Cursory approval is not review

Article 50(4) of the EU AI Act does not ask a publisher to prove it avoided AI. It sets a disclosure duty for one kind of text and then opens a door out of it. The duty: "Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated." The door: that obligation does not apply "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content."

Article 50 applies from 2 August 2026. On 20 July 2026 the Commission approved the content of guidelines on Article 50 and published them, and they say what cannot count as human review. That second document is where this essay lives. We have written here before about what a score can and cannot establish; this is a question about a different kind of evidence entirely.

One thing to fix first. The guidelines say of themselves that "These Guidelines are non-binding. Any authoritative interpretation of the AI Act may ultimately only be given by the Court of Justice of the European Union". So everything below attributed to the Commission is the Commission's reading, not the Article's text. Nothing here is legal advice.

Two conditions, and what the Commission says they mean

On the Commission's account the exception applies "where two cumulative conditions are met: (i) the AI generated or manipulated text must have undergone human review or editorial control and (ii) a legal or natural person must hold editorial responsibility for the publication." The same paragraph goes on: "Where relevant, deployers may rely on relevant applicable professional or deontological standards to demonstrate compliance with those requirements as outlined below."

Note the verb. Deployers may rely on standards to demonstrate compliance. That is a means offered, not a duty imposed, and the distinction holds for the rest of this piece.

The first condition gets a definition, in paragraph 134. Human review is "the deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge and professional judgement pertaining to the subject matter under scrutiny". The paragraph adds: "Fact-checking the accuracy of the content is a minimum requirement that should be part of that review." Editorial control is "the control exercised in practice by a responsible editorial entity (e.g. an editor-in-chief) over the content having the authority to approve, alter or reject the substance of the text based on substantive grounds (incl. fact-checking of information and ensuring the trustworthiness of sources)." Read that last clause slowly. The authority to approve is part of what the Commission says editorial control is.

The second condition has an outward-facing piece. The guidelines say that "the identity and contact details of the legal person, the natural person or the function with editorial responsibility should be made publicly available on an easily findable location (if not yet otherwise available)." A should rather than a must, and the function will do in place of a name.

One boundary before going on. All of this concerns text published to inform the public on matters of public interest. That scope is narrower than the question of whether a machine wrote it.

The sentence that does the work

Then comes paragraph 135:

"Superficial, solely formal or procedural checks (e.g. spell-checking or grammatical correction), the mere existence of an editorial policy, automated review processes or cursory editorial approval without substantive engagement by the human reviewer or the editorial entity, cannot fulfil the conditions for human review or editorial control for the purposes of this exception."

Four things on that list, and the fourth is the one that bites. Hold it against the definition above. Approval is constitutive of editorial control, on the Commission's own wording. So what this sentence excludes cannot be approval. It is cursory approval without substantive engagement. The line the Commission is drawing runs inside the act of approving, not between approving and something else.

The same shape governs the policy item. What is excluded is "the mere existence of an editorial policy", not an editorial policy. Having one is not the failure. Having one stand in for the review is.

The guidelines give an instance: "AI-generated articles that are reviewed and edited by another AI system and where a human editor performs a mere superficial, grammatical check before publication". The list also names "automated review processes". That is the text, and it is written about processes. The section does not take up whether an agent doing the reviewing would count, and I am not going to extend it there on the Commission's behalf.

The exception does not stay granted

Paragraph 136 adds something easy to miss. Where AI is used "to modify, supplement, or reformulate content following editorial sign-off, the resulting content must be treated as AI-generated or manipulated for the purposes of Article 50(4) AI Act. Any substantive AI intervention occurring after the human review or editorial control process has taken place will therefore cause the exception to become void."

Put that against a publishing pipeline in the abstract. Suppose a line runs: draft, an editor reads it and approves, then a tool trims the piece to a template, writes the summary that goes out by email, and rewrites the headline to fit a card. The editor's read is the review; the last three steps happen after it. Whether any of them is a substantive intervention is a judgement about that pipeline, and the guidelines do not make it for anybody. What the Commission supplies is the ordering rule: the exception attaches to the text as it stood when a person engaged with it, and a substantive change afterwards is a change to text nobody reviewed.

The practical consequence is about where a publisher puts its finish line. A line that places its automated steps after sign-off raises the question on every publication. A line that places them before raises it once, during design.

This essay does not assess Pagecut's own publishing line against the guidelines.

What the Code says, and who it says it to

There is a second document. On Article 50(7), the guidelines say deployers "may adhere to a code of practice, assessed as adequate pursuant to that provision, to demonstrate compliance with the condition of human review or editorial control (especially by deployers that are not media service providers subject to existing editorial professional or deontological standards) laid down in that provision." Again the permissive verbs. May adhere, to demonstrate.

