Labelling AI Content in Drupal Under the EU AI Act's Article 50

Since 2 August 2026, Article 50 of the EU AI Act has required people and organisations using AI systems professionally to disclose deepfakes and certain AI-generated text, according to the European Commission. For a Drupal site, that raises two questions: which published content needs a label, and how should that label appear?

A contributed module called AI Disclosure addresses both. It records how AI was involved in producing content and whether an editor's assessment calls for a visible label. It can show readers the European Union's AI labelling icons and add machine-readable information to the page. Its second beta, 1.0.0-beta2, was released on 28 October 2026, two weeks after the first beta extended the module's disclosure features from pages to image, video and audio files.

On sites using Drupal Canvas content templates, displaying the label may require an additional configuration step. A local test by The DropTimes found that placing the module's compact label allowed the disclosure to remain visible when the template omitted the standard disclosure field.

The module's Drupal.org project page lists the European Commission and European Union Institutions, Agencies and Bodies under supporting organisations. That listing does not, by itself, establish official approval or endorsement of the module. Its documentation also states that the software does not provide legal advice or certify compliance. This article examines the legislation, European Commission guidance, module documentation and local test results.

Which Content Needs a Label Under Article 50

The obligation most directly relevant to publishers appears in Article 50(4). It applies to deployers, the Act's term for people, organisations and public bodies using AI systems professionally under their authority. The provision covers deepfake images, audio and video, as well as certain AI-generated or manipulated text.

Under the Act, a deepfake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic or truthful. Not every AI-generated image, video or audio recording automatically qualifies as a deepfake.

According to the Commission, enforcement falls mainly to national market surveillance authorities. Under Article 99, breaches of Article 50 can attract administrative fines of up to €15 million or, for undertakings, 3% of worldwide annual turnover, whichever is higher. The Act sets different ceilings for small and medium-sized enterprises and requires consideration of the circumstances of each infringement.

The table sets out the main publishing cases, the answers an editor records in AI Disclosure and the label decision the module produces. It follows the Act's text and the module's Article 50 documentation. It does not cover every obligation or exemption under the AI Act.

The Commission's questions and answers on Article 50 explain the terms on which the text provisions depend:

• Human review: a deliberate examination of the substance of content by people with relevant knowledge and professional judgement.
• Editorial control: authority to approve, alter or reject the substance of published text, including fact-checking and assessment of sources. Spell-checking and grammar corrections alone do not qualify.
• Editorial responsibility: ultimate legal responsibility for publication, including the review or editorial control.
• Matters of public interest: subjects including politics, democratic processes, public administration, justice, law enforcement, fundamental rights, public security, public health, environmental protection and economic, scientific or cultural developments relevant to public debate.

A separate obligation, in Article 50(2), falls on providers of generative AI systems. These are organisations or individuals that develop an AI system, or have one developed, and place it on the market or put it into service under their own name or trademark. Such providers must ensure that AI-generated or manipulated outputs carry machine-readable markings and can be detected as artificially generated or manipulated, subject to the provision's technical qualifications and exceptions.

This obligation is distinct from a publisher's duty to disclose relevant content to readers. Whether a publisher also qualifies as a provider depends on its activities and the applicable legal definitions.

Article 50 Already Applies, and a Provider Grace Period Ends on 2 December

According to the European Commission, Article 50 has applied since 2 August 2026. The rules do not require retroactive labelling of content generated before that date, although the Commission encourages such labelling where practicable.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, allows providers of generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2)'s machine-readable marking and detection requirements. The extension concerns qualifying pre-existing systems and does not postpone the separate disclosure obligations of publishers under Article 50(4).

The Commission published guidelines on Article 50 and a voluntary Code of Practice on Transparency of AI-generated Content, published on 10 June 2026. Approximately 190 organisations had signed the code by late July 2026. The Commission and the AI Board have assessed the code as adequate for helping signatories demonstrate compliance with the relevant marking and labelling obligations.

The Commission's optional EU icons for labelling AI-generated content appear in AI Disclosure's reader-facing labels. Their use does not establish legal compliance by itself. The Commission's guidance on displaying the icons includes keeping them visible when content is downloaded or reshared, while detailed placement specifications form part of the voluntary code's commitments for signatories.

