Code of Practice on Transparency of AI-Generated Content (marcatura ed etichettatura dei contenuti generati o manipolati dall'IA)

In line with Article 74 AI Act and Article 7 of Regulation (EU) 2019/1020 (the Market Surveillance Regulation), Signatories will cooperate with competent market surveillance authorities under the AI Act to demonstrate compliance with Article 50(2) and (5) AI Act and their Commitments

under this Section of the Code. At their reasoned request, where necessary for the exercise of the relevant tasks of the market surveillance authorities, Signatories will provide the documentation specified in Measure 4.1 and access to their marking and detection solutions. Article 78 AI Act applies to information obtained in the course of market surveillance activities, ensuring trade secrets and confidential information are preserved in accordance with the AI Act and applicable Union law.

Signatories are encouraged to cooperate with the AI Office and the AI Board in providing information about technologies that could be used to provide transparency across the value chain and that have been assessed by the AI Office and the AI Board to be compliant with the Code, for instance via an EU repository of available recognised standards and technologies.

Glossary Wherever this Section refers to a term defined in Article 3 AI Act, the AI Act definition applies. The following terms with their stated meanings are used in this Section of the Code. Unless otherwise stated, all grammatical variations of the terms defined in this Glossary shall be deemed to be covered by the relevant definition.

Term Definition

Analog hole Refers to a category of content processing operations where the digital content is rendered in an analogue form, typically to be presented to natural persons, before being re-digitised. A simple example is recording digital video content displayed on a screen with a digital camera. API Application Programming Interface: a machine-usable interface to an AI system or another software service. Containerised text Text that is embedded within a structured file format or a container, where the content is organised according to specific rules defined by the format. The container may include metadata, layout information, and encoding details that influence how the text is stored, displayed, and processed. Examples include text inside PDFs, Word documents, or HTML files. Desynchronization Refers to a category of content processing operations where the mechanism position of the digital samples is modified (and also possibly their value). A simple example is applying a mirror effect to a digital image. This definition has to be considered side-by-side with the one for ‘in- place modification’. Detection Mechanism for the detection of watermarks or the verification of mechanism for a digitally signed metadata markings that have been purposefully added marking technique by a provider of an AI system or a third party (e.g. model provider). Different providers of an AI system may share the same detection mechanism, typically when they use a standardized marking technique or develop a shared detection solution jointly. However, in general, a detection mechanism is specific to a given marking technique, i.e.

different watermarking techniques will have different detection mechanisms. Digital signature A cryptographic signature that enables secure verification of authenticity of the provider and integrity of the signed content. End-user A natural person exposed to the content generated or manipulated by the AI system. Error rate Relates to the probability of the detection mechanism to misclassify some content as “AI-generated or manipulated”. Error rates can be further broken down for improved interpretability, e.g. the false positive rate can negatively affect the trust that can be put in a marking technique and associated detection mechanism. Fingerprinting Also referred to as ‘perceptual hashing’ or ‘robust hash’. Content indexing technique that reduces content to condensed descriptors that can be efficiently looked up even if content has been subject to alterations. Fingerprinting has been used in the past for content-based recognition or identification. Forensic detection Detection of AI-generated or manipulated content which does not require prior AI marking. For example, a forensic detection mechanism may aim to capture some intrinsic signal signature present in AI- generated or manipulated content that makes it different from other content. Free-form A raw sequence of characters with no enclosing structure, schema, or text container format. It is not bound to any metadata, layout rules, or encoding beyond basic character representation. Examples could be the text that is shown on a website or within a chat. Homoglyphs Characters that appear (nearly) identical in shape but that originate from different alphabets, fonts, or encodings. As such, they may be exploited to confuse text marking techniques and associated detection mechanisms. In-place Refers to a category of content processing operations where the value modification of the digital samples, e.g. image pixels, are modified, but not their locations. A simple example is increasing the contrast of a digital image. This definition has to be considered side-by-side with the one for ‘desynchronization mechanism’. Logging Verbatim recording and indexing of content (usually text). Can be used for a fast lookup of known content, i.e., a repository of logged entries can be queried to find out whether content is known to have been AI- generated or manipulated. Marking Addition or embedding of a marker to AI-generated or manipulated content such as a digitally signed metadata or imperceptible watermarking. The purpose of this marker is to facilitate the detection of AI-generated or manipulated content.

Provenance A digital record for a piece of content generated or manipulated by an Information AI system that shows its origin, how and when the content was generated or manipulated and processing applied to the content. Screencasting Process of digitally recording the visual output displayed on a screen (computer, tablet, smartphone), often with some audio narration, and saving it to a file or streaming it live. Signpost Openly disclosed marking technique within the content and associated solution detection mechanism used to indicate which (watermark) detection mechanism shall be employed. This is an interoperability mechanism to streamline the detection workflow and avoid running each content subject to verification against all detection mechanisms employed by providers of generative AI systems whenever metadata is not available. It may be implemented, for instance, as an imperceptible machine- readable mark. User Either a deployer within the meaning of Article 3 (4) AI Act or another person that is using the generative AI system of a provider. UX “User Experience”, i.e., the way a user interacts with and perceives user-sided aspects of a software product. Very short Text that is so short that in many cases it cannot be watermarked, even text with a basic level of reliability. At the time of publication of the code, state-of-the-art techniques enable watermarking with at least a basic level of reliability of text as short as 200 tokens, with the expectation that this threshold will decrease as new methods become available. Until then, “very short text” should be understood as text shorter than 200 tokens. Watermark Technique that embeds a marker within the content in a manner that is imperceptible (to natural persons) and robust (the watermark is recoverable after content alteration). The watermark is inherently tied to the digital representation of the content (e.g. image pixels, audio samples) i.e. it is not auxiliary metadata. Watermarking has been used in the past for anti-piracy, audience measurement, and proof of ownership.