Such a Code was published on 10 June 2026. On 8 July 2026 the Commission's Opinion found that it "adequately covers the obligations provided for in Articles 50(2), (4) and (5)", and the same Opinion states that adherence "does not constitute conclusive evidence of compliance". The AI Board's conclusion, recorded by the Commission as 9 July 2026, is that "the Board considers that Sections 1 and 2 of the Code adequately cover the obligations provided for in Articles 50(2), (4) and (5) of the AI Act". Adequate is not the same word as compliant, and the Opinion is the document that says so.

Inside that Code sits "Commitment 4: Human Review and Editorial Control for Published Text", and it has two parts, divided by who they address. The first is for "Signatories who are media service providers within the meaning of Art. 2(2) of Regulation (EU) 2024/1083 and already subject to editorial standards and to regulatory, co-regulatory, or self-regulatory frameworks". Both conditions, not either one. Who meets them turns on a definition in a different Regulation, which this essay neither opens nor applies to anyone. What matters here is narrower: that first part has no policy elements, no itemised list and no sentence about documentation.

The second part addresses "All other Signatories, including those without such review or editorial procedures". They commit to "establish, adapt, or maintain appropriate policies for human review or editorial control prior to publication and that a natural or legal person holds editorial responsibility for the publication", and those policies "will include at least the following elements: a) The identification of the natural or legal person with editorial responsibility (name, role and contact details); b) An overview of the concrete organisational measures as well as human resources, allocated to ensure adequate human review or editorial control is performed and editorial responsibility is assumed before publication of the published text. This does not entail having to document individual instances of human review or editorial control over individual text publications."

That closing sentence is worth stopping on, and stopping means saying whose sentence it is. It is the last line of item (b), in the part of Commitment 4 addressed to "All other Signatories, including those without such review or editorial procedures". It says what their policy obligation does not entail. It is not addressed to a signatory under the first part, it reaches nobody who has not signed the Code at all, and it is not a statement about what a regulator may ask to see.

I will note one thing and then leave it alone. What that second part requires is a policy and an overview, and paragraph 135 says "the mere existence of an editorial policy" cannot fulfil the conditions for the exception. To me those two sit at an awkward angle. Nothing here turns on resolving it.

Where the record is, and where it is not

So where does the record live? On these documents the answer depends on which of three positions a publisher is standing in.

A signatory under the first part of Commitment 4: the Code imposes no documentation requirement on them. A signatory under the second part: the Code states that per-instance documentation is not entailed by the policy obligation it sets. A publisher that has signed nothing: neither part reaches them, and the question returns to Article 50(4) and to the guidelines' section on this exception, which sets out two conditions and a means of demonstrating them, and nowhere in that section requires a log of individual reviews.

One further paragraph belongs here, or the picture comes out cleaner than it is. Turning to supervision, the Commission addresses deployers that are not signatories to a code assessed as adequate, and says they "are expected to demonstrate how they have complied with their obligations under Article 50(2), (4) and (5) AI Act through other adequate means" and "to explain how the measures they implement ensure compliance". That expectation is written down and I am not going to talk it away. It is also an expectation to demonstrate by means left unspecified: the paragraph names no per-publication record, and the illustration it reaches for is a gap analysis against such a code. The same paragraph says authorities "will likely need more detailed information when monitoring for compliance". Authorities can ask. Being asked is a different thing from a document telling you to keep a record.

Put the three positions together and one practical fact falls out of all of them. A publisher can meet this exception's conditions, in any of those positions, without producing a single thing that shows a reader the review was substantive.

That last step is mine, and I want it marked as mine rather than read off the Commission's page: the invisibility is this essay's conclusion, not the guidelines' requirement and not the Code's.

It needs scoping to be worth anything. I mean invisible to a reader, or to anyone else who has not asked. Authorities can ask, and for some deployers the Commission says they will likely need to ask for more. The claim is about what shows up on the page and around it, which is where a reader stands.

So the two cases end up looking the same. A piece an editor read closely, fact-checked and argued with. A piece an editor clicked through in forty seconds. Both publish, both carry a byline, both can name someone with editorial responsibility. What separates them was an event, and the event happened where a reader cannot look.

What that leaves a publisher

A choice, not a duty. The Commission has said with precision what cannot count as review. It has not, in the section that sets out this exception, said what the counting must leave behind. The Code it assessed as adequate speaks to that in its second part only, and there it says the policy obligation does not entail documenting individual instances.

So a publisher who wants the difference to be visible has to decide to make it visible and build whatever makes it so. That costs more than a policy document and reads less easily than a badge. It is also the only version that survives being examined rather than asserted.

From where a reader sits, a substantive review and a forty-second sign-off arrive looking exactly alike. Only the publisher can change that. Cursory approval is not review, and nothing on the finished page will ever tell you which one you just read.