WordPress EU AI Act Compliance Seal and Digital Checklist

EU AI Act Compliance Checklist for WordPress Websites

If you need to know exactly what to do to align your WordPress site with EU AI Act Article 50 transparency obligations, this checklist walks you through every step. For the full regulatory context, see our EU AI Act compliance guide and Article 50 explainer.

Phase 1: Audit Your AI Usage

Before you can disclose anything, you need to know what AI is present on your site.

  • List all AI chatbots — Identify every chatbot, AI agent, or conversational AI tool running on your site. Note the provider (e.g., OpenAI, Anthropic, a custom system) and where the chatbot appears (pages, widgets, pop-ups).
  • Inventory AI-generated text — Review published articles, blog posts, and pages. Identify which content was fully AI-generated, which was AI-drafted and then edited, and which was human-written with AI assistance (e.g., spell-check, grammar suggestions).
  • Inventory AI-generated media — Check your media library for AI-generated images, illustrations, audio, or video. Look for content created with tools like DALL-E, Midjourney, Stable Diffusion, or AI voice generators.
  • Identify AI tools in your stack — List all WordPress plugins, themes, or third-party services that use AI. This includes SEO plugins with AI features, image optimizers with AI, content generators, and analytics tools.
  • Check for emotion recognition or biometric categorisation — If your site uses tools that analyze visitor emotions or categorise users by biometric features, note them (Article 50(3) applies).

Phase 2: Chatbot Disclosure (Article 50(1))

  • Ensure every AI chatbot identifies itself — From the first interaction, the chatbot must clearly state it is AI. This should be clear, distinguishable, and accessible.
  • Don’t rely on “it’s obvious” — The “obvious” exception is interpreted narrowly. Unless the chatbot’s interface makes it unmistakably clear it’s AI, add explicit disclosure.
  • Make disclosure accessible — Ensure the disclosure follows accessibility requirements (WCAG-compliant, perceivable by screen readers).
  • Position disclosure at the start — The notification must come at the beginning of the first interaction, not buried later in the conversation.

See our AI chatbot disclosure requirements guide for implementation details.

Phase 3: Content Labeling (Article 50(4))

  • Label AI-generated text on matters of public interest — If you publish AI-generated or AI-manipulated text about politics, public health, public security, consumer safety, economic/financial/political/scientific/cultural developments, or other matters of public interest, apply a visible label unless the content has undergone genuine human review.
  • Document human review — If you claim the human review exemption, document who reviewed the content, their qualifications, and their authority to approve, alter, or reject. Superficial checks, spell-checking, and grammar correction do not qualify.
  • Label deepfakes — Any AI-generated or manipulated image, audio, or video that resembles existing persons, objects, places, or events and could falsely appear authentic must be clearly labeled. Disclosure must happen no later than the viewer’s first exposure.
  • Use visible and perceivable labels — Labels must be clear, distinguishable, understandable, and perceivable without requiring special tools. Visible badges, overlays, or captions are suitable.
  • Don’t rely solely on machine-readable marks — For deepfake disclosure, deployers cannot rely only on the provider’s embedded watermarks. A visible, human-perceivable label is also required.

See how to label AI-generated content and deepfake disclosure rules for practical guidance.

Phase 4: Preserve Machine-Readable Marks (Article 50(2))

  • Don’t strip provider-side watermarks — When you publish AI-generated content (especially images and video), ensure the machine-readable marks embedded by the AI provider remain intact.
  • Check your publishing pipeline — Some WordPress image optimization or compression plugins may strip metadata. Configure them to preserve provenance metadata (IPTC, XMP, C2PA).
  • Verify after publishing — Periodically check that published AI-generated content still carries its machine-readable marks.

Phase 5: AI Governance Files

  • Generate an AI.txt file — Declare your site’s AI usage policy in a machine-readable format accessible to AI crawlers and transparency verifiers.
  • Generate an LLMs.txt file — Specify which AI models/LLMs are permitted to crawl your site and under what conditions.
  • Configure robots.txt for AI crawlers — Set appropriate rules for AI bots in your robots.txt file.

MegaGovern generates AI.txt and LLMs.txt files natively on its Free tier. Learn more in our AI.txt and LLMs.txt guide.

Phase 6: Evidence and Audit Readiness

  • Maintain records of AI usage declarations — For each piece of content, record: what AI was used, how it was used, when it was disclosed, and what label was applied.
  • Keep timestamps — When you apply labels or make declarations, timestamp the action.
  • Export audit-ready reports — Be prepared to produce evidence of your compliance efforts. This includes disclosure logs, declaration records, and labeling histories.
  • Sync to durable storage — Local browser storage or short-term caches are not sufficient for audit purposes. Ensure evidence is stored durably.

MegaGovern’s Pro tier produces cryptographically signed PDF audit logs and syncs cloud audit records for 365 days. See megagovern.com/pricing for current plan features.

Phase 7: Ongoing Governance

  • Monitor compliance status — As you add new content or new AI tools, your compliance status changes. Establish a process to review compliance regularly.
  • Train your team — Ensure content creators, editors, and administrators understand the labeling requirements and the human review exemption.
  • Update declarations for new content — Every new AI-generated or AI-assisted post needs to be classified and labeled appropriately.
  • Track your readiness score — Use a governance dashboard to monitor your overall compliance status at a glance.

Phase 8: Agency & Multi-Site Considerations

If you manage multiple WordPress sites (e.g., as an agency):

  • Apply compliance consistently across all client sites — Standardize your disclosure labels, AI.txt files, and audit processes.
  • Use white-labeled tools — If clients see the compliance dashboard, ensure it reflects your agency’s branding.
  • Manage from a central dashboard — Track compliance status across all sites without logging into each one individually.
  • Assign team roles — Define who is responsible for auditing, labeling, and evidence management on each site.

MegaGovern’s Agency tier supports white-labeling across 20 domains with multi-site client dashboard management and detailed workflow team roles. See current plans.

Summary

This checklist covers the eight phases of EU AI Act Article 50 compliance for WordPress:

  1. Audit your AI usage
  2. Disclose AI chatbots
  3. Label AI-generated content
  4. Preserve machine-readable marks
  5. Generate AI governance files
  6. Maintain evidence and audit readiness
  7. Monitor ongoing compliance
  8. Manage multi-site governance (if applicable)

For the full regulatory background, read our Article 50 explainer. For help implementing any of these steps, explore MegaGovern’s features or compare the best AI disclosure plugins for WordPress.

Disclaimer: This checklist is a practical guide, not legal advice. Regulatory requirements may evolve. Consult the official European Commission guidance and a qualified legal professional for your specific situation.

Similar Posts