For technology and media firms, the Act converts many previously unregulated practices into activities subject to legally binding risk management, transparency, and accountability obligations. This article analyses how the AI Act will affect companies operating in technology and media. It focuses on four dimensions: the structure and scope of the Act; specific implications for platform algorithms, synthetic media and newsrooms; core compliance duties for providers and deployers; and strategic governance choices for firms that rely on AI as core infrastructure. Throughout, it situates the AI Act within the broader EU regulatory environment, including the Digital Services Act (DSA), the Digital Markets Act (DMA), and the European Media Freedom Act (EMFA).
1. Technology and media use cases under the AI Act
1.1 Recommender systems, ranking and content moderation
Recommender systems and ranking algorithms lie at the heart of contemporary technology and media services. They determine which posts users see, which videos are suggested next, which news stories are promoted, and how advertising is targeted. The DSA already imposes obligations on very large online platforms and search engines to assess systemic risks linked to such recommendation systems, including impacts on freedom of expression, civic discourse, and disinformation.
The AI Act interacts with this regime rather than duplicating it. Most recommender systems are not automatically designated as high-risk under Annex III, but they remain subject to general requirements for technical robustness, non-discrimination and transparency where they qualify as AI systems. If a recommender system is used in a way that materially influences individuals’ access to essential services or produces significant legal effects—such as automated demotion of lawful content in ways that affect economic livelihoods or political participation—it may contribute to a high-risk use case and trigger more stringent duties. Even where classification remains below the high-risk threshold, the combined effect of DSA and AI Act requirements will push platforms towards more systematic documentation, auditing and explanation of algorithmic curation.
Automated content moderation systems raise similar issues. Tools used to detect and remove illegal content, hate speech, or misinformation operate at scale and can significantly affect users’ rights to expression and information. Under the AI Act, such tools must meet baseline standards of accuracy, robustness and bias mitigation, with meaningful human oversight for high-impact decisions. In parallel, the DSA’s obligations on notice-and-action procedures, complaint handling and transparency reporting require platforms to be able to account for the role AI plays in these processes.
1.2 Generative AI, synthetic media and Article 50
Generative AI systems—models that produce text, images, audio or video—sit at the core of many technology and media products. The AI Act addresses them primarily through Article 50, which establishes transparency obligations for AI systems that interact with natural persons or generate synthetic content.
Providers must design AI systems that inform individuals when they are interacting with AI rather than a human, unless this is obvious from context. For systems that generate or manipulate audio, image, video or text content, providers must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. This is not limited to large language models; it covers voice-cloning tools, text-to-speech engines, image and video synthesis models, and multimodal systems.
Deployers face additional duties. Article 50 requires deployers of AI systems that generate or manipulate image, audio or video content constituting a deepfake to disclose that the content is artificially generated or manipulated, subject to limited exceptions (for example, certain law-enforcement uses). It also obliges deployers that generate or manipulate text published with the purpose of informing the public on matters of public interest to disclose that the text is AI-generated or AI-edited. This directly affects news organisations, broadcasters, corporate communicators and platforms that rely on AI-authored text in public-facing contexts.
For technology and media companies, these rules imply changes to content production and distribution workflows. Systems must be capable of embedding provenance signals (such as watermarks or metadata) at the point of generation, and content management systems must preserve these signals through editing, re-encoding and distribution. User interfaces need to communicate AI involvement clearly and consistently, including in cross-posted content and syndication chains.
1.3 Journalism, newsrooms and media freedom
The AI Act does not create a dedicated media-sector chapter, but its impact on journalism and newsrooms is mediated through broader concerns about media freedom and pluralism. Academic analysis emphasises that AI tools used in news production and distribution—such as automated story templates, audience analytics, and personalised news feeds—can affect editorial autonomy and the diversity of information environments.
The EMFA and DSA complement the AI Act by targeting specific risks to editorial independence and pluralism. The EMFA introduces rules on state interference, transparency of media ownership and assessments of media market concentration that consider pluralism, while the DSA focuses on systemic risks linked to very large platforms. AI Act obligations overlay this landscape by requiring that AI systems used in these contexts be designed and governed in ways that respect fundamental rights, including freedom of expression and non-discrimination.