Since 30 September 2026, two signatory task forces have been working on implementation of the code. The Commission's task-force information describes work on an interactive second layer linked to the EU icon, signals for AI-generated audio and sector-specific practices for labelling deepfakes and public-interest text.

The Module Separates How AI Was Used from Whether a Label Is Required

Grades describe involvement. The module's default configuration installs nine grades, ranging from "Human only" through "AI translated", "AI summarized" and "AI assisted (human led)" to "Autonomously AI generated" and "AI deep fake (media)". These classifications describe how AI contributed to content creation.

Each grade has an associated disclosure sentence, such as "This content was produced by AI and edited by a person." It also specifies the EU icon and a digital source type from the International Press Telecommunications Council (IPTC) vocabulary, allowing software that reads the metadata to identify how the content was produced.

Scope answers determine the recorded legal assessment. Editors answer four questions covering the content category, whether deepfake media form part of an evidently artistic or fictional work, whether text is published to inform the public and whether it concerns matters of public interest. Each answer can be yes, no or not assessed. The module does not infer these answers automatically from the Drupal content type or the assigned grade.

During a local test on 5 November 2026 using AI Disclosure 1.0.0-beta2, The DropTimes created a fictional page about a council vote on harbour parking charges. The text was generated by AI and had not undergone human review. The editor recorded it as material intended to inform the public about a matter of public interest. The module returned a decision that a label was required.

A second fictional page covering festival shuttle times used a disclosure profile for AI-assisted text reviewed by a person. With editorial responsibility recorded, the module returned a decision that a label was not required.

The verdict has three values. Based on the grade and the recorded answers, the module reports that a label is required, not required or not assessed. The last value means that an unanswered question could still affect the outcome. As the maintainers explain in the Article 50 documentation, the module records and displays the site's decision but does not independently establish its legal correctness.

Profiles and site policy. A profile groups a disclosure grade, the human-review answer, a responsible person or team, scope answers and a description of how AI was used. Editors can apply that profile instead of entering the same information repeatedly. A site-wide policy determines whether disclosure labels appear only where the recorded assessment requires them or on every page with a disclosed level of AI involvement.

Who builds it. AI Disclosure was created by Giorgio Alfredo Pagano (sjpagan), a Drupal developer formerly associated with SparkFabrik. Its co-maintainers include Marcus Johansson (marcus_johansson) and joevagyok.

The Drupal.org project page traces the module to an earlier proposal by Marcus within the Drupal AI Initiative. On 3 August 2026, he opened a meta issue proposing a standalone module to support Article 50 disclosure in Drupal. Alpha releases followed in September and October, with The DropTimes reporting the second alpha on 16 September 2026.

Readers See a Card, and Machines Read Tags in the Page Head

For readers, AI Disclosure can render a card containing the EU icon, the grade's disclosure sentence, the site's own notice where a label is required and an expandable section describing how AI was used. The card can also identify who holds editorial responsibility and link to the site's published statement on AI use.

For software, the module adds machine-readable information to the canonical page. A meta tag records disclosure details, including the grade and label requirement, while schema.org structured data in JSON-LD format carries the IPTC digital source type. The meta tag records the legal assessment as required, not required or undetermined. These markings describe the site's recorded disclosure; they are not cryptographic proof of content origin.

Disclosures are stored separately for each language version of a content item. A machine-translated page can therefore carry a different grade from the original language version.

The module also provides an administrative report listing each page's disclosure grade, the source of the grade, whether a label is required and whether human review was recorded. Editors and compliance teams can filter the information and, with the optional CSV export submodule, export it for review.

Sites Using Canvas Templates Should Place the Compact Label

Local testing by The DropTimes examined AI Disclosure with Drupal CMS and Drupal Canvas. Tests conducted on 14 and 25 October 2026 used AI Disclosure 1.0.0-beta1 with Drupal CMS 2.2.3. A further test on 5 November 2026 used 1.0.0-beta2 on a fresh Drupal CMS 2.2.8 site. Both test environments used Drupal Canvas 1.12.0.

