Think Like a Publisher - Fleur Willemijn Newsroom

Who signed off on that? Most brands can't say

Sun, 09 Aug 2026 08:06:45 +0200

You can't say who approved the last ten pieces of content your brand published. Or which ones AI touched, and how much. That's a governance gap on your website, unowned, waiting for someone outside your company to ask the question first.

As of August 2nd, the EU AI Act requires anyone publishing AI-generated text on matters of public interest to disclose it — unless that content went through human review and a named person holds editorial responsibility for it.

→ That exemption is the entire case for having an editorial policy.

This isn't a content problem, it's a governance problem

A CMO thinks about this as brand voice. A CEO should think about it as exposure. A competitor, a journalist, or a regulator can ask how your organization decides what gets published and how AI is involved. ‘We haven't written that down’ doesn't survive the boardroom.

An editorial policy is not a disclaimer. It's a public statement of who owns the content your brand puts into the world, and how. It converts an implicit practice, probably inconsistent, probably undocumented, into a standard anyone can check. Ownership, made visible.

It also does something quieter. It signals that AI at your organization is reviewed by a process, and led by a human. That's exactly where AI governance belongs: visible at the level where the organization takes responsibility for what it says.

Nine elements, none of them optional

A working editorial policy is short, plain and specific. It reads like a standard, not a legal shield.

A one-line stance on human ownership, stated up front, not buried in a footer
A named person or role with final editorial authority, not ‘our team’
An explicit line between what AI does (drafting, research, structure) and what stays human (judgment, verification, the final word)
A verification standard, stated without hedging. ‘Facts are checked before publication,’ not ‘checked where reasonably possible’
A correction policy: what happens when something's wrong, and how readers find out
A conflicts-of-interest line: how sponsorships, partnerships or client work are kept separate from editorial content
A sourcing standard: no fabricated quotes, no unverifiable sources, ever
A review cadence for the policy itself, with a last-reviewed date. A policy nobody revisits is a policy nobody trusts
A way to reach someone with a question or a correction

Three organizations already do this

None of these are long or read like a disclaimer. All three name state a standard, and say it plainly enough that a reader can hold them to it.

My thinklikeapublisher.com runs this at the smallest possible scale: ‘Human expertise comes first. AI is a tool. I'm the author.’
The Guardian built its policy through a cross-functional working group spanning editorial, engineering, legal and commercial teams.
Thomson Reuters has ‘Data and AI Ethics Principles’, that tie back to the company's Trust Principles, a framework older than most of its current AI tools. Governance inherited from a century of editorial credibility, applied to AI rather than invented for it.

What to do

Start with the nine points above. Check how many your brand can already answer.

The EU AI Act's disclosure rule took effect this month. Human review and a named editorial owner are what keep your content out of that requirement, a policy is how you prove both exist.

Write yours before someone asks why you don't have one. There’s no excuse left not to.

Sources

Join 2,750+ professionals

AI changes how the work gets done. I test it in my own work and write about what actually works.

Free. Unsubscribe anytime.

→ Subscribe

You probably don't need the AI-generated label

Mon, 27 Jul 2026 21:14:00 +0200

Article 50 becomes applicable on 2 August 2026. The final guidelines were published on 20 July, with just two weeks' notice.

Now the market is confused, and searching.

→ Marketers are mostly worried about the wrong thing. They're checking whether to slap a label on everything AI touched. They should be checking their editorial process instead.

Marketing only own one of Article 50's four rules

These are the 4 obligations when you need to notify that you’re using AI.

If your AI talks to customers, it has to say so. Chatbots, AI agents, anything conversational on your site or in your DMs.
AI tools that generate audio, image, video, or text must embed a marker so the output is detectable as AI-generated. These machine-readable markers are the tools responsibility, and are invisible for you and me.
If you're scanning faces or emotions, say so. This is niche. Most content and marketing work never touches this one.
You must inform your audience about deepfakes and text publications on matters of public interest without human review or editorial control.

The fourth rule is ‘deepfakes and text on matters of public interest must disclose that it's AI-generated’ is the one that matters to you. It's also the one that gets misunderstood the most.

