Why the AI Act, accessibility and copyright are turning content compliance into a company-wide responsibility
Content is created faster, in more variations and for more channels than ever before. Generative AI is accelerating this trend even further. At the same time, organisations face growing demands: they must not only know which content they publish, but also how it was created, who reviewed it, which rights apply, and whether it is accessible to everyone.
In 2026, three developments converge to make content compliance a management responsibility once and for all: the EU AI Act, digital accessibility and copyright law.
Or, to put it a little more dramatically: the three horsemen of content management have arrived.
At first glance, these may appear to be separate legal domains. In practice, however, they all lead to the same fundamental question: Can an organisation document the entire lifecycle of its content in a transparent and traceable way, from creation and review to approval, publication and ongoing use?
Table of Contents
The first horseman: The EU AI Act and the €15 million question
Since 2 August 2026, the transparency obligations set out in Article 50 of the EU AI Act have been in force. The regulation distinguishes between the obligations of AI providers and those of organisations deploying AI systems.
Providers of generative AI systems must ensure that artificially generated or manipulated content is marked in a machine-readable format and can be recognised as such.
Organisations using these systems must, among other things, clearly disclose deepfakes. Transparency requirements also apply to AI-generated or manipulated text that is published to inform the public about matters of public interest. Such disclosures may not be required if the content has been substantially reviewed by a human, produced under editorial supervision and an individual or organisation assumes editorial responsibility.
In cases of direct interaction with an AI system, such as a chatbot, individuals must also be informed that they are communicating with AI unless this is already obvious.
At the same time, this means that not every piece of AI-assisted marketing content must automatically carry a visible AI label. Organisations must be able to determine which obligation applies to which type of content.
To do that, they need to know:
- Whether and how AI was involved in content creation
- Which AI system was used
- What type of content was created
- Whether human review took place
- Who approved the content and assumed responsibility
Violations of transparency obligations may result in fines of up to €15 million or, for businesses, up to 3% of global annual turnover from the previous financial year.
Source: Regulation (EU) 2024/1689 and WKO
What appears to be a labelling question therefore becomes a governance challenge. Michael J. Kräftner, CEO of CELUM, puts it this way:
According to Kräftner, the critical issue is not whether a finished image, text or video visibly reveals AI involvement.
Organisations therefore need an AI Content System of Record: a central and reliable source of information where the creation, editing, review and approval of content are documented and tracked.
The second horseman: Accessibility starts long before content reaches the website
The European Accessibility Act – the European directive on accessibility requirements for products and services – has been transposed into national law across EU member states.
In Austria, the Barrierefreiheitsgesetz (Accessibility Act) has applied since 28 June 2025. In Germany, the Barrierefreiheitsstärkungsgesetz (Accessibility Strengthening Act) and its accompanying regulations have come into force.
The legislation covers specific products and services, including:
- E-commerce services
- E-books
- Banking services
- Electronic communications services
- Certain transport-related websites and applications
- Certain audiovisual media services
The requirements therefore do not automatically apply to every company website, but rather to the categories of products and services defined by law.
Quelle: European Accessibility Act, Austrian Accessibility Act (BaFG), German Accessibility Strengthening Act (BFSG) und BFSG Regulation (BFSGV)
For content teams, one fact is crucial: Many accessibility barriers are created long before technical implementation begins.
An image without meaningful alternative text cannot be fully understood by people using screen readers. A video without captions excludes part of the audience. Unclear headings, information conveyed only visually and poorly structured documents make navigation and use significantly more difficult.
The W3C Web Content Accessibility Guidelines identify, among other things, text alternatives for non-text content, captions for recorded media and clear headings and labels as key accessibility requirements.
Source: W3C Web Content Accessibility Guidelines (WCAG) 2.2
Accessibility is therefore not solely the responsibility of web development or UX teams. It begins during content creation and must be considered throughout the entire content lifecycle.
