The Legal and Regulatory Landscape

Three dates

Take the three legal questions synthetic media raises and ask where each one stands.

Who must disclose. Article 50 of the EU AI Act applies from 2 August 2026. Providers must mark AI-generated output in machine-readable form; deployers creating deepfakes must disclose that content has been artificially generated or manipulated. It was not postponed by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which was published in the Official Journal on 24 July 2026 and in force from 27 July. That instrument did defer high-risk obligations: Annex III systems to 2 December 2027, and systems under Annex I sectoral product safety legislation to 2 August 2028. C11.01 Established

Whose likeness, and what harm. In the United States the TAKE IT DOWN Act was signed on 19 May 2025, making it unlawful to use an interactive computer service knowingly to publish an intimate visual depiction or a digital forgery of an identifiable person. Platform obligations took effect 19 May 2026: a notice-and-takedown mechanism, with properly reported imagery and known identical copies removed within 48 hours. The Federal Trade Commission has sent warning letters to 15 major platforms. C11.02 Established

Whether a court can rely on a recording. Proposed Federal Rule of Evidence 707, on machine-generated evidence, was published for comment in August 2025, with hearings in January 2026 and comments closing on 16 February. On 7 May 2026 the Advisory Committee voted to withdraw the published version and study a revised draft. In June 2026 the Standing Committee agreed and sent it back. Proposed Rule 901(c), which would let a court demand further authentication where a party credibly claims evidence was AI-fabricated, remains a study item. There is no rule and no effective date. C11.03 Established

That ordering is the chapter. The question that binds actors who were never the problem is in force. The question that binds intermediaries is in force and being enforced. The question that decides whether institutions can still rely on recorded evidence has no instrument at all.

Learning objectives

1. Distinguish the three legal questions and their very different compliance and effect profiles.
2. Explain why enforcement succeeds against intermediaries and fails against originators, using the documented cases.
3. Restate the function of transparency mandates in terms of the Chapter 10 threshold rather than as viewer warnings.
4. Describe the editorial-responsibility exemption in Article 50 and what it transfers.
5. Explain how proposed Rule 901(c) formalises the liar’s dividend as procedure.
6. Identify an organisation’s live legal exposure arising from Part II and Part III findings.

Reachability beats severity

Chapter 2 logged the enforcement outcome of the best-documented election case. Steve Kramer was identified, admitted commissioning the New Hampshire robocall, received a $6m FCC forfeiture and faced 13 felony and 13 misdemeanour counts. Reporting indicates neither the fine nor a subsequent $22,500 award was paid. C2.03

Set that beside the TAKE IT DOWN position. A statute aimed at platforms produced, within days of its compliance date, warning letters to fifteen named companies that have legal departments, revenue, jurisdictional presence and reputational exposure.

The difference between those two outcomes is not the severity of the law. The federal penalty in the first case was far larger than anything a warning letter represents. The difference is that one target was reachable and solvent and the other, though fully identified and domestic, effectively was not. Severity is what legislatures control; reachability is what determines collection.

What transparency duties are actually for

The standard criticism of disclosure mandates is that they bind only those who would have behaved well anyway. A compliant laboratory marks its output; a hostile actor does not, and faces no practical consequence for omitting a label on content that is already criminal. On its own terms the criticism is correct.

But it measures the wrong thing, and Chapter 10 supplies the correction. The value of provenance was never in the presence of a credential. It was in the eventual significance of its absence, which depends entirely on adoption, and which no individual organisation has an incentive to produce because the returns are collective.

A machine-readable marking duty on providers is the instrument that manufactures that adoption. Read that way, Article 50 is not a warning-label regime at all. It is adoption-forcing legislation whose function is to move the ecosystem toward the third panel of Figure 10.2, where unmarked output from an accountable source becomes a question worth asking. That is a more defensible rationale than the one usually offered for it, and a more modest one: the duty does not inform viewers so much as build the baseline against which absence will later be read. Analysis C11.04

Evidence: the liar’s dividend becomes procedure

Proposed Rule 901(c) would allow a court, where a party makes a credible claim that evidence was fabricated by artificial intelligence, to require further authentication. Consider what that does to the ordinary position of a party holding an authentic recording.

Today, a recording is authenticated by relatively light means. Under such a rule, an opponent’s credible assertion of fabrication can shift additional burden onto the party relying on genuine evidence. This is Chapter 2’s liar’s dividend arriving as civil procedure: the cost of the possibility of forgery is borne by whoever is telling the truth, because they are the one who must now prove more.