The disclosure field was added to the basic page content type, and the site policy was configured to display disclosures on every page. Two fictional pages were published: reviewed, AI-assisted text that did not require a label under the recorded assessment, and unreviewed AI-generated public-interest text that did.

On the standard page display, both pages showed the disclosure card beneath the body. The AI-generated public-interest page also displayed the site's notice, "Labelled per this site's AI disclosure policy."

The result changed when the Drupal CMS content template for full-page views, implemented through Drupal Canvas, was enabled. Neither page displayed the standard disclosure card, and no alternative visible label appeared automatically. In the tested Drupal CMS 2.2.8 installation, the content template was disabled by default, so the standard display continued showing the card until the template was activated.

The machine-readable meta tag and structured data remained in the page head. The meta tag continued to record that the unreviewed public-interest page required a label. The disclosure had therefore not been lost from the page metadata, but readers could not see it in the template's rendered content.

The module's compact label provided a workaround in the tested configuration. The "AI disclosure label" component was available in the page type's Manage display settings but hidden by default. Once enabled and positioned there, the required disclosure appeared at the top of the Canvas-rendered page. It showed the EU icon and the sentence "This content was produced by AI." The fuller card and the site's additional notice did not appear.

The reviewed page, whose recorded assessment did not require a label, displayed no compact label. The result demonstrates the distinction between recording a disclosure and ensuring that a particular page template renders it visibly.

The standard card depends on the disclosure field being rendered. A template that omits the field cannot display that card, even though the page-level metadata remains available. The developer observations below describe a separate limitation encountered when attempting to place the module's own Canvas component.

The Beta Carries Labels into Image, Video and Audio Files

Metadata attached to a Drupal page does not automatically accompany a media file downloaded separately from that page. The AI Disclosure documentation identifies this limitation as one reason to support labelling within media files and their publicly served versions.

According to the module documentation and beta release history, AI Disclosure handles media disclosure in two ways. On the page, it can display the EU icon over AI images, add labels to video and audio players, and identify AI files in download links. Its status reporting can also identify media for which a required visible label is missing.

Within files, the optional ai_disclosure_image submodule can write the IPTC digital source type into image-style derivatives, the resized or otherwise processed copies served by Drupal. For deepfake images that require disclosure, it can also embed the EU icon into selected image derivatives through the configured image-style effect. The original uploaded image remains unchanged.

The ai_disclosure_av submodule uses FFmpeg to produce labelled copies of video and audio files. Deepfake videos can carry the icon, while deepfake audio can receive a spoken disclaimer at the beginning. The documentation also describes an optional audio watermark.

Embedded IPTC information is stored as metadata, including XMP, and can be removed from a file. Without cryptographic signing, it does not prove how the file originated. When used alongside the separate C2PA Sign module, AI Disclosure can provide the digitalSourceType recorded in the disclosure for inclusion in a signed C2PA Content Credentials manifest.

Another contributed module, Content Credentials, provides the complementary process of reading credentials from uploaded files. When a credential is signed by a certificate trusted by the site and indicates AI generation, the module can create a pending suggestion in AI Disclosure. An editor must then accept or dismiss it. The project remains in alpha, and its documentation does not recommend treating the feature as an automatic determination of AI origin.

For new AI Disclosure installations, the deepfake icon overlay and download-link labels are enabled by default. Sites upgrading from earlier alpha releases retain their previous display behaviour until administrators enable those settings. The upgrade instructions require drush updb and a full cache rebuild.

The second beta also introduces the ability for other modules to suggest complete disclosure profiles rather than individual grades. It adds export, removal and restoration of stored disclosure information to support uninstalling and reinstalling the module without reducing an existing recorded disclosure. Its release notes also describe controls for video icon sizing and accessibility improvements. Administrators upgrading from the first beta must run the database updates and rebuild caches.

Security Advisory Coverage Begins with a Stable Release

AI Disclosure 1.0.0-beta2 supports Drupal 10.4 and Drupal 11. In the week of 1 November 2026, Drupal.org reported 70 sites using the module. The figure reflects reported installations, not a verified count of production deployments.

