Content Governance Before and After AI: What the EU AI Act Changes

Content governance was invented to solve a scarcity problem. Writing was expensive, so organizations built workflows, approval chains, and editorial calendars to make sure the few things they could produce were correct, on-brand, and legally defensible.

Generative AI removed the scarcity. It did not remove the need for correctness. That single shift explains almost every governance failure teams are hitting right now, and it is the reason the EU AI Act exists in the form it does.

Governance Before AI: Managing a Bottleneck

Pre-2023 content governance was a queue management discipline. The model looked like this:

• Scarce production. A handful of writers, agencies, and subject matter experts produced a finite number of assets per quarter.
• Governance at the gate. Because output was small, a human could review every item. Legal, brand, and accessibility checks all fitted into one approval step.
• Roles and workflow states. Author, reviewer, approver, publisher. Encoded in the CMS as workflow states with permissions attached.
• Taxonomy and single source of truth. Structured content, controlled vocabularies, one canonical asset per concept, reused across channels.
• Audit trail as a byproduct. Version history recorded who wrote and who approved. That was enough, because a human name sat behind every sentence.

The failure modes were slowness, stale content, and inconsistent taxonomy. Nobody worried about whether the text was real, because a person had typed it.

What Generative AI Actually Changed

The naive framing is “AI writes content now.” The governance-relevant framing is sharper: the marginal cost of producing a plausible-looking asset fell to approximately zero, while the cost of verifying one stayed exactly the same.

Every consequence follows from that asymmetry:

The practical result: governance can no longer sit only at the publish gate. If a human reviews everything, AI gives you no throughput gain. If a human reviews nothing, you are publishing unverified claims at scale under your own brand. Governance has to move into the pipeline itself, as metadata, risk tiering, and sampling.

The EU AI Act in the Terms That Matter to a Content Team

Regulation (EU) 2024/1689 entered into force on 1 August 2024. ^[1] It is a product-safety style regulation, not a content law, which is why most content teams misread it. Three things to internalize:

1. It classifies systems by risk, not by technology.

• Unacceptable risk - prohibited outright (social scoring, certain biometric categorization, manipulative techniques).
• High risk - permitted with heavy obligations (conformity assessment, risk management, logging, human oversight). Mostly employment, credit, education, critical infrastructure, and safety components.
• Limited risk / transparency - this is where nearly all marketing and content use lands. Chatbots, synthetic media, AI-generated text.
• Minimal risk - everything else, no specific obligation.

2. Your role determines your obligations. A provider develops or places an AI system on the market under its own name. A deployer uses one under its own authority. If you use a commercial model through an API to draft content, you are almost always a deployer, which is a much lighter set of duties, but not zero.

3. The obligation that will actually touch your CMS is Article 50, transparency. ^[2]

• Systems interacting directly with people must make clear they are AI, unless it is obvious from context. That means your support chatbot needs a disclosure.
• Providers of generative systems must mark synthetic output in a machine-readable format, detectable as artificially generated. This is the provenance and watermarking clause, and it is why C2PA Content Credentials matter. ^[5]
• Deployers who publish AI-generated or AI-manipulated text on matters of public interest must disclose it. The carve-out: no disclosure is required where the content underwent human review and a natural or legal person holds editorial responsibility for its publication.
• Deep fakes must be labelled as artificially generated or manipulated.

That editorial-responsibility carve-out is the single most important sentence in the regulation for a content team. It converts a labelling problem into a governance-evidence problem: you can skip the label precisely when you can show that a human reviewed it and someone owns it. If you cannot show that, you label.

Timeline

Penalties scale with the breach: up to €35M or 7% of worldwide annual turnover for prohibited practices, up to €15M or 3% for most other infringements, and up to €7.5M or 1% for supplying incorrect information to authorities.

Do Not Forget Article 4

AI literacy is already in force. Providers and deployers must take measures to ensure a sufficient level of AI literacy among staff operating AI systems on their behalf. ^[3] There is no certification to buy. What a regulator will look for is evidence: a training record, a documented internal policy, role-appropriate guidance. If your content team uses AI daily and has no written policy, that is the cheapest gap on this page to close.

Translating This Into Your CMS

Governance that lives in a PDF policy is not governance. Here is what it looks like implemented in a content platform.

1. Provenance as first-class content metadata

Add fields to your content types, and make them non-optional for any AI-assisted item:

A binary “AI-generated: yes/no” flag is fundamentally inadequate. The EU AI Act specifically scrutinizes whether content underwent genuine human review and editorial control. Defining granular operational roles—distinguishing an initial AI draft (drafted), iterative collaboration (co-authored), human writing polished for tone (copy-edited), background synthesis (researched), citation audits (fact-checked), or technical snippets (coded) from uncurated autonomous output (fully-generated)—creates an unambiguous, defensible audit record.

These fields are what turns the Article 50 editorial-responsibility carve-out from an assertion into evidence. They are also what lets you answer “which pages did model X touch?” the day a model turns out to have a systematic problem.