For newsrooms, this translates into several practical questions. When AI is used to draft articles, summarise sources or generate headlines, how is accountability maintained, and how are corrections handled if AI contributes to errors? When audience data and predictive analytics feed into editorial decisions, how are risks of “click-driven” homogenisation and marginalisation of minority voices assessed and mitigated? Academic commentators note that AI governance must be aligned with professional journalistic ethics rather than treated as a purely technical compliance exercise.
1.4 Creative industries, virtual production and IP
Beyond news, creative sectors such as film, television, gaming, advertising and music increasingly rely on AI for virtual production, localisation, asset generation and audience analysis. Many of these applications will fall under the limited-risk category, but Article 50 ensures that synthetic media is not invisible in the information ecosystem. Where AI can convincingly depict real persons or simulate real-world footage, there is a particular expectation of disclosure and technical detectability, especially if content could mislead audiences.
The AI Act operates alongside an emerging EU framework on copyright and AI. A briefing by the European Parliament’s research service notes that current policy debates distinguish between AI-assisted human works and purely AI-generated content, with draft positions suggesting that AI-generated works should not receive copyright protection in their own right. At the same time, the AI Act and related initiatives require providers of powerful GPAI models to publish summaries of copyrighted data used for training and to mitigate risks associated with copyright and related rights.
For media and entertainment companies, this creates a dual challenge. On the one hand, they must manage the risk that their own catalogues are used, without authorisation, in training datasets for third-party models. On the other, they must clarify the legal status of content that their teams produce with substantial AI assistance, particularly where human creative contribution is diffuse.
2. Core obligations for technology and media companies
2.1 High-risk systems and conformity assessment
Where an AI system qualifies as high-risk, providers face a dense set of obligations before placing it on the market. They must implement a risk management system that identifies, analyses and mitigates risks throughout the AI lifecycle; establish data governance procedures to ensure the quality, relevance and representativeness of training, validation and testing datasets; prepare extensive technical documentation; and implement logging and record-keeping mechanisms.
High-risk systems must be designed with appropriate human oversight, enabling natural persons to understand the system’s operation and intervene where necessary, and they must meet standards of robustness, accuracy and cybersecurity appropriate to their intended purpose. Providers are required to register high-risk systems in a public EU database and to conduct or arrange conformity assessments—either via internal control procedures or, in certain cases, via notified bodies—before deployment.
In technology and media contexts, high-risk classification is more likely to arise at the boundaries with other sectors than in core media functions. Examples include AI systems used by platforms to assess creditworthiness for marketplace merchants, tools used in hiring and workforce management, or systems that have legal effects in areas covered by Annex III, such as access to education or essential services. Nevertheless, the existence of these obligations will influence internal governance structures and may incentivise companies to avoid design choices that would bring systems within high-risk categories.
2.2 Transparency and disclosure for generative AI
Transparency obligations under Article 50 apply irrespective of whether an AI system is high-risk. Providers must ensure that AI systems designed to interact with natural persons are developed in such a way that users are informed that they are dealing with AI, unless this is obvious to a reasonably well-informed, observant and circumspect person. This affects chatbots, virtual assistants, interactive entertainment systems and customer-service automation.
For systems generating or manipulating content, providers must ensure that outputs are marked and detectable as artificial. Deployers then have to disclose when they use deepfakes or AI-generated text in public-interest contexts. Legal analysis emphasises that these duties attach to professional and institutional uses; they are not confined to traditional media organisations but extend to any entity that uses synthetic media in the course of business or professional communication.
These provisions will require companies to standardise internal labelling practice. For instance, a news organisation that uses an AI system to transcribe interviews and draft first versions of articles must decide when and how to indicate AI assistance to readers. A streaming service that experiments with AI-generated trailers must ensure that viewers are not misled about what is human-performed and what is synthetic. Consistency across products and jurisdictions becomes complex when AI-related expectations differ in other markets, such as the United States or Asia.
2.3 General-purpose AI models and foundation models
The AI Act recognises general-purpose AI (GPAI) models, particularly those with systemic risk potential, as a distinct category requiring additional obligations for providers. Providers of GPAI models must perform and document model evaluations, identify and mitigate systemic risks (including risks to fundamental rights, public safety and democracy), ensure cybersecurity, and provide technical documentation and usage instructions to downstream deployers.
