EU AI Act: The 10-Point Checklist for Your Website
Ten points to help you assess your website’s AI transparency status in just one hour — from initial inventory to ongoing monitoring.
Since 2 August 2026, the transparency obligations of the EU AI Act apply. Most guides explain the law — but few tell you what to do on Monday morning. This checklist bridges that gap: ten points you can work through step by step.
Inventory (Points 1–4)
- 1. Do you know how many images, videos, and texts are hosted on your domain? Don’t estimate — count. Established websites almost always have more content than the operator expects.
- 2. Do you know the origin of your images? Agency, stock provider, your own photo, AI tool — there should be an answer for every piece of content.
- 3. Is there a chatbot running on your site? If so, it must identify itself as a machine at first contact — the clearest case under Art. 50.
- 4. Are there videos featuring people who never actually spoke those words? Synthetic voices, swapped faces, animated photos — all are potential deepfakes and must be explicitly disclosed.
Labelling (Points 5–7)
- 5. Are identified AI-generated contents visible to visitors? A discreet but noticeable note on the content is sufficient — it simply needs to be present.
- 6. Is the labelling also machine-readable? The EU Code of Conduct refers to standards such as C2PA and IPTC — visible notices alone will not be sufficient in the long term.
- 7. Is it documented who checked and decided what, and when? In case of dispute, it’s not good intentions that count, but the record.
Ongoing Operation (Points 8–10)
- 8. What happens with new content? Every blog post, every campaign image can trigger new obligations — one-off checks become outdated within weeks.
- 9. Who in your organisation is responsible? Without a clearly assigned person, the topic will be neglected after the initial clean-up.
- 10. Can you demonstrate your due diligence if asked? A publicly accessible record answers the question before it is even raised.
The quickest first step
Points 1 and 2 can be completed by an automated audit in under a minute: it counts your content and shows which items bear traces of machine generation. This gives you a clear picture of what you’re actually dealing with.
As always: this checklist provides technical and organisational guidance, not legal advice. The assessment of contentious individual cases is a matter for your solicitor.
Free audit
What is actually on your website?
Enter your domain, wait less than a minute — you will see which content shows traces of AI generation. No registration required.
Read more
Art. 50 EU AI Act: Who Must Label AI Content — and What This Means in Practice
The practical guide to labelling obligations: affected content, the operator’s role, and the most common misconceptions.
How to Detect AI-Generated Content — and Why No Single Detector Is Sufficient
Why metadata provides the strongest evidence, classifiers can be misleading — and why, ultimately, a human should make the final decision.
Labelling AI Images: What Is Mandatory, What Is Sensible — and How to Do It Properly
The honest answer to the most common question — and three design rules to ensure your labelling doesn’t look like a warning sign.
Deepfakes on Your Own Website: Why the Operator Is Liable — Not the Creator
The law’s most powerful lever does not target AI providers, but you — and deepfakes arise more quickly than most people realise.
C2PA, Metadata, Watermarks: How Machine-Readable AI Labelling Really Works
A look inside the file rather than at the image: the standards that make origin verifiable — clearly explained.
Stock Photos and AI: Why Almost Every Website Contains Unlabelled AI Content
You have never knowingly used AI? Your website probably has — in ways no one expects.