Governance & Accountability · GOV-10

Review and disclosure of AI-generated content

The organisation has approved rules for reviewing and disclosing AI-generated content that it releases or relies on, so people know when AI was used.

Why it matters

Content produced by AI can be wrong or misleading, and can be mistaken for the work of a person. Reviewing it before it is released or relied on, and saying plainly where AI was used, protects the people who meet it and keeps official records trustworthy.

Levels

0 Absent	Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0.
1 Initial	Whether AI-generated content is reviewed or disclosed is left to the person who produced it.
2 Developing	Some teams review or label AI-generated content, but the rules are incomplete, unapproved or not widely known, or content used inside the organisation is not covered.
3 Defined	Approved rules set how AI-generated content released outside the organisation, or used inside it for decisions and official records, is reviewed and disclosed, clearly and at least as the law requires.
4 Managed	Compliance with the review and disclosure rules is measured, and the rules are reviewed on schedule and after significant incidents or legal change.
5 Optimising	The rules are refined from evidence of how AI-generated content is actually used and received, and stay ahead of external change rather than reacting to it.

Level 3 criteria

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

GOV-10.1 Approved rules set how AI-generated content released outside the organisation, including synthetic media, is reviewed and disclosed. GEN
GOV-10.2 Approved rules set how AI-generated content used inside the organisation to inform decisions or form official records is reviewed and disclosed. GEN
GOV-10.3 The rules require disclosure at least to the extent the law requires, made clearly when a person first meets the content. GEN

Assessment questions

Are there approved rules for reviewing and disclosing AI-generated content released outside the organisation, including synthetic media?
Do the rules also cover AI-generated content used inside the organisation to inform decisions or form official records?
How and when is disclosure made, and how do you know it meets what the law requires?

Evidence an assessor would expect

The approved rules for reviewing and disclosing AI-generated content, with owner and approval record
A sample of released content and internal records showing review and disclosure
The legal disclosure requirements the rules were checked against

How to reach Level 3

Set rules for reviewing and disclosing AI-generated content released outside the organisation, including synthetic media such as images, audio and video.
Extend the rules to AI-generated content used inside the organisation to inform decisions or form official records.
Check the rules against the disclosure duties in the obligations register (RSK-04), and make disclosure clear at the point a person first meets the content.
Approve the rules under the AI policy (GOV-01) and tell the staff who produce or publish content.

Common pitfalls

Forgetting AI-generated content used internally, such as drafts that become official records.
Placing the disclosure where people only find it after they have read or relied on the content.

Starter artefacts

AI-generated content review and disclosure standard
Disclosure wording for common content types

Ownership and sequence

Accountable: ai governance lead
Contributors: risk lead, business owner
Depends on: GOV-01
Roadmap step: 3
Lifecycle: deploy, operate

Cross-references

EU AI Act	Art 50(4) direct
JSP 936 Part 1	para 40 direct
MITRE AI Maturity Model	P1.2 partial
NIST AI 600-1	R8 direct
UK Data and AI Ethics Framework	Transparency 5 direct; SAT 4.6 partial

direct: this control at Level 3 meets the item. partial: it covers part of it.