Generates text with AI, in the European Union

Directive 2009/24/EC, OJ L 111, 5.5.2009, p. 16 · Read the law's page

• This Directive is addressed to the Member States, which implement it in national law, so an app meets these rules through that law (Art. 12).
• Treat a computer program as protected by copyright as a literary work, in the expression of the program in any form but not in the ideas and principles that underlie any element of it, including those that underlie its interfaces (Art. 1(1) and (2)).
• Get the rightholder's authorisation before permanently or temporarily reproducing a computer program, in part or in whole, including where loading, displaying, running, transmission or storage of it necessitates the reproduction (Art. 4(1)(a)).
• Get the rightholder's authorisation before translating, adapting, arranging or otherwise altering a computer program or reproducing the result, or before distributing the program or copies of it to the public, including by rental (Art. 4(1)(b) and (c)).
• After a first sale of a copy in the Community by the rightholder or with his consent, you need no further authorisation to distribute that copy within the Community, except to rent it (Art. 4(2)).
• A lawful acquirer may, in the absence of specific contractual provisions, do the acts in Art. 4(1)(a) and (b) without authorisation where they are necessary to use the program in accordance with its intended purpose, including for error correction (Art. 5(1)).
• A person with a right to use the program may make a back-up copy as far as necessary for that use, and a contract may not prevent it (Art. 5(2)).
• A person with a right to use a copy may observe, study or test the functioning of the program, to determine the ideas and principles underlying any element of it, while performing the acts of loading, displaying, running, transmitting or storing the program that he is entitled to do (Art. 5(3)).
• Decompile only as Art. 6 allows: reproduction of the code and translation of its form need no authorisation only where indispensable to obtain the information necessary for the interoperability of an independently created program, are done by a licensee or another person with a right to use a copy (or on their behalf), the information was not previously readily available to them, and the acts are confined to the parts of the original program necessary for interoperability (Art. 6(1)).
• Do not use information obtained under Art. 6(1) for goals other than the interoperability of the independently created program, give it to others except when necessary for that interoperability, or use it to develop, produce or market a program substantially similar in expression or for any other act that infringes copyright: Art. 6(1) does not permit those uses (Art. 6(2)).
• A contractual term contrary to Art. 6 or to Art. 5(2) or (3) is null and void (Art. 8).

Regulation (EU) 2022/2065, Article 35(1)(k) · Read the law's page

• This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
• Where it applies, ensure generated or manipulated content that would falsely appear authentic is distinguishable by prominent markings when presented on the platform
• Offer an easy-to-use function for flagging that content

Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 · Read the law's page

• If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
• Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
• Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
• Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).
• Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 5 · Read the law's page

• Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
• Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
• Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
• Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
• Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
• Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.when it serves a public body

Regulation (EU) 2024/1689, Article 50 · Read the law's page

• If you are a provider of an AI system intended to interact directly with natural persons, design and develop it so that the people it interacts with are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use (Article 50(1)). This does not apply to an AI system authorized by law to detect, prevent, investigate or prosecute criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties, unless the system is available for the public to report a criminal offense.Makes itprovider
• If you are a provider of an AI system, including a general-purpose AI system, that generates synthetic audio, image, video or text content, ensure that its outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art (Article 50(2)). This marking duty is the provider's; a deployer's disclosure duties are in Article 50(3) and (4). It does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data the deployer provided or its semantics, or where authorized by law to detect, prevent, investigate or prosecute criminal offenses.Makes itprovider
• If you are a provider of an AI system that generates synthetic audio, image, video or text content and was placed on the market before 2 August 2026, take the necessary steps to comply with the Article 50(2) marking duty by 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744).Makes itprovider
• If you are a deployer of an emotion recognition system or a biometric categorisation system, inform the natural persons exposed to it of the operation of the system, and process their personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)). This does not apply to an AI system used for biometric categorisation and emotion recognition that is permitted by law to detect, prevent or investigate criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties and in accordance with Union law.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake, disclose that the content has been artificially generated or manipulated (Article 50(4)). A deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3, point (60)). Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the disclosure is limited to the existence of the generated or manipulated content, in an appropriate manner that does not hamper the display or enjoyment of the work. This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates text that is published with the purpose of informing the public on matters of public interest, disclose that the text has been artificially generated or manipulated (Article 50(4)). This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses, or where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication of the content.Runs itdeployer
• If you owe the information required by Article 50(1) to (4), provide it to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, in a form that conforms to the applicable accessibility requirements (Article 50(5)).Makes itRuns itproviderdeployer

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1689, Article 26(11) · Read the law's page

• If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.Runs itdeployer
• If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.