EU AI Act for websites: what to actually check

The EU AI Act phases in between 2024 and 2027, and most of what you read about it concerns the big model makers. But part of it applies directly to anyone who runs a website and uses those models to generate content — which includes me. So I ran a real audit, not a theoretical one, on my own projects to see what actually applies.

Where the audit starts

On portale3d, AI image generation isn't hypothetical: it's already in production in two places. The 17 comic-style illustrations in the About interview are generated with Cloudflare Workers AI (FLUX-1-schnell model, with a Hugging Face fallback). The cards in the Varco game use the same pipeline: hundreds of fantasy illustrations generated to replace the original, copyrighted Magic cards. Two different cases, the same question: am I meeting the transparency obligations?

The article that matters for a website: 50

The AI Act has dozens of articles, but for anyone publishing AI-generated content the decisive one is Article 50: the transparency obligations. In short, whoever generates or manipulates content — images, audio, video, text — with AI must label it as such, in a way that is «clear and distinguishable». A line buried at the bottom of the page isn't enough if the content could be mistaken for real. There's an exception for works that are «evidently artistic or creative», but it concerns the form of the work, not an exemption from disclosing somewhere accessible that it was AI-generated.

What I found

On the About page there was already a note at the bottom, under «How this page was made», saying the illustrations are «drawn in a 1990s comic style — no fake photograph of a real person». Honest, but incomplete: it declared the style, not the method. Nowhere did it say «AI-generated». It's a subtle difference, but it's exactly what Article 50 is about: it's not enough for content to be recognizably non-photographic, it has to explicitly say it's AI.

The fix

I updated the note, in all three site languages, to explicitly state the illustrations are AI-generated (Cloudflare Workers AI, FLUX model), keeping the part about style that was already accurate. Five minutes of work. When content is already honest about the approach — as it was here — making it explicit costs almost nothing: it's the kind of fix a real audit surfaces and that gets fixed in the same session you find it.

A practical checklist for a site with AI features

• List every place on the site where you generate content with AI: images, text, audio, a chatbot.
• For each one, ask: would a visitor understand, without having to search, that it's AI-generated?
• If not, add a label next to the content itself, not just on a separate legal page nobody reads.
• If you use a chatbot or automated assistant, disclose it explicitly at the start of the interaction — a separate obligation, also under Article 50.
• Keep track of which provider and model you use to generate content: you'll need it if anyone asks about the source.

This kind of check is the same spirit as the step-by-step website audit I wrote starting from Skanno: you don't need to be a lawyer, you need to look at every page with the right question in mind.

What the AI Act isn't

It's not a ban on using AI, and for most small sites it's not a huge bureaucratic burden. If you don't train your own models and don't run «high-risk» AI (hiring, credit scoring, healthcare...), your main obligations are around transparency: saying what's AI, where it counts. It's more a matter of honesty toward your readers than compliance in the strict sense — but it still needs doing, and it's easier than it looks once you tackle it page by page instead of as one big block.