Four places you now have to say that AI did it

The transparency duties apply now, and they are not hard to meet. What trips companies up is not knowing which of their own touchpoints are in scope. Work through these four and you have covered most of what a mid-sized Estonian company actually does.

1. The chatbot or voice line

If customers can talk to software, they have to be able to tell. The disclosure has to land by the first interaction, not in a policy page they will never open. One line in the opening message does the job. Name the thing and say a human is available, because the second half is what stops people arguing with a bot about a refund.

2. Generated images, video and audio

Synthetic output has to carry a machine-readable marker so software can detect it. In practice this means checking whether the tool you use embeds provenance metadata, and whether your own pipeline strips it. Export, resize and compression steps routinely throw metadata away. Test one asset end to end before you assume you are covered.

Anything already published before August has until 2 December 2026 to meet the marking requirement, which is the deadline most teams are going to miss by forgetting their back catalogue exists.

3. Emotion and biometric scoring

If a system reads sentiment in support calls, scores candidate video interviews, or sorts people by inferred characteristics, the people on the receiving end have to be told before or while it happens. This duty sits on you as the deployer even when a vendor built the tool. Sentiment analytics bolted onto a contact centre platform is the common case and the one people forget.

4. Published text on public-interest matters

AI-written text published to inform the public needs a label, unless a human reviewed it substantively and someone carries editorial responsibility for it. For a company blog about your own products, this rarely bites. For commentary on policy, health, safety or elections, it does. If you run the review, record who did it, because the exemption depends on that review having happened.

The judgement call to document

Disclosure falls away when AI involvement is obvious to a reasonably observant person. That exemption is real and it is also the one a regulator will ask you to justify. Write a short note for each case: what the touchpoint is, why you considered it obvious, who decided. Half a page, kept with your other compliance records.

• ✳Assistive editing such as spellcheck stays outside the marking duty
• ✳A tool that substantially rewrites the text does not
• ✳Art and satire are disclosed in a way that does not spoil the work
• ✳The rules follow your users, so serving EU customers from outside the EU changes nothing

An afternoon covers all four. The reason to do it now rather than in December is that the back catalogue takes longer than the live site.