Technology firms that develop foundation models used widely across media and creative industries—such as large language models for copywriting or multimodal models for image and video synthesis—will need to expand internal safety and governance functions. This includes robust testing for misuse scenarios, content-filtering capabilities, and guidance to downstream users on appropriate use, limitations and residual risk. For media companies that fine-tune or integrate such models into proprietary tools, there is a threshold question of when they become providers of new AI systems in their own right, with corresponding obligations.
2.4 Penalties and enforcement landscape
The AI Act’s enforcement framework is designed to be dissuasive. Serious infringements, including breaches of prohibitions on unacceptable-risk AI practices or certain obligations for high-risk systems and GPAI models, can attract fines up to 35 million euros or 7 percent of global annual turnover, whichever is higher. Other major infringements can result in fines up to 15 million euros or 3 percent of global turnover.
Enforcement responsibilities are distributed. National competent authorities and market-surveillance bodies oversee compliance for most provisions, while existing regulators, such as media authorities, are expected to supervise certain aspects of Article 5 and Article 50 in the media context. The European Commission plays a central role for GPAI models and systemic-risk issues and may issue guidance or adopt implementing acts that further specify obligations. For technology and media firms, this multi-layered regime underscores the need for coherent, cross-border compliance strategies rather than fragmented country-by-country approaches.
3. Deepfakes, disinformation and information integrity
3.1 Deepfake labelling and detection
Deepfakes—synthetic or manipulated media depicting individuals in ways that appear authentic—concentrate many of the AI Act’s concerns about information integrity. Rather than banning deepfakes outright, the Act requires transparency from both providers and deployers. Providers of AI systems capable of generating such content must ensure that outputs are technically identifiable as artificial. Deployers who publish deepfake content must disclose that it is artificially generated or manipulated, with only narrow exceptions.
Policy analysis from EU institutions and academic commentators stresses that these obligations respond to the difficulty of distinguishing human-generated and synthetic content in online environments. The requirement for machine-readable markers—potentially via watermarking, cryptographic provenance or metadata—aims to enable both human and automated detection. However, experts also note technical limitations: watermarking can be stripped or degraded, and bad actors may not comply with labelling rules, which limits the regime’s ability to prevent malicious uses.
For technology and media companies that host or distribute user-generated content, these constraints create operational questions. Platforms must decide whether to require provenance information for uploaded content, how to treat content without such signals, and how to balance detection efforts against privacy and security concerns. Broadcasters and professional media organisations, by contrast, may find that adopting strong provenance and labelling practices enhances trust, even if the legal baseline is narrower.
3.2 Media pluralism, algorithmic gatekeeping and systemic risk
AI systems that curate and amplify information can influence which voices are heard and which perspectives are marginalised. Scholars have described algorithmic recommendation systems as new “gatekeepers” in the online sphere, co-determining what people see, what content gains visibility, and how attention is allocated. The AI Act’s emphasis on risk management and transparency for AI systems, together with the DSA’s systemic-risk provisions, provides a legal foundation for scrutinising these effects.
The EMFA further embeds media pluralism and editorial independence into EU law by requiring assessments of media concentration that consider not only economic indicators but also impacts on pluralism. AI-driven tools within media organisations and platforms thus operate within a broader policy project aimed at protecting democratic discourse. While the AI Act itself does not dictate editorial choices, its requirements encourage companies to document and evaluate how algorithmic systems might bias exposure to news and opinion, and to develop mitigation measures where needed.
3.3 Children, vulnerable users and harmful synthetic content
Children and other vulnerable users face particular risks from AI-generated media. A European Parliament briefing on children and deepfakes highlights threats including harassment, non-consensual imagery, manipulation and erosion of trust in information. The AI Act recognises synthetic content as a risk to the integrity of information, and Article 50(4) establishes specific labelling requirements for deepfakes, intended to reduce deception and manipulation.
For platforms heavily used by minors, these obligations intersect with existing EU and national frameworks on child protection and age-appropriate design. Companies will be expected to integrate provenance tools, labelling mechanisms and reporting channels that reflect children’s particular vulnerabilities, alongside broader efforts to combat disinformation and harmful content. This goes beyond technical implementation: it requires policy choices on content curation, education initiatives and support for victims of synthetic media abuse.
4. Strategic implications for technology and media firms
4.1 Compliance as an engineering and product constraint
For technology and media companies, AI Act compliance cannot remain isolated within legal departments. The nature of the obligations—risk management, data governance, model evaluation, logging, human oversight, transparency—means they must be implemented at the level of system architecture and product design. Treating compliance as an end-stage documentation exercise would leave companies exposed to both regulatory and operational risk.
