AI on your site: what the law expects of you
This page is for you, our customer. The European AI Act does not only target those who build AI tools: it also targets those who use them in their business. That includes you, from the moment you publish content produced with one of our extensions.
1. You are a "deployer", and you probably did not know it
The regulation defines two roles. The provider designs the tool and places it on the market: that is us. The deployer uses it in the course of their activity: that is you, as soon as you use the extension on your own site, your company's, or a client's.
Both roles carry obligations, and they are not the same. This page covers yours. It is not legal advice: it gives you what you need to ask the right questions.
2. What the extension does — and what it does not
What it does: it sends text, an image or a piece of data from your site to an AI model you chose, using your own key, and returns a suggestion.
What it does not do, and this is the part that matters:
- it never publishes anything on its own;
- it never decides anything for you;
- it sends nothing until you have entered your key and switched the feature on;
- no data passes through our servers — the call goes from your site to your provider.
3. What remains a human decision — explicitly
An AI output is a suggestion, never a publication. In every case below the decision is yours, and the regulation treats it as yours:
| The extension suggests | You decide |
|---|---|
| a text, a heading, a description | to publish it, edit it, or discard it |
| a reply to a customer | to send it as is or rewrite it |
| a diagnosis, an analysis, a priority | whether to act on it |
| an image or an alt text | whether to use it on your site |
None of our extensions makes a decision producing a legal or similarly significant effect on a person. If you were to put one to that use, see point 6.
4. Where to read the marking, and how
Article 50(2) requires the provider — that is, us — to mark AI-generated content in a machine-readable way. It is done, and here is where to see it.
| Where | What you will find |
|---|---|
| In the page HTML | generated content is wrapped in a block carrying data-ai-generated="true", alongside data-ai-model, data-ai-provider and data-ai-scope |
| On a generated image | the same data-ai-generated="true" attribute on the image tag |
| In the WordPress database | a post meta field, _aiforya_ia_genere, queryable like any other |
| In your site's REST API | a field exposed on posts, pages and media — this is what makes the marking readable by an automated check |
This marking adds no visible text to your page, and that is deliberate. Paragraph 2 asks for a machine-readable mark; the human-readable disclosure falls under paragraph 4, and paragraph 4 is about you. We cannot write it for you: only you know your editorial context, your voice and your audience.
One distinction that matters: when only a metadata field is generated — an image alt text, for instance — the image itself is not marked as generated. It was not. Claiming otherwise would be a false declaration, and a false declaration exposes you more than a missing notice does.
5. Three things to check before publishing
- The substance. A model can be confidently wrong: figures, dates, names, legal references, prices. Check whatever commits you — the rest is style.
- Your notice to readers. Decide, once and in writing, what you display when a piece of content is AI-generated or AI-assisted. A line in the article footer is enough; having no policy is not.
- The data you send. Do not paste into an AI feature what you would not hand to an outside contractor: health data, identity documents, bank details, employee records.
6. When to tell us
Write to us before if you are considering using one of our extensions to:
- screen, score or rank people — applicants, students, patients, claimants, beneficiaries;
- decide on access to employment, education, credit, housing or an essential service;
- anything else falling under Annex III of the regulation.
This is not boilerplate. Repurposing the tool into one of those areas would move you into the heavy obligations reserved for high-risk systems (Article 25) — impact assessment, formalised human oversight, logging, registration. That is not a setting: it is a different legal regime.
Our extensions are not built for those uses, and we have removed from the catalogue every feature that scored a person. If your need points that way, let us talk before you install it, not after.
7. Your obligations, one line each
- Competence (Article 4): the people using the tool at your organisation must understand what a model can and cannot guarantee. This page is an acceptable support for most small organisations; keep a record of it.
- Transparency (Article 50(4)): tell your readers when published content is AI-generated or AI-manipulated. The technical marking in point 4 is your basis; the wording is yours.
- Good faith: do not present as a human judgement what a model produced.
A question about this page? Write to us — we would rather answer one upfront than correct something afterwards.