The EU AI Act is remarkably precise about transparency. Article 50 tells us when people must be informed that they are interacting with AI, when synthetic content must be machine-readable and detectable, and when AI-generated or manipulated content intended to inform the public must be disclosed. It explains who is responsible, when the rules apply, and what organizations must do to reduce the risk of deception. So, companies understandably focus on a central question: Are we compliant? 

But what if the answer is Yes; but the company still publishes AI slop? 

Consider a director preparing a short article on an important public issue. They remember that an internal subject-matter expert recently gave an excellent presentation on the same topic, and two slides contain exactly what they need. The slides look completely ordinary. They carry no visible AI label because no such disclosure was required for the internal use case for which they were created. The director knows the employee, trusts their expertise, and has no reason to question the provenance of the material. 

What they do not know is that generative AI played a meaningful role in producing those slides. Perhaps the AI provider complied with Article 50(2) and embedded the required machine-readable indication that the content was artificially generated or manipulated. But machine-readable does not mean human-visible. So, nothing visible alerts the director, so they incorporate the material into their article, review it carefully, take editorial responsibility, and publish it. 

Then the LinkedIn comments begin: the statistic is wrong, the source is unclear, this inference has already been debunked. Eventually, someone calls the piece “AI slop.”  

So who failed? 

Perhaps no one did, at least not in the narrow regulatory sense. The provider may have complied with its transparency obligations. The employee may have used AI while creating an internal presentation. The director encountered no visible AI label and did not knowingly conceal AI-generated material. Article 50(4), moreover, recognizes human review and editorial responsibility in its treatment of AI-generated or manipulated text published on matters of public interest. 

The process may have been compliant while the information itself was still wrong. 

That is the problem: Everyone fulfilled their compliance obligations, yet no one ensured the information was true. 

Join us for a webinar on November 17 about the EU act and transparency and accountability beyond compliance. Register here.

A high-quality regulatory framework does not necessarily produce high-quality output. Regulation can define responsibilities, require transparency, establish safeguards, and reduce the risk of deception, but it cannot guarantee that a claim is true. AI-generated text can be entirely accurate, just as human-written text can be nonsense. And a human can carefully review an AI-assisted document without verifying a single underlying fact. 

This is where phrases such as human review can create false reassurance. The relevant question is not simply whether a human was involved, but what that human actually did. Editing, approving, fact-checking, and source verification are not interchangeable. A director may review tone, logic, and wording, but if they assume that a statistic taken from an internal expert’s presentation has already been validated, they are not verifying the statistic. They are inheriting trust. 

Inside organizations, that trust can compound. AI generates a claim, an employee places it into a slide, the slide becomes part of a trusted presentation, and months later someone else reuses it publicly. At every stage, the information appears to gain authority while its evidentiary foundation remains unchanged. By the time someone asks where the claim came from, the answer may be difficult to reconstruct. 

We might call this provenance decay. 

Technical standards such as C2PA’s Content Credentials help preserve the origin and editing history of digital content. But knowing where information came from is not necessarily the same as knowing whether it is true. 

The EU AI Act establishes legal obligations, while governance frameworks such as NIST AI RMF and ISO 42001 support oversight and risk management. Yet neither compliance nor governance guarantees complete information integrity.  

Accountability and transparency need to begin with the individual. 

Anyone passing along AI-generated content should be transparent about its origin, particularly when it has not been independently verified. This allows the next person in the information chain to understand what they are looking at; a principle aligned with the EU AI Act’s transparency objectives.

Ultimately, organizations must preserve not only the origins of AI-derived information, but also evidence of its accuracy as it is copied, reused, and repurposed. 

Because once that origin disappears, the question is no longer merely whether AI was used. It is whether anyone still knows why the information should be believed. 

Want to learn more? Join us for a webinar on November 17. Register here.