Alternative text, captions, language declarations and other accessibility-related information should be attached directly to each asset. Mandatory metadata fields can help ensure that critical information is not forgotten. Approval workflows can ensure content is reviewed before publication. Version control prevents corrected content from being accidentally replaced by older, non-accessible versions.
A content management platform cannot automatically guarantee full accessibility compliance. However, it can provide the organisational foundation required to make accessible content a repeatable process rather than a recurring manual effort.
The third horseman: Copyright between existing obligations and new AI risks
Copyright is about far more than simply determining whether an image can be used.
Organisations must also be able to track:
- Who created a work
- What rights were granted
- How and to what extend the content is being used
Article 19 of the EU Copyright Directive in the digital single market requires authors and performers to receive regular, current and relevant information regarding the exploitation of their works or performances, the revenues generated and the compensation to which they are entitled. In principle, this information must be provided at least once per year.
Source: Directive (EU) 2019/790, Article 19
This requirement has been transposed into national law.
In Austria, Section 37d of the Copyright Act governs the right to information regarding exploitation, revenues and outstanding claims.
In Germany, Section 32d of the Copyright Act requires contracting parties in relevant cases to provide annual information on the extent of usage and the revenues and benefits derived from the work.
Both regulations contain conditions and exceptions that must be assessed individually.
Source: Austria Copyright Act, Section 37d und Germany Copyright Act, Section 32d
For organisations, this raises highly practical questions:
- Who owns the rights?
- What contact information is available?
- Which countries, channels and periods are covered by the licence?
- Is the asset still actively used?
- Does it appear on a website, in an online shop, on social media or within a running campaign?
When this information is scattered across emails, spreadsheets, agency systems and local folders, even a simple request can become a time-consuming investigation.
Generative AI further complicates the situation. Questions regarding the origin of AI training data, the originality of AI-generate works or similarities to existing protected content remain unresolved in many areas.
According to Michael J. Kräftner, more specific rules governing AI and copyright will eventually be required because existing legislation and case law do not fully address all emerging grey areas.
The issue extends beyond images that may resemble copyrighted works. AI can also generate texts containing inaccurate product information, unsupported marketing claims or other problematic statements.
For this reason, origin, review and approval processes must remain traceable for textual content as well.
Three horsemen, one common answer
The AI Act, accessibility requirements and copyright law impose different obligations. However, organisations do not need three separate compliance silos.
The common foundation is a structured content supply chain that connects every asset with the information and process steps required to govern it:
- Creation: Where did the content originate, and which systems were involved?
- Rights: Who owns it, and under which conditions may it be used?
- Quality and accessibility: Are all required formats and information available?
- Review and approval: Who reviewed and approved the content from an editorial, legal or subject-matter perspective?
- Usage: In which systems, campaigns and channels is the content published?
This also changes the role of Digital Asset Management (DAM). It is no longer sufficient merely to store files centrally and make them searchable. Organisations need a system that connects content, metadata, responsibilities, versions, approvals and usage information.
CELUM helps organisations centrally manage content, enrich assets with structured metadata, guide them through defined review and approval workflows and make usage more transparent and traceable.
Information about rights holders, licences, AI involvement or accessibility can be documented directly within the asset record itself.
The result is a reliable foundation for marketing, communications, product management and legal teams, without requiring every department to maintain its own spreadsheets and parallel processes.
Conclusion: Governance instead of panic
The three horsemen ultimately reveal one thing: Content compliance is not an isolated responsibility of the legal department. It affects every team that creates, edits, approves, publishes or reuses content.
Blanket AI bans, additional Excel spreadsheets or after-the-fact labels do not solve the problem.
Organisations need:
- traceable processes
- consistent metadata
- clear accountability
- a central System of Record
Because in the event of an audit, dispute or regulatory inquiry, what matters is not only what was published. It is equally important to demonstrate:
- How the content was created
- Which reviews were conducted
- On what basis it was approved and used
The content apocalypse can therefore be prevented. But not without content governance.
Disclaimer: This article does not constitute legal advice. The applicability of legal requirements depends on the specific content, use case, market and relevant national legislation.
