Copyright and the EU AI Act 2026: what changed in February, and what did not

Since the EU AI Act's 2024 adoption no change has been as consequential as the February 2026 GPAI implementing package — delivered by the Commission six months late but delivered. As a publisher that produces AI-assisted content, we spent three weeks combing through our own compliance posture. Here is our reading and the playbook we built.

What changed in February

Two substantive points. The first is the transparency obligation: any content where AI generation or AI assistance materially shaped the final form before publication must be disclosed to the consumer. The definition of 'materially' lives in the delegated act and is not hand-waving: the act's worked examples show that 'title rewritten by LLM' is not a trigger on its own, while 'lede rewritten by model and published after human review' is.

The second is training-data disclosure: providers of general-purpose AI (GPAI) models must publish a public summary of the categories of data the model was trained on. This does not bind us directly as a publisher, but it binds us downstream: if we use a provider that does not comply, we may share liability in the downstream compliance assessment.

What did not change

The Berne Convention's authorship attribution is unchanged. The author of a news article is the natural person who wrote it — even when an LLM assisted the process. The LLM is not a co-author, not a 'work for hire' author, and not a legal entity that needs to appear on the copyright notice. Several pieces in the trade press in the last weeks have framed this incorrectly.

Reader-data handling is also unchanged on the GDPR side — the AI Act is not a module of GDPR, it is a parallel regime. What was compliant under GDPR in 2025 is compliant under GDPR in 2026. We caught one internal proposal that assumed the AI Act overrode our GDPR processing notice. It does not.

Our three-step disclosure rule

On 14 February the newsroom and legal team met. The agreement: every Mediaorigo article carries three metadata fields, two of which surface to the reader.

1. Per-article generation flag — an enumerated value: human_only, llm_assisted_lede, llm_assisted_structure, llm_co_authored. The first two carry no reader-side badge. The third (llm_assisted_structure) renders a small 'AI-assisted' marker next to the publication date. The fourth (llm_co_authored) is unused today — we do not publish work where the model contributed more than a quarter of the substantive content. If we ever do, full-content disclosure is mandatory.

2. Model fingerprint — which model, which version, which prompt template ID. This is internal-only; it exists for audit and for reproducibility when we later regenerate or correct.

3. Human editor of record — every article carries a named editor who read and signed off before publication. This existed before February 2026 as a newsroom convention. It is now a contractual requirement.

What the Commission left unresolved

The liability split between model provider and publisher remains murky. If a GPAI model hallucinates a concrete claim and we publish it in good faith with mandatory human review, civil liability sits with the publisher while the compliance fine may attach to the model provider — or vice versa. The delegated act devotes one paragraph here, which in effect punts the question to member-state courts.

Mediaorigo's posture for now: we hold civil liability on our side as publisher. The cost is priced into the business case for any AI-assisted workflow we deploy.

The second open question is training-data audit accountability — can we, as a downstream user, be expected to verify the GPAI provider's published training summary? The act says no, but a consumer-protection action testing this in court is overdue. Our internal answer: we read the summaries, we keep dated copies, and we make our procurement decisions on the assumption that providers will be held to what they publish.