Since 2 August 2026, two parts of the EU AI Act reach publishers from opposite directions. Article 50 places a duty on the publisher. Article 53 places a duty on the AI companies that train on the publisher's content.
Most compliance checklists cover only the first. That leaves half the evidence uncollected — and it is the half a publisher needs when it wants to enforce its rights rather than defend its own conduct.
This article sets out the records worth keeping on each side, who should own them, and where the AI Act itself stays silent.
In short
Article 50 asks a publisher to prove what it did. Article 53 lets a publisher prove what was done to its content — but only if the publisher kept its own records.
Under Article 50(4), a publisher that uses AI to generate or manipulate text published to inform the public on matters of public interest must disclose it, unless the text went through substantive human review under a named editorial responsibility. That duty has applied since 2 August 2026, with no transition.
Under Article 53, providers of general-purpose AI models must keep a copyright policy that identifies and respects rights reservations, and publish a summary of their training content. The AI Office's enforcement powers over those obligations also apply from 2 August 2026. The publisher is not the regulated party, but it is the party whose evidence decides whether a reservation existed and when.
The practical answer is a ten-record checklist: six records for the Article 50 side, four for the Article 53 side.
What changed in August 2026
Several dates are easy to blur, so here they are in order.
2 August 2025. Obligations for providers of general-purpose AI models, including the Article 53 copyright policy and training-content summary, started applying.
10 June 2026. The European Commission published the final Code of Practice on marking and labelling AI-generated content. It is voluntary, with one section for providers (marking, Article 50(2)) and one for deployers (labelling, Article 50(4)), and it introduces EU icons that publishers can use as labels.
20 July 2026. The Commission published its final guidelines on Article 50, which read the editorial exception narrowly.
2 August 2026. Article 50 applies, including the Article 50(4) deployer duty with no transition. The Commission's enforcement powers over general-purpose AI obligations enter into application on the same day.
2 December 2026. Under Regulation (EU) 2026/1744, the Digital Omnibus on AI, generative AI systems already on the market before 2 August 2026 have until this date to implement Article 50(2) machine-readable marking. The relief covers marking by providers only, not labelling by deployers.
Article 50 vs Article 53: which side is the publisher on?
The two articles do not regulate the same actor, and a publisher can sit on more than one side at once.
Provision | Regulated party | When a publisher is that party | What the evidence is for |
|---|---|---|---|
Art. 50(4) — labelling public-interest text | Deployer | Whenever it publishes AI-generated or AI-manipulated text informing the public | Showing the label was applied, or that the editorial exception applied |
Art. 50(1) — telling users they interact with AI | Provider | When it ships its own chatbot or "ask the book" assistant under its brand | Showing users were informed by design |
Art. 50(2) — machine-readable marking | Provider | When it places its own generative system on the market | Showing outputs are marked and detectable |
Art. 53(1)(c) and (d) — copyright policy, training summary | GPAI model provider | Almost never; the publisher is the rights holder | Showing a reservation existed, when, and what was accessed or licensed |
The third and fourth rows are where most publishing teams misjudge their position. A publisher that launches a branded AI assistant has moved from deployer to provider for that product. A publisher licensing a catalogue to an AI company has not become a provider at all — it has become the holder of evidence the provider's compliance depends on.
For the licensing consequences of that last point, see why access is not a usage record under the EU AI Act.
The checklist: ten records, by article
The order matters. Records one to six protect the publisher as a regulated deployer or provider. Records seven to ten protect the publisher as a rights holder facing regulated providers.