And where your exemption lives.

‘Informing the public on a matter of public interest’ explained

There are 3 gates. If one of these answers is ‘no’, you don’t need the AI-generated label.

Is it published? Is it public? Not a draft, not an internal doc, not a one-off email to a client.

Is it informing, not selling? This gate decides most typical marketing cases with ‘no’.

Ask yourself: Is this to promote or directly sell a product or service? Or would you call this journalism, or brand content to inform that happens to touch a serious subject?

Most of your marketing copy, product descriptions, social posts, newsletters don’t fall under the Article 50's AI-labelling rule. Because this content is more sales focused and not a matter of public interest.

The most complicated one: Does the topic sit in a public-interest category? Politics, public health, justice, the environment, consumer safety, or an economic, scientific, or cultural development or trend people are debating.

Explained by example: two pieces, same author (me), same site (mine), opposite outcomes.

My LinkedIn post curating a podcast episode and a summer book pick.Published, yes. Selling? No. Informing the public on a public-interest matter? No. It's brand voice. Out of scope.
A blog breaking down what these Article 50 guidelines mean for content teams, this piece in fact. Published, yes. Written to inform, not to sell. Sitting inside a named public-interest category. That one's in the gray zone. Probably in scope.

But I have my editorial process in place, I can prove my human review, I’m the named author, so no AI-generated label needed.

→ Stop worrying about the AI-tag. Start worrying about the documented editorial process you don't have in place yet.

→ This safeguards your copyright too.

How you qualify for the AI label exemption

This is where most companies don't comply. Human review and editorial control means someone more than just fact-checking or correcting typos. You need someone with real knowledge of the subject examined the content. This person has the actual authority to approve, change, or kill the piece, and takes responsibility for it.

→ Here's the process you need to qualify: one named person, with real subject knowledge, who can reject the piece and is on record as having reviewed it. Write that down as proof, if anyone ever asks.

If you don't have this documentation, you don't have a defensible position. Just a company hoping nobody asks.

There's a second reason to build this documentation. EU copyright law only protects work with genuine human creative input. The proof of your editorial review for Article 50 is the evidence that protects your copyright too.

Deepfakes: visual, video and audio content

A deepfake, under Article 50, is AI content realistic enough to pass as something real that could exist — and convincing enough that someone might believe it. The rules are stricter.

All three of these need to be true before the watermark requirement applies:

It closely resembles the real thing.
That real thing exists.
It could fool someone into thinking it's genuine.

Text gives you an out when the content is selling, not informing. Deepfakes don't get that out. With text, intent decides. With visual, video, or audio, it doesn't — the rule applies regardless of why you made it.

Explained by example: a dragon and an AI host, same technology, opposite outcomes.

A dragon breathing fire in an ad, however photorealistic, isn't a deepfake. It fails criterion two; dragons don't exist and never have, so there's nothing real for the content to falsely pass off as. No disclosure needed, no matter how convincing the rendering.

An AI-generated host fronting your online masterclass is a different case entirely. It resembles a real person. That kind of person, someone teaching, on camera, speaking directly to an audience, plausibly exists. And if you don't disclose it, your audience has every reason to believe they're learning from someone real. All three criteria met.

Same underlying technology. The difference is what the content claims to be, not how well it's made.

Why marketers panic anyway

If the rule is this narrow, why is everyone still panicking?

The usual coverage flattens it. Most headlines read ‘AI Act requires labelling AI content.’ Full stop. Nobody mentions the four-obligation split, the three gates, or the editorial exemption.

The fine number does the scaring. €15 million or 3% of turnover gets quoted next to ‘AI content’ with no qualifier attached. Nobody checks if it applies to them first.

Legal talk adds to the confusion. Provider and deployer obligations get mashed into one. The invisible watermark is the tool's job. The visible disclosure is sometimes yours. Report both as ‘AI content must be marked,’ and marketers can't tell which part is theirs.

Legal teams default to safe. ‘Label everything AI touched’ is the most secure solution. ‘You're probably exempt if you can prove editorial control’ takes work that's outside of their influence.

And fear sells better than nuance. It pitches easier ‘you must label everything’ than ‘you're probably fine if your process holds up.’