Practically, this implies integrating AI governance into existing software-development lifecycles and newsroom or content-production workflows. Risk assessments need to be embedded as gating criteria; data pipelines must be designed with provenance and documentation in mind; model selection and configuration must account for robustness and bias; and user-facing components must incorporate appropriate disclosures. For many firms, this will require multidisciplinary teams that combine legal, compliance, engineering, data science and editorial expertise.
4.2 Business models, competitive dynamics and innovation
The AI Act may influence business models and competitive dynamics in several ways. First, transparency and labelling duties reduce the feasibility of relying on opaque synthetic media, particularly where users might reasonably assume content is human-generated. This can affect engagement strategies, advertising value propositions, and user expectations about authenticity. Companies will need to experiment with disclosure formats that are clear enough to meet legal obligations without undermining user experience.
Second, compliance costs are unlikely to be evenly distributed. Larger incumbents with existing governance infrastructure and regulatory experience may absorb the cost of high-risk conformity assessment and GPAI obligations more easily than smaller firms. High fixed costs for documentation, auditing and monitoring may therefore contribute to consolidation in certain AI-intensive segments, though the Commission and co-legislators have emphasised the need for proportionality and support for SMEs, including through regulatory sandboxes and guidance.
Third, the AI Act may influence innovation strategies, particularly for global companies that must decide whether to develop EU-specific versions of AI-enabled services or adopt AI Act-compliant designs globally. Some firms have already delayed or limited AI feature roll-outs in Europe due to regulatory uncertainty and perceived compliance burdens. Over time, however, convergence on AI Act-aligned practices could reduce fragmentation and serve as a de facto global standard, especially if other jurisdictions adopt similar approaches.
4.3 Intellectual property, training data and content rights
For media companies, the AI Act intersects with intellectual-property and content-rights questions in several ways. Providers of GPAI models must publish summaries of copyrighted works used in training, assess and mitigate copyright-related risks, and comply with EU copyright law, including exceptions and limitations. This increases transparency about training datasets and may facilitate enforcement by rights holders whose works have been used without authorisation.
At the same time, the European Parliament’s work on copyright of AI-generated works suggests that purely AI-generated outputs may remain outside the scope of copyright protection, while AI-assisted works could still qualify if human creative contribution is sufficient. Media and creative companies must therefore consider how their reliance on AI affects the legal status of their outputs and their ability to control downstream uses. This will influence decisions about where to deploy AI in the creative process and how to document human input.
4.4 Global regulatory spillovers
Finally, the AI Act is likely to have global spillover effects. Academic and policy commentary characterises it as a potential “global benchmark” for AI governance, similar to the GDPR in data protection. Companies seeking to operate at scale across jurisdictions may find it more efficient to build AI systems that meet AI Act standards by default, rather than maintaining divergent architectures for different markets.
For large US-based technology companies with significant EU user bases, the Act adds another layer to a complex regulatory environment that already includes antitrust measures, platform regulation and privacy law. Strategic decisions about infrastructure, localisation and product design will increasingly need to account for AI Act requirements and enforcement trends, particularly for GPAI models and AI-enabled features with systemic impact.
5. Governance recommendations for companies
5.1 System mapping and risk classification
An effective response to the AI Act begins with a comprehensive mapping of AI systems across the organisation. This includes models and tools used in consumer-facing products, internal analytics, content workflows, advertising systems, and back-office functions. Each system should be assessed against the AI Act’s definitions and Annex III use cases to determine whether it falls into prohibited, high-risk, limited-risk or minimal-risk categories.
This mapping must encompass third-party services and APIs as well as in-house models. Companies can be treated as providers when they substantially modify a third-party model or integrate it into a new system with a different intended purpose, and as deployers when they use AI within their own operations. Clear classification enables proportionate governance: not every system requires the full high-risk compliance stack, but every system needs an appropriate level of documentation and oversight.
5.2 Integrating AI governance into development lifecycles
Once systems are mapped and classified, companies should integrate AI Act obligations into software development and content-production lifecycles. In practice, this means incorporating risk assessment checkpoints into product design, aligning data-governance procedures with AI training and evaluation pipelines, and defining human-oversight protocols that are realistic and enforceable.