# | Record | Article | Owner | Why it matters |
|---|---|---|---|---|
1 | Scope decision: is this text published to inform the public on a matter of public interest? | 50(4) | Editorial lead | The duty only exists inside this scope; an undocumented scope call cannot be defended later |
2 | The version a reviewer approved, the reviewer's identity and relevant competence, and the date and scope of the review | 50(4) | Editorial | The exception protects the reviewed text, not the publication in general |
3 | Designation of the person holding editorial responsibility | 50(4) | Legal and editorial | The second cumulative condition of the exception |
4 | Log of every AI step applied after sign-off: tool and known version, change type, time | 50(4) | Product or CMS owner | A substantive post-approval intervention can void the exception for the published version |
5 | Labelling decision and the label as actually displayed | 50(4) | Editorial and product | Where the exception is not claimed, the label is the compliance |
6 | For each AI tool in use: its marking status and deadline, and a check that marks survive CMS export and republication; for own-brand assistants, the user notice and marking evidence | 50(1), 50(2) | Procurement and product | A vendor's marking gap before 2 December 2026 does not lift the publisher's own labelling duty, and a mark stripped on export no longer proves anything |
7 | Dated register of rights reservations: every robots.txt version, machine-readable protocol and terms-of-use change | 53(1)(c) | Rights and tech | Providers must respect reservations; only the publisher can prove what its reservation said on a given date |
8 | Raw crawler access logs, kept beyond the default rotation window | 53(1)(c) | Tech | The only contemporaneous record of who accessed what, under which declared identity |
9 | Licence register by purpose — training, retrieval or grounding, display — with term, counterparty and usage reports received | 53(1)(c) | Rights and legal | Separates licensed use from use that required authorisation and did not have it |
10 | Provider file: archived versions of each provider's public training-content summary, notices and complaints sent, replies received | 53(1)(d) | Legal | Summaries change; a complaint is only as strong as the dated version it cites |
Records seven and eight carry the same logic as the custody ranking in what publishers must record themselves about AI search controls: keep first what only you can produce, because nobody else will produce it for you.
The Article 50 side: the sign-off is the control point
Records two to four hang on one moment: the editorial sign-off. Any AI step after it that changes structure, meaning or claims reopens the question of whether the editorial exception still covers the published text — which steps qualify is analysed in what breaks the Article 50 editorial exception after sign-off.
The consequence is a CMS workflow, not a policy statement: record the approved version, log every automated step that touches it afterwards. A line saying "reviewed by our editors" does not do that job, for the reasons set out in why AI disclosure is not an audit trail.
Record six closes a procurement gap, and it is where the provider role starts. Until 2 December 2026, a generative tool already on the market may legally ship without machine-readable marking, but the publisher's Article 50(4) duty to label public-interest text applied from 2 August. Vendor contracts should state the tool's marking status, its compliance date, and what it is allowed to change after sign-off.
The Article 53 side: obligations that only work with your records
Article 53(1)(c) requires general-purpose AI providers to identify and comply with rights reservations expressed under Article 4(3) of the Directive on copyright in the Digital Single Market. For content made publicly available online, that reservation has to be expressed in an appropriate manner, such as machine-readable means.
The signatories of the General-Purpose AI Code of Practice — among them Amazon, Anthropic, Google, Microsoft, Mistral AI and OpenAI — went further in its copyright chapter. They committed not to circumvent effective technological measures such as paywalls and to exclude sites recognised as persistently infringing (Measure 1.2); to follow robots.txt as specified in IETF RFC 9309, alongside other appropriate machine-readable protocols (Measure 1.3); and to designate a point of contact with an electronic complaint mechanism open to rights holders and collective management organisations (Measure 1.5).
Complaints under Measure 1.5 have to be "sufficiently precise and adequately substantiated" — which is where the publisher's own records come in. Each of those commitments turns into a factual question the publisher must answer first. Was the reservation in place on the date of the crawl? Which crawler identity accessed which section? Was the content covered by a licence, and for which purpose? The provider's compliance file cannot answer those questions for the publisher, and it has no reason to try.
This is also why record nine separates purposes. A licence for retrieval is not a licence for training, and the distinction collapses quickly in a dispute if the register does not hold it. The same holds for collective licensing, where who holds the authority to put content into an AI system has to be documented before any use can be priced.
Who owns what
The checklist fails most often at the handoffs, not inside a single team. Three are worth naming.
Editorial to product. Editorial owns the review and the responsibility designation. Product owns the log of what happens to the approved version afterwards. If neither owns the link between the two, record four never exists.