→ None of this is irrational.

It just takes real work to understand the obligation, and right now the ownership of that work hangs in the middle, between legal, marketing, and whoever built the AI tool.

Wrappin it up; build the process, skip the AI label

Most companies think they need an AI label. Don’t worry about the tag. Worry about the process you don't have in place yet. Not only for Article 50. For your copyright too.

Compliance was never going to be a sticker. It was always going to be a decision about who's allowed to say yes.

First. Know Article 50, the obligations, the gates and the exemptions. And separate your deepfake from your text content, as different rules apply.

Second. Run your written content through the three gates: published, informing not selling, sitting in a public-interest category. Flag anything that lands in the gray zone.

Third. Pick named persons as topic experts, with real subject knowledge, who have the authority to reject a piece before it publishes. Write down that this person reviewed it, and what they checked. Usually this is also the author of the piece.

→ None of this is a label. It's a process. Build it once, and use it daily.

Disclaimer and sources

This isn’t a legal advice — I'm a strategist, not a lawyer. This is my read of the regulation for marketing purposes.

Secondary sources and legal commentary:

Join 2,750+ professionals

Most content advice tells you what to do. This tells you how to think. For marketers and communicators who think before they create.

Free. Unsubscribe anytime.

→ Subscribe

The EU AI Act created board obligations — the briefing just never arrived

Mon, 11 May 2026 09:14:00 +0200

Most boards treated AI as a technology decision. Handed it to IT. Flagged it for legal. Put it on next year's agenda and moved on. That felt responsible. It isn’t.

The EU AI Act makes AI a board responsibility. Not a department responsibility. Not a vendor responsibility. Yours. Since February 2025.

This piece draws on the EU AI Act and on copyright legislation. Both are in effect. Both are moving. Sources at the bottom.

Here is what every board needs to know.

1. Training your people is a legal obligation

This is not something to include in next year's planning cycle. It has been law since February 2025.

→ If your organization uses AI, in any form, for any purpose, you are required to ensure that everyone who works with it understands how it functions, where it fails, and what the risks are.

And yes, that probably includes employees using their personal ChatGPT account to write a report or analyse a document. The tool is personal. The obligation is not.

The regulator can ask for documentation of who was trained, on what, and when. If that documentation does not exist, your organization is already non-compliant.

Later in this piece, I describe what your board and people actually need to learn.

2. Your vendor contract doesn't cover you

OpenAI, Microsoft, Google, and the AI feature quietly built into your CRM, your HR platform, your marketing software. They all have their own legal obligations as the organizations that build these tools. You have yours as the organization that uses them. Those are not the same. One does not cover the other.

→ When something goes wrong, the regulator comes to you. Not to your vendor.

There is a second trap most boards do not see. The moment your IT team adapts a system, trains it on your data, or uses it outside its original purpose, you are no longer just a user. You become legally the organization that built it. With all the obligations that come with that.

Your vendor signed a contract. You signed up for the liability.

3. Your HR tools are probably high-risk

The recruitment software that screens applications before your HR manager sees them. The system that supports performance reviews. The tool that tracks productivity or predicts absence. The EU AI Act classifies all of these as high-risk by default.

→ High-risk does not mean illegal. It means you have strict obligations: human oversight, logging, transparency, and a formal assessment of the impact on people's rights, before you use it.

Some tools cross a different line entirely. Lie detection in job interviews. Emotion recognition software on the work floor. Those are not high-risk. They are forbidden. Before you roll out any AI system that touches your people, you are required to involve them. Employees have the right to know. You do not get to decide that on their behalf.

4. If you use AI, you have to say so

Your customers have the right to know when they are talking to a machine. The EU AI Act makes it your obligation to tell them.

Any customer-facing chatbot must identify itself as AI. Deepfakes must be visibly marked. Fully AI-generated content must be labeled. AI-assisted content is a grey area. When in doubt, disclose.

→ These obligations apply from August 2026. For some, they apply already.

This is not a legal footnote. It hits brand trust, customer relationships, and liability at the same time. And when your organization gets it wrong, you do not get to manage that story. The regulator tells it.

5. What your AI writes, anyone can copy

Pure AI output has no copyright protection. That proposal. That report. That campaign. If a human did not meaningfully shape it, it is not yours. Anyone can take it, use it, publish it. You have no legal claim.

There is a second risk most boards do not see coming. If your AI tool trained on someone else's copyrighted work and your output looks too similar, you can be sued for infringement. Even though you did not write a word of it.

→ Most organizations are producing work they think they own but legally cannot protect.

For extensive reports, make sure a human shaped the final output, save the chats, and name that person as the responsible author.

A note on this point: copyright sits outside the EU AI Act. It is governed by separate legislation. It belongs in this piece because it is a direct consequence of how most organizations use AI today.

The cost of getting this wrong

The fines are bigger than GDPR. Up to € 35 million or 7% of global annual turnover, whichever is higher. They add to any fines for your GDPR exposure. One incident, two regulators, two bills.

The full enforcement machinery is still being built. National authorities are being set up and harmonized standards are not yet final. But the fines regime has been active since August 2025. The law is not waiting for governments to catch up.

Roll out AI without proper process and your own people can stop you. Employees have the right to formally object to AI systems that affect their work. One complaint to the regulator is enough to trigger an investigation. If your company has more than 50 employees, your Works Council has the legal right to block the deployment entirely, after you have paid for it and announced it.

When something goes wrong, your customers and employees will not hear it from you first. Transparency obligations mean the regulator tells the story. You do not get to manage that narrative.

Where to start: being compliant

Awareness is not compliance. Knowing the risks is not the same as managing them.

Start here. Make a list of every AI tool your organization uses. Not what IT approved. What people actually use. ChatGPT on personal accounts. The AI feature inside your CRM. The recruitment software your HR team bought last year. Every tool.
For each one, ask three questions. Does it make decisions about people? Does it process personal or confidential data? Was it ever adapted or fine-tuned for your specific needs? The answers tell you where your risk sits.
Then go to your legal team, not with "are we compliant?" but with "here are our tools, here is what they do, what do we need to put in place?" That is a conversation legal can actually work with.

That is step zero. Most boards have not taken it yet.

Where to start: the training question

The legal obligation to train your people is covered in point one. Three things your board and people need to be trained on.

Learn to talk to machines
This is not about writing a better prompt. It is about understanding how to give AI clear, structured instructions.

And how to break your own work processes into steps that AI can actually execute. Once you can do that, agents and automation follow naturally. Not as a technology project. As a logical next step.
Bias and ethics, the lines you cannot see
Bias is not hypothetical. It’s happening in tools organizations are already using. Every AI system learned from human data. Which means every AI system carries human bias. You will not see it. Your employees will not flag it.

But when your hiring tool quietly filters out women, or your customer model disadvantages certain postcodes, you are responsible.

Ethics sits right next to it. Digital manipulation. Exclusion by algorithm. Personalization that exploits rather than serves.
Data safety: know what goes where
There is a fundamental difference between using Copilot inside your Microsoft environment and using ChatGPT, Claude, or Gemini. Internal tools keep your data inside your walls. External tools may use what you give them. Customer data. Financial projections. Legal documents.

Most employees do not know the difference. Most boards have not set a policy.

This is trainable. Not in a one-day workshop. In a structured program that builds understanding for those who works with AI every day.

→ If you want to know what both starting points look like for your organization, get in touch.

Sources and notes

This piece draws on two legal frameworks: the EU AI Act and copyright legislation. For other regions, different rules may apply.

What I do is translate the legal parts that matter to the board. I am not a lawyer. For anything specific to your organization, talk to your legal department.

One more thing. The law is already in effect, parts of it since February 2025. And it keeps moving. The Digital Omnibus agreement of May 2026 is the most recent example: a significant shift in deadlines that happened with little public notice.

By the time most organizations hear about a change, it has already taken effect. A yearly legal update is not enough. This needs to be on your agenda throughout the year.

Join 2,750+ professionals

Most content advice tells you what to do. This tells you how to think. For marketers and communicators who want the difference.

Free. Unsubscribe anytime.

→ Subscribe