-Generated Content, a deepfake is content that realistically resembles a real person, object, place or event, closely enough that it could pass for the real thing.

Not every AI-assisted piece needs a visible label. What matters is that the decision gets documented, so you can justify it later if you’re asked to.

Step 7. Apply the right marking#

Where the obligation applies, the content should carry:

• A visible or audible disclosure for the audience.
• Machine-readable technical marking.
• Information about its provenance and any modifications made.

The icons developed by the EU are voluntary, but using them gives you a consistent way to signal compliance with Article 50.

You’ll find the icons and guidance on using them on the official European Commission page.

Step 8. Certify and preserve the evidence#

VeriqX documents and certifies an AI-generated piece step by step, without slowing production down. It records the tools, models, prompts, input files, intermediate outputs, human involvement and the labelling decision made for each piece.

From that record, it issues a certificate tied to the final file, using timestamping and standards such as C2PA / Content Credentials to reinforce its integrity and traceability.

No tool can guarantee legal compliance on its own, and VeriqX doesn’t claim to. What it gives you is proof that your organisation followed a structured process of transparency, control and due diligence.

A label tells the audience something happened. Documentation is what lets you show exactly how, and why.

If what you need is to get the whole organisation ready, rather than a single piece of content, work through the EU AI Act compliance checklist for companies.

Not sure how to get your organisation ready for the EU AI Act?#

If you need advice on auditing your processes, documenting content, or putting certification and transparency systems in place:

• Technical consultancy and corporate certification: contact the VeriqX team at [email protected].
• Talk to the author directly: connect with David Lahoz (co-founder of VeriqX and a generative AI consultant) on LinkedIn: https://www.linkedin.com/in/dlahoz/

Key points and frequently asked questions#

When do the EU AI Act transparency rules apply?#

Since 2 August 2026, the Article 50 obligations to label and document synthetic content have been mandatory.

What is a deepfake, and when does it need a label?#

Any image, video or audio that realistically resembles a real person, object or place. It needs a visible or audible disclosure so audiences aren’t misled.

How does VeriqX support AI traceability?#

It records prompts, tools, inputs and human involvement, and issues a certificate with timestamping and the C2PA standard.