Tech to rights. Tech controls robots.txt and log retention. Rights and legal need dated versions of both. A thirty-day log rotation decided for infrastructure reasons is, in practice, a decision to discard Article 53 evidence.
Procurement to legal. Every AI tool contract should map to record six, and every AI licence to record nine. If licences live in email threads, the register does not exist.
What the AI Act does not say
Three limits are worth stating plainly, because they shape how much to retain.
First, the AI Act does not set a record-keeping period for Article 50(4) deployers. The retention case is practical, not statutory: if a market surveillance authority asks whether the exception applied to a given article, the publisher needs to show it. Our working recommendation is to keep the review record for as long as the text stays published, plus a buffer agreed with counsel.
Second, the transparency Code of Practice and the General-Purpose AI Code of Practice are voluntary, and the Commission's guidelines are not binding law. They are, however, the baseline authorities and providers are expected to work from first.
Third, Article 53 is enforced against providers by the AI Office, which is not expected to assess compliance work by work. Individual enforcement of a reservation remains a copyright matter driven by rights holders. That is precisely why the publisher's own records carry the weight.
Frequently asked questions
Does the AI Act require publishers to keep evidence?
Not through an explicit retention rule for Article 50(4). It requires publishers acting as deployers to label AI-generated public-interest text unless the editorial exception applies. Demonstrating that the exception applied, or that the label was displayed, requires records — so the obligation to keep evidence is practical rather than written.
Is a publisher bound by Article 53?
Only if it is itself a provider of a general-purpose AI model, which is rare. In nearly all cases the publisher is the rights holder whose reservations and licences Article 53 providers must respect. The publisher's records are what make that obligation testable.
What changes on 2 December 2026?
Generative AI systems already on the market before 2 August 2026 must implement Article 50(2) machine-readable marking by that date. The Article 50(4) labelling duty for deployers is not affected and has applied since 2 August 2026.
Does launching an AI assistant change a publisher's obligations?
Yes. A publisher that places its own generative AI system on the market becomes a provider for that system. It must then inform users that they are interacting with AI under Article 50(1) and ensure outputs are marked under Article 50(2), on top of its deployer duties.
Is a robots.txt file enough to prove a rights reservation?
The file shows the current reservation, not the past one. What proves a reservation in a dispute is a dated history of every version, together with access logs showing which crawlers visited while each version was live.
Continue the evidence chain
AI Act Article 50: What Breaks the Editorial Exception After Sign-Off
EU AI Act and Content Licensing: Why Access Is Not a Usage Record
AI Search Controls: What Publishers Must Record Themselves
AI Transparency Law Should Regulate Evidence That Survives Model Change
When AI Licensing Deals Become Evidence in Court
AI Usage Evidence for Publishers: The Proof Layer for AI Licensing
Book an AI Act evidence review
Sources
European Commission — Commission publishes Code of Practice on marking and labelling AI-generated content (10 June 2026)
Code of Practice on marking and labelling AI-generated content
European Commission — Final guidelines on transparency obligations for providers and deployers of AI systems (20 July 2026)
Guidelines on transparency obligations
European Commission — FAQ on transparency obligations under Article 50 of the AI Act
Transparency obligations under Article 50 of the AI Act
European Commission AI Act Service Desk — Article 53: Obligations for providers of general-purpose AI models
Article 53
European Commission — General-Purpose AI Code of Practice
General-Purpose AI Code of Practice
European Commission — Copyright chapter of the General-Purpose AI Code of Practice (10 July 2025)
GPAI Code of Practice — Copyright chapter (PDF)
European Commission — Template for GPAI model providers to summarise their training content
Training content summary template
Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI)
Official Journal text
Bird & Bird — Taking the EU AI Act to Practice: The Final Transparency Code of Practice (2026)
The Final Transparency Code of Practice
This article is operational analysis for publishing, rights and editorial teams, not legal advice. Confirm application to a specific publication or licence with counsel.