If you run a small news site and you have used a tool to draft a headline, generate a feature image, or tidy up a press release, Europe's new rulebook has something to say about you.

The EU AI Act, formally Regulation (EU) 2024/1689, entered into force in August 2024 and applies in stages. It is long, dense, and written with regulators and large vendors in mind. The parts that touch an independent publisher, though, are narrower than the headlines suggest — and mostly cheap to satisfy.

The short version: you are almost certainly a "deployer" rather than a "provider." Your main duty is transparency. Your biggest deadline is August 2026, with a couple of smaller items already in force.

What follows is a working map, not legal advice. If you publish at volume, sell political advertising, or build your own tools, get a lawyer who knows media law.

First, work out which side of the line you are on

The Act splits obligations between providers — the companies that build a system or put it on the market under their own name — and deployers, the businesses that use one. Most small publishers are deployers. You pay for a subscription to a writing assistant, an image generator, a transcription service, and you use it the way you would use any other software.

You can slide into the provider role without noticing. The usual routes are:

  • You fine-tune a model on your archive and distribute the result.
  • You rebrand a vendor's tool and offer it to readers as your own product.
  • You substantially modify a system and put it into service under your name.

If any of those describe you, the heavier provider duties apply: technical documentation, conformity assessment, and in some cases registration in an EU database. That is a different conversation, and usually the point at which to call a lawyer.

The risk categories, in plain terms

The Act sorts systems into four buckets. Only one of them matters much to a newsroom.

  • Unacceptable risk. Banned outright. Social scoring, manipulative techniques that exploit someone's vulnerabilities, untargeted scraping of faces to build databases. Nothing a small publisher should be anywhere near.
  • High risk. Listed in Annex III: recruitment, credit scoring, education, essential services, biometric identification, and systems built to influence elections or voting behaviour. A general news site rarely lands here. A site selling programmatic political ad targeting might get closer, so check before assuming you are clear.
  • Limited risk. Chatbots, emotion recognition, synthetic content. This is where publishers actually live. The duty is disclosure, not certification.
  • Minimal risk. Spam filters, simple recommendation widgets, spelling tools. No specific obligations beyond ordinary care.

The transparency rules that will shape your workflow

Article 50 is the section worth reading twice. In practice it means four things for a publisher:

  • If you publish synthetic text to inform the public on matters of public interest, you must disclose that it was artificially generated — unless a human reviewed it and takes editorial responsibility.
  • If you publish a deepfake — an image, audio clip or video of real people or events that looks authentic — you must label it.
  • If you run a chatbot on your site, readers must be told they are talking to a machine.
  • Machine-readable marking of generated output sits mostly with the provider, but the visible label on the page is yours.

The editorial-control carve-out, and how not to abuse it

That first exception is the one small publishers should understand best. Human review plus editorial responsibility can mean no label is required. But "run it past an intern" does not qualify. It means a named editor has checked the claims, fixed the framing, and is willing to stand behind the piece. Keep a note of who reviewed what and when. Interpretation of this exception may vary between member states, so your records are your defence.

The dates, in order

  • 2 February 2025: bans on prohibited practices, plus the duty to ensure staff have adequate literacy in these systems.
  • 2 August 2025: rules for general-purpose models and the governance machinery around them.
  • 2 August 2026: most remaining obligations, including the Article 50 transparency duties.
  • 2 August 2027: high-risk systems embedded in products already covered by other safety rules.

Some of these timings have been the subject of adjustment proposals at EU level and remain politically contested. Before you plan a project around a specific date, confirm it against current official guidance rather than a blog post from last year.

Literacy is the cheapest box you will ever tick

The literacy duty asks deployers to make sure the people handling these systems know what they are doing. There is no certificate and no exam. For a team of four, a one-page internal note plus a short session, with a record of who attended, is a defensible answer. Cover the four things that actually cause damage: what the tools get wrong, how errors creep into copy, what must never be pasted in (unpublished sources, embargoed material, personal data), and who signs off before publishing.

A practical checklist for the next month

  1. Inventory. One spreadsheet: tool, vendor, what it produces, who uses it, where the output ends up.
  2. Classify. For each row, decide provider or deployer, and which risk bucket applies.
  3. Read the contracts. Many vendors now ship an AI addendum. If a supplier will not say whether it meets its own duties, that tells you something useful.
  4. Write one page of editorial policy. Disclosure rules, human review, banned uses. One page, not a handbook.
  5. Build labelling into the CMS. A checkbox at publish time beats relying on memory.
  6. Keep records. Dates, decisions, training. Regulators ask for evidence, not intentions.

The realistic bottom line

For most independent publishers this is a documentation and disclosure exercise, not a rebuild. The sites that get into trouble will be the ones that cannot answer a simple question: which tools are you using, and who checked the output before it went live?

Two cautions to close. Penalties are tiered and can be steep, though the Act caps them for smaller businesses, and enforcement will go after the worst conduct first. And none of this substitutes for legal advice. Compliance is a floor, not a ceiling — your readers are still the ones who decide whether the piece was right.

Photo: USA-Reiseblogger / Pixabay