For media organisations, editorial policies should explicitly address the role of AI: when AI may be used to generate or translate content; how AI-generated material should be labelled; how sources are verified when AI is used for research or summarisation; and who bears responsibility when AI-assisted content contains errors or bias. Aligning editorial standards with AI governance frameworks reduces internal friction and supports more coherent external communication about AI use.
5.3 Investing in provenance, watermarking and detection
Given the centrality of Article 50 obligations, content provenance and detection capabilities are not optional add-ons but core infrastructure for technology and media companies. Providers of generative tools need mechanisms to embed machine-readable markers in outputs, while deployers must maintain these markers across editing and distribution workflows.
Detection capabilities will remain imperfect, and there is broad recognition that watermarking and labelling alone cannot eliminate malicious deepfakes or synthetic disinformation. Nonetheless, investment in these tools, combined with user-reporting channels, partnerships with fact-checking organisations, and collaborative standard-setting, can improve resilience. For professional media organisations, robust provenance practices can also differentiate verified journalism from unverified synthetic content.
5.4 Coordinating across overlapping regulatory regimes
The AI Act is only one piece of the EU’s digital regulatory environment. Technology and media companies must coordinate AI Act compliance with obligations under the DSA, DMA, GDPR, EMFA and sector-specific rules. Many requirements—such as systemic risk assessments, transparency about recommender logic, and protection of fundamental rights—are shared across these regimes.
To avoid duplication and inconsistency, firms should establish integrated governance structures with clear responsibility at board and executive level for AI and digital compliance. Centralised functions can ensure that risk assessments conducted for DSA purposes inform AI Act compliance, that privacy impact assessments under GDPR are aligned with AI data-governance reviews, and that media-specific considerations under EMFA are reflected in AI-driven editorial tools.
Conclusion
The EU AI Act represents a structural shift in AI governance with substantial implications for technology and media companies. It reframes AI-enabled practices—such as recommendation, content moderation, generative media and analytics—as regulated activities subject to risk-based obligations, transparency duties and potential high-value penalties. It also interacts with a wider set of EU instruments aimed at protecting fundamental rights, media pluralism and democratic discourse.
For companies operating in these sectors, the key challenge is to translate legal obligations into operational practice. This requires mapping AI use, classifying risk, integrating governance into development and editorial workflows, building provenance and labelling infrastructure, and coordinating compliance across overlapping regimes. Firms that treat these changes as an opportunity to embed transparency, robustness and rights-respecting design into their products may find that AI Act compliance aligns with longer-term strategic interests, including user trust and sustainable market access.
References
- European Commission, “AI Act – Shaping Europe’s digital future” (Digital Strategy portal).
- European Commission, “Timeline for the implementation of the EU AI Act” and related application-timeline briefings.
- European Parliament, “EU AI Act: first regulation on artificial intelligence.”
- European Commission, “Navigating the AI Act – Questions and Answers.”
- Intereconomics, “Better Regulation and the EU’s Artificial Intelligence Act.”
- European Commission, “Regulatory framework for AI – Code of Practice on Transparency of AI-Generated Content.”
- Interdisciplinary Centre for Media Pluralism and Freedom, “Risk in the Digital Services Act and AI Act: implications for media freedom, pluralism, and disinformation.”
- International Journal of Social Science and Economic Research, “The EU Artificial Intelligence Act and deepfakes in journalism.”
- E-SSAYS / University of Trento, “Artificial Intelligence and Media Freedom.”
- Policy Review, “Between the cracks: Blind spots in regulating media concentration and AI.”
- Media Studies, “European Media Freedom Act, DSA, and AI Act: transparency and risk-management obligations for AI use in media contexts.”
- European Parliament Research Service, “Children and deepfakes.”
- Geneva Graduate Institute, “Deepfakes and human rights: Why the EU AI Act is becoming the global standard for ethical AI.”
- WilmerHale, “General Purpose AI Models and AI-Generated Content under the EU AI Act.”
- European Parliament Research Service, “Copyright of AI-generated works: Approaches in the EU and beyond.”
- IPEX and related Council documents on AI, democracy and systemic risk.
- IBA, “Deepfakes – can the AI Act protect Europe?”
- Helberger et al., “Online platforms, algorithmic gatekeepers and media pluralism” (UvA-DARE).