Code of Practice on Transparency of AI-Generated Content (marcatura ed etichettatura dei contenuti generati o manipolati dall'IA)

Signatories will make available a detection solution, composed of one or more detection mechanisms, to enable deployers, users of their generative AI system, third-party integrators, end-users exposed to the content, and other legitimate parties (such as competent authorities, independent researchers, civil society and media organisations) to verify whether content has been generated or manipulated by their AI system based on the marking technique(s) implemented pursuant to Commitment 1. Signatories will ensure that the detection solution, in conjunction with the associated marking solution, meets the level of effectiveness, interoperability, robustness, and reliability required by Article 50(2) AI Act, Commitment 3 of the Code, and the following Sub-measures.

Sub-measure 2.1.1. Making the detection solution available The detection solution may be made available in the Union as one or more of the following: (i) a public, ideally standardised, specification allowing any third party to implement a detection mechanism; (ii) a piece of software (e.g., a standalone executable or library); (iii) a cloud-based service accessible to users in the Union through an API. When providing a public specification under point (i), Signatories are encouraged to provide a reference implementation. When providing a piece of software under point (ii), Signatories are encouraged to ensure that the version is portable on most operating systems (including, where technically feasible, mobile phone systems) and that the hardware requirements are limited, if any at all, to facilitate the local execution of the detection mechanism(s) on any general-purpose device. Signatories will ensure that their detection solution includes a detection mechanism for each marking technique implemented in their generative AI system pursuant to Commitment 1. Similarly to the marking techniques in Measure 1.1, Signatories may rely on shared or third- party detection mechanisms, for instance provided by providers of AI models that apply

markings at the model level or by third-party technology providers specialised in transparency marking techniques and detection mechanisms. Such reliance is without prejudice to the Signatories’ own responsibility to ensure compliance with Article 50(2) and (5) AI Act and with this Section of the Code. In order to facilitate compliance by downstream providers of generative AI systems, Signatories who are also providers of generative AI models are encouraged to provide detection mechanisms for the content generated or manipulated by their models prior to the model’s placement on the market. Signatories will make the detection solution available free of charge. Signatories with fewer than 1,000,000 monthly users of their generative AI system, whose detection solution incurs substantial operational costs (in particular when it is provided for detection of watermarks as a cloud-based service), may charge a fee for the use of their detection solution (which will be reasonable, fair and proportionate to the overall operational costs of that solution) in cases where requests from a single user exceed a reasonable threshold due to large volume of requests. All Signatories will always provide free access to their detection solution, without any restriction on the volume of requests, to competent market surveillance authorities and other regulators, law enforcement authorities, media, fact-checkers, trusted flaggers, independent researchers, educational and research institutions, and civil society organisations. Signatories are encouraged to collaborate with relevant actors within the ecosystem to make their detection solution directly available within distribution and communication platforms.

Sub-measure 2.1.2: Access to the detection solution Signatories will ensure access to their detection solution through a user interface appropriate for the audience of end-users that may eventually be exposed to the content generated or manipulated by their AI system. Where the general public may be exposed to the AI-generated or manipulated content, the detection solution will accordingly be made available to the general public. However, where there are safeguards to ensure that only a limited number of natural persons will be exposed to the AI-generated or manipulated content (e.g., AI systems in professional settings), and where there are effective safeguards to prevent further dissemination of the content to the general public, access to the detection solution may be restricted to those natural persons. In their detection solution, Signatories may restrict access to detection mechanisms associated to watermarking techniques for free-form text to the extent that they have a lower level of reliability and robustness and that they may produce misleading or low-confidence results. However, the results of such detection mechanisms may still provide valuable information to verified expert end-users with a legitimate need, including competent market surveillance authorities, other regulators, law enforcement authorities, media, fact-checkers, trusted flaggers, independent researchers, educational and research organisations, and civil society organisations. Therefore, Signatories will ensure that access for these expert end-users is granted subject to appropriate access controls and safeguards. Any restriction to the access will be limited in time until more reliable and robust detection mechanisms have emerged and have been adopted as the state of the art for detection mechanisms for the watermarking of free- form text evolves. Signatories will ensure that the detection results by their detection solution are provided in accordance with Measure 2.3 below. Moreover, Signatories will ensure that the detection result of specific content submitted for detection can be downloaded upon request in a digitally signed format, including at least a hash

of the content submitted for detection, a URL or other identifier of the detection solution, and a timestamp.

Sub-measure 2.1.3: Personal data protection, privacy and security Signatories will ensure that the detection is compliant with EU privacy and data protection law. Without prejudice to applicable EU law, including EU privacy and data protection law, for any detection solution provided as a software or a service (fully or in part) that requires uploading content, Signatories will ensure:

(a) That the content submitted for detection is processed as privacy sensitive and processed in compliance with EU privacy and data protection law.

(b) The confidentiality and integrity of the content, while in transit and at rest.

(c) Data minimisation in the provision of the detection service, namely that the detection service does not collect, retain, or otherwise process personal data from users of the detection solution, or content submitted to it, beyond what is necessary to deliver the detection functions, except where necessary and based on a valid legal basis for security and abuse prevention, for ensuring the detection solution works effectively, opt-in user feedback or service improvement based on user preferences. Where technically feasible, Signatories are encouraged to apply privacy-preserving technologies and only require the uploading of a derivative of the content that does not give access to the semantics of the content.

(d) That the content submitted for detection is processed for the sole purpose of detecting the markings and is not processed for any other purpose except where necessary for the other purposes specified in point (c) above.

(e) That the content is stored only for the duration of the detection and is permanently deleted immediately thereafter (i.e. with a ‘zero retention’ policy) provided that minimal data (such as traffic logs) may be retained for a limited period on a valid legal basis solely to ensure security and prevent abuse. In particular, Signatories will not retain a verbatim copy of the content and will delete it immediately after the detection.

(f) That relevant security safeguards, appropriate to the risk, are in place to ensure the ongoing confidentiality, integrity, availability, and resilience of the detection service.

(g) Compliance with all other applicable requirements under EU privacy and data protection law, including the requirements governing transfers of personal data to third countries under EU data protection law.

(h) That best practices in cybersecurity are implemented to protect access to the detection solution in cases where uncontrolled access to the detection solution may compromise the security of the underlying marking techniques and detection mechanisms.

Sub-measure 2.1.4: Retirement of a detection solution Signatories are entitled to retire a detection solution as long as it is replaced by an alternative detection solution. Signatories will ensure that any such alternative detection solution yields the same or better detection capabilities and is backward compatible, enabling the detection of previously marked content. Where a Signatory has developed its own detection solution and stops providing that solution without replacement for any reason (e.g., business closure), it will make that solution available

to the competent market surveillance authorities, subject to confidentiality and security safeguards to enable them to detect, where necessary, legacy content generated or manipulated by their AI system.