The AI Evidence Chain: Why Transparency Has Become a Procurement Requirement
By James Holloway, Senior Technology Analyst
For most of the enterprise AI build-out, vendor selection has turned on one axis: capability. On 2 August 2026 that axis acquired a competitor. The European Commission's AI Office and member-state authorities began enforcing the AI Act's transparency rules, under which users must be told when they are interacting with AI and when content has been AI-generated or altered. Transparency is no longer a roadmap item; it is an auditable, present-tense fact.
The structural change is not that new rules exist, but where the obligations sit. Article 50 deliberately splits duties between the providers who build AI systems and the deployers who use them — and a deployer can only discharge its half if the provider's half survives every handoff along the supply chain. In our reading, AI compliance has therefore become a procurement discipline. The defining question for buyers is no longer "what can your model do?" but "what evidence travels with your output — and will it still be intact when my obligation attaches?" Capability without a transferable evidence trail is, for EU-exposed use cases, an unpurchasable product.
Five Obligations, Two Roles, One Chain
The Commission's guidelines on Article 50 set out five transparency obligations, deliberately distributed across two roles:
- Interaction disclosure (provider): people "explicitly informed whenever they interact with an AI system directly".
- Machine-readable marking (provider): "machine-readable marks to enable the detection of AI-generated or manipulated content".
- Deepfake labelling (deployer): visible labels on publicly shown AI-manipulated image, audio or video.
- Emotion recognition and biometric categorisation disclosure (deployer): exposed individuals must be informed.
- Public-interest text disclosure (deployer): AI-generated public-interest text published without human review must be disclosed, with a "standard editing" carve-out.
The deployer obligations are only dischargeable if the provider obligations were engineered upstream: an organisation cannot label a deepfake its tools cannot detect, nor evidence editorial control over text whose provenance was never marked. The risk inherits from engineering choices made two or three contractual tiers away.
Who Owes What — and What Evidence Must Change Hands
In due-diligence terms, Article 50 is a checklist of artefacts that must change hands at signature:
| Article 50 obligation | Who bears it | What it requires in practice | Evidence a buyer should demand |
|---|---|---|---|
| Interaction disclosure (chatbots) | Provider | Users explicitly informed they are interacting with AI | Design documentation; disclosure specification; test evidence |
| Machine-readable marking | Provider | Marks and metadata enabling detection of AI-generated or manipulated content | Marking method statement; code signatory status or stated equivalent; mark-persistence guarantees across formats |
| Deepfake labelling | Deployer | Visible disclosure on AI-manipulated image, audio or video | Upstream marking warranty; labelling procedure; use of EU standard icons |
| Emotion recognition and biometric categorisation disclosure | Deployer | Individuals exposed must be informed | System inventory entry; notice templates; vendor scope-of-use record |
| Public-interest text disclosure | Deployer | Disclosure of AI-generated public-interest text absent human editorial review | Human-review procedure records; editorial-control log; disclosure policy |
Obligations per the Commission's Article 50 guidelines; the evidence column is the World Research Institute's interpretation.
A Voluntary Code That Behaves Like a Baseline
Machine-readable marking now has an official compliance vehicle. The Code of Practice on Transparency of AI-generated Content reached its final version on 10 June 2026, and the Commission and the AI Board have confirmed it as "an adequate voluntary tool" for demonstrating compliance; the guidelines allow providers to comply instead via "alternative equivalently adequate means". The code's page also publishes the EU's standardised icons for labelling AI content.
Signatory mass is what converts a voluntary code into a market baseline. The Commission's enforcement announcement cites more than 180 signatory organisations; the code's own page puts the figure at roughly 190 companies and organisations by late July 2026. At that mass, a non-signatory carries an evidence gap into every competitive procurement, voluntary or not. Signatory status and marking methods are also public, monitorable signals: transparency compliance itself is becoming competitive-intelligence raw material.
The Complaint Channel That Gives the Game Away
Alongside enforcement, the Commission opened three intake channels: a general AI Act complaints tool, a whistleblower tool, and a dedicated complaints channel for downstream providers building on general-purpose AI models. That third channel is the tell: the regulator itself expects compliance failures to surface between supply-chain tiers — precisely where the evidence chain is most likely to break — rather than only at the point of end use.
Enforcement is also multi-actor — national market surveillance authorities, the AI Office and the European Data Protection Supervisor all hold roles under the guidelines — so tempo and appetite will vary by member state. A vendor's "we comply" is jurisdiction-sensitive; the durable protection is contracted evidence, not assurances.
What to Watch
- First enforcement decisions. Whether early cases pursue the party holding the obligation or the party holding the evidence gap will reshape contract-negotiation leverage.
- National divergence. Member-state authorities may read the "standard editing" carve-out and marking adequacy differently; multinationals should expect the strictest regulator to set the de facto bar.
- Legacy deployments. Neither cited Commission page sets a separate timetable for systems already on the market before enforcement began; in our reading, buyers should treat pre-August 2026 deployments as in-scope now.
What This Means for Decision-Makers
- Rebuild the vendor questionnaire around evidence, not capability. Add marking method, code signatory status, disclosure design and mark persistence as scored RFP criteria. The cheapest compliance control is a question asked before signature — and interaction-disclosure duties apply to exactly the conversational and agentic systems enterprises are now buying at volume.
- Contract for the handoffs. Seek warranties that machine-readable marks survive integration, change-notification clauses covering model or marking alterations, audit rights over documentation, and escalation paths mirroring the Commission's complaint channels.
- Stand up the unglamorous controls now. An AI system inventory mapped to the five obligations, version records, documented human-review procedures for public-interest text (the guidelines' explicit exemption lever), and labelling procedures using the EU's standardised icons.
- Treat existing deployments as in-scope, not grandfathered. The obligations attach to how a system is used, not when it was bought; systems procured before August 2026 need the same evidence retrofitted, and retrofitting takes longer than asking at signature.
Evidence and data cut-off: 3 September 2026. Third-party figures are as published by the cited sources; Logistics Index readings are the World Research Institute's own. See our Research Standards.
The World Research Institute provides technology and regulatory trend analysis, vendor due-diligence research, and competitive intelligence programmes. Contact our team to commission tailored research.