The project has opted into Drupal's security advisory coverage, but no supported stable release is available. Under the Drupal Security Team's security advisory policy, development releases, alpha versions, betas and release candidates do not receive security advisories. The project's security advisory eligibility therefore does not extend coverage to the current beta.

A Smaller Project Also Labels Images

A separate contributed project, AI Content Disclosure, appeared on Drupal.org in September 2026. Its project page describes a simpler approach to recording AI involvement, with three classification states and configurable visible labels. It can embed labels in selected public image derivatives while leaving the original files unchanged.

As of 10 November 2026, AI Content Disclosure has not published a release on Drupal.org. Its documented features therefore describe the project rather than an available tagged release that site owners can install through the usual release workflow.

The overlap was discussed in issue #3621703, opened by Giorgio on 8 September 2026. He suggested combining the development work and offered a maintainer role on AI Disclosure to the other project's developer.

Andreas Votteler (zcht), founder of trendkraft, responded that his team's module had originally been developed for its own requirements. He explained that its simpler implementation was better suited to their editorial processes and image-derivative labelling needs at that stage.

Giorgio subsequently linked to the other project from the AI Disclosure project page, and the overlap issue was marked fixed on 9 September 2026. The two projects remain separate, with AI Disclosure offering broader disclosure profiles, reporting and media integrations, while AI Content Disclosure describes a smaller classification and image-labelling workflow.

For Developers

Other AI modules can integrate with AI Disclosure through its recorder service. A calling module can suggest a grade or, since the second beta, an entire profile for an editor to accept or dismiss. It can also apply a disclosure directly during an automated workflow. The recorder is designed not to replace an existing disclosure with a lower level of recorded AI involvement.

The beta provides six optional submodules. In addition to its image and audio-video integrations, these include an append-only audit trail (ai_disclosure_audit), CSV reporting export (ai_disclosure_csv_export), integration with Tool API for recording disclosures from AI agents (ai_disclosure_tool) and Content Moderation support (ai_disclosure_workflow).

The principal module declares Drupal core's Field module as its Drupal module dependency. Its Composer package requires league/commonmark for rendering disclosure descriptions. The image submodule requires Image Effects, while the audio-video integration depends on FFmpeg and its associated tooling. Other optional integrations have their own requirements.

AI Disclosure adds its machine-readable marking through page-level output, while the reader-facing card is rendered by the disclosure field's formatter. According to the documentation, a legally required label or an unassessed disclosure card is shown when the field is rendered. However, a page template that does not include the disclosure field prevents its formatter from appearing.

During the local tests, Drupal Canvas did not offer the disclosure field as a component within the tested content template. The module also supplied an "AI disclosure" single-directory component, added following a request from Marcus in September, but Canvas 1.12.0 did not list it among usable components in the tested installations.

The Canvas component audit identified a required sentence input without an example value and object-type inputs named group and icon for which Canvas did not provide suitable form controls. These observations apply to the tested versions and configurations. They document the specific component integration behaviour encountered during the tests.

Before Relying on the Module

• Record the scope answers in disclosure profiles. Editors should establish which kinds of published content their profiles cover. The module does not infer the answers.
• Identify who holds editorial responsibility. The exemption for reviewed public-interest text requires substantive human review or editorial control together with editorial responsibility. The module records the supplied information but cannot verify the legal status of that responsibility.
• Choose the site-wide disclosure policy. Administrators can configure whether labels appear only when required by the recorded assessment or on every disclosed page.
• Check Canvas content templates. Where the standard disclosure field is omitted, administrators should verify that the compact label is enabled and appears on relevant pages.
• Review settings after an alpha upgrade. The deepfake overlay and download-link labels may remain disabled until explicitly enabled.
• Account for beta status. Drupal Security Team advisories do not cover development releases, including the current beta.

AI Disclosure's project page provides the module, installation requirements, release notes and documentation, including its explanation of Article 50. The module offers a way to document editorial assessments and present disclosures, but the accuracy of those assessments and the site's compliance obligations remain the publisher's responsibility.