2. Risk-tier your content, then set review depth per tier

Uniform review is the mistake. Tier it:

• Tier 1 - regulated or safety-relevant. Medical, financial, legal, safety instructions, anything on a matter of public interest. Mandatory named human review, full sign-off, no exceptions. AI drafts or assisted co-authorship only; fully-generated output prohibited.
• Tier 2 - brand and commercial. Campaign copy, product pages, thought leadership. Human review required, disclosure decided per channel policy.
• Tier 3 - operational. Internal summaries, meta descriptions, alt text drafts, tag suggestions. Sampled review, spot checks, automated quality gates.

Encode the tier on the content type or the section, not on the individual item, so the workflow can enforce it automatically.

3. Move the gates into the pipeline

• Pre-publish automated checks: factual claim detection, banned-claim lists, brand terminology, accessibility (alt text present, heading order), and a duplication check against your own corpus.
• Workflow enforcement: a Tier 1 item cannot reach the published state without a humanReviewer value set by someone in the approver role. This is a workflow condition, not a habit.
• Sampling for the rest: review a fixed percentage of Tier 3 output, and track the defect rate. If the defect rate climbs, the model or the prompt changed. That is your early warning system.

4. Disclosure that is both human and machine readable

Two separate obligations, often conflated:

• Human-facing: a visible notice where policy or Article 50 requires it. Keep the wording consistent, factual, and matched to the operational role. “This article was co-authored with AI assistance and reviewed by [name]” or “Copy-edited with AI assistance” is vastly more defensible than a generic AI badge, because it documents both the division of labor and the human holding legal responsibility.
• Machine-facing: structured markers. C2PA Content Credentials for images and media, ^[5] plus schema.org metadata and machine-readable provenance endpoints (such as a site-wide /ai-provenance.json) for text. If your CMS renders <meta>, JSON-LD, and an automated transparency register from content fields, this is a template change, not a platform migration.

5. Keep the audit trail queryable

Version history is not enough on its own. You need to be able to answer, on demand: which content is AI-assisted, at what tier, reviewed by whom, generated with which model version, and when was it last re-reviewed. If that requires exporting the JCR or the database and writing a script, the answer will not arrive within the time a regulator or a customer gives you. Build it as a report in the admin UI while the fields are being added.

6. Retention and re-review

Content generated by a model has a shelf life tied to that model. When you upgrade the model or materially change a prompt template, the assumption that the prior output was reviewed under the same conditions expires. Set a re-review interval per tier, and treat a model change as a trigger event.

A Realistic Operating Model

The governance body that worked before AI, a monthly editorial board, is too slow at AI publishing volumes. What tends to work:

• A named accountable owner for AI-assisted content, sitting with the content or digital function, not with IT.
• A short written policy covering approved tools, prohibited use cases, disclosure rules, and the tier definitions. Two pages, not twenty.
• A tool allowlist. Uncontrolled tool sprawl is where data leakage and untraceable provenance start, and it is invisible until an incident.
• Training records against the Article 4 literacy duty.
• Quarterly review of the defect rate, not of individual items. You are governing a process now, not a queue.

If your organization needs a formal framework to point at, ISO/IEC 42001 provides an AI management system standard that maps reasonably onto this and gives auditors something familiar. ^[6]

Practical Starting Points

If you do nothing else, do these five, roughly in this order:

1. Inventory. Which AI tools are in use, by whom, producing what published output. You cannot govern what you have not listed.
2. Write the two-page policy and record that the team has read it. This closes the Article 4 gap immediately.
3. Add the provenance fields to your content model, and backfill the last twelve months as best you can.
4. Tier your content types and enforce the Tier 1 review gate in workflow.
5. Decide your disclosure rule per channel, implement it as a rendered field, and make it consistent.

None of these require a platform replacement. All of them are cheaper now than after the fact, which is the same lesson accessibility compliance taught the industry a decade ago.

Conclusion

Content governance before AI was about making a slow process reliable. Content governance after AI is about making a fast process accountable. The controls that matter changed: from approval chains to provenance metadata, from reviewing everything to tiering and sampling, from version history to a queryable audit trail.

The EU AI Act does not ask you to stop using AI for content. Read carefully, it asks a narrower question: can you show who is responsible for what you published, and can a machine tell what was synthetic. Teams that structured their content properly in the first place will find both answers are mostly a metadata exercise. Teams that treated the CMS as a page store will find it is a project.

Either way, the deadline is on the calendar and the content is already being generated.

• governance
• ai
• eu-ai-act
• compliance
• cms

Share:

About the Authors

Ahmed Chaabni

Founder of Gladtek and Senior IT Consultant specializing in DXP, ECM and Cloud-Native architectures. Passionate about open-source and modern developer experiences.

Claude

AI assistant by Anthropic, collaborating with the Gladtek team to produce technical content on enterprise CMS, Astro, and AI-ready web architecture.

Previous Post How We Made Gladtek.com Readable by AI Agents (and Why You Should Too)