The rule is nonetheless probably necessary, and the dilemma is real rather than a drafting failure. Without such a provision, courts have no structured route to respond when fabrication is genuinely alleged. With it, every holder of authentic evidence inherits a new exposure. The practical escape is the one Chapter 10 described: an organisation that can produce an original with a hard binding and a documented editing history meets a raised authentication burden cheaply, and an organisation that cannot will meet it expensively or not at all.

Which means the single most consequential legal development in this field is a rule that does not yet exist, and the preparation for it is a records-retention and provenance decision that must be taken years before the rule lands.

Table 11.1 — The bottom-right cell is the one with a deadline nobody has set. Sources: C11.01 to C11.04.

Practical scenario

Executive implications

• Retain originals and provenance now, because the evidence rule has no date. This is the only item in this chapter with a lead time measured in years, and it is the one with no regulatory prompt to make you do it.
• Withdraw AI-text detection from decisions about people. Chapter 8 established a 61.22 per cent false-positive rate for non-native English writers against roughly five per cent for native writers. The evidence is published and the mechanism understood, which makes the disparate impact foreseeable, and foreseeability is where exposure begins.
• Mark your own output, and treat the duty as adoption rather than labelling. If Article 50 applies to you, compliance also buys the Chapter 10 benefit. If it does not, the benefit is still available.
• Use the editorial-responsibility route where you can. A named human accountable for publication is both a legal position and a better control than a label.
• Know the takedown mechanism before an incident. A 48-hour statutory clock is useful only to an organisation that already knows how to start it, for itself and for its people.
• Do not budget on deterrence. The best-documented penalty in this field, $6m against an identified and admitting defendant, appears uncollected.

Common misconceptions

Limitations and open questions

• This is not legal advice, and the selection is biased toward documentation. Two jurisdictions appear here because their instruments are well published. Likeness law in particular varies enormously, and several significant proposals, including US federal likeness bills, remain bills and are not treated as law.
• Statuses change, and this chapter is dated by construction. Article 50’s application date survived the Digital Omnibus; high-risk deferral shows such dates do move. Anyone relying on the dates here should re-verify them.
• Collection data is thin. C2.03 rests on reporting at a point in time, and no systematic data appears to exist on collection rates for synthetic-media penalties. That absence is itself a finding and would be worth a proper study.
• The transparency-as-adoption argument is analysis, not a stated legislative intent. Nothing cited here says Article 50 was designed to produce the Chapter 10 threshold effect. The claim is that this is its most defensible function, not that it was the drafters’ purpose.
• Enforcement against platforms has its own costs. A 48-hour removal duty with statutory penalties creates incentives toward over-removal, and the resulting harm falls on lawful speech. This chapter does not attempt to weigh that trade-off.

Teaching materials

Discussion questions

1. Why has law advanced fastest on transparency and not at all on evidence? Consider who lobbies for each.
2. Is the transparency-as-adoption argument a sufficient justification for a compliance cost on legitimate industry?
3. Article 50 exempts text with human editorial responsibility. Is that a loophole or the best part of the provision?
4. If Rule 901(c) shifts burden onto honest parties, should it be adopted anyway? What is the alternative?
5. Given the collection record, what should an organisation reasonably expect from legal remedy after an incident?

Assessment questions

1. Compare the three legal questions across the rows of Table 11.1 and justify which carries the greatest institutional exposure. (20 marks)
2. Explain why enforcement succeeded against intermediaries and failed against an identified originator. (10 marks)
3. Set out the evidentiary preparation an organisation should undertake before any new authentication rule takes effect. (15 marks)

Practical exercise

Pick one recording your organisation would rely on in a dispute. Establish whether an original exists, who holds it, whether it has been transcoded, and what provenance record accompanies it. In most organisations this exercise ends in under ten minutes with an unsatisfactory answer.

Research assignment

Trace one synthetic-media penalty from order to collection. Report what public records show about payment, and note how difficult the question was to answer.

Seminar topic

“Regulating disclosure was the easiest thing to do and the least useful; regulating evidence is the hardest and the most necessary.” Argue either side.

Further reading

1. Regulation (EU) 2024/1689 (AI Act), Article 50, and Regulation (EU) 2026/1744 (Digital Omnibus on AI). See the Commission’s FAQ on Article 50 transparency obligations. digital-strategy.ec.europa.eu
2. TAKE IT DOWN Act, Public Law, 19 May 2025. Congressional Research Service product LSB11314. congress.gov
3. Federal Trade Commission. (2026). Take It Down Act enforcement starts now. ftc.gov
4. Advisