TL;DR

The European Commission has published a voluntary Code of Practice on AI-generated content, guiding providers and deployers on meeting the EU AI Act’s transparency obligations before they apply from 2 August. It recommends identifying and disclosing AI-generated or AI-manipulated content through machine-readable metadata, provenance information and watermarking. Early attention has focused on deepfakes and disclosure labels — but for banks, the consequence is a new class of things that have to be tested continuously.

The reason is that a label is only a control if it survives the journey. QA Financial’s Michiel Willems traces a plausible path: a customer letter drafted with a generative AI assistant, edited by several people, converted to PDF, loaded into a content management platform, emailed, archived for regulatory purposes and finally viewed in a customer portal. Metadata gets stripped during conversion. APIs fail to pass provenance between systems. A third-party update quietly overwrites a working control.

Each of those becomes a test case. Does every AI-generated output carry the right disclosure? Does provenance survive file conversion, compression and copy-paste? Can labels be removed deliberately? Detection tooling gets pulled in too, with false positives and negatives becoming measurable quality characteristics — and for a bank, wrongly flagging a genuine customer communication as synthetic is its own compliance problem.

This is consistent with the direction European supervisors have already taken. BaFin placed generative AI inside the same ICT risk management framework as any other critical technology asset under DORA, and the Commission’s high-risk AI guidance pointed at lifecycle validation rather than one-off approval.

Looking Forward

The through-line is a shift in what counts as evidence: regulators are moving from asking whether controls exist to asking firms to demonstrate they still work as systems change. That means transparency checks migrating into CI/CD pipelines alongside security and accessibility gates, regression suites verifying provenance survives each release, and audit logs showing when AI content was created and modified. UK financial firms serving EU customers inherit this regardless of domestic policy, and the pattern will be familiar — accessibility and then cyber resilience under DORA both travelled the same road from specialist exercise to continuous engineering discipline. The date to note is 2 August. The Code itself is voluntary; the obligations it interprets are not, and the Bank of England has separately told firms that AI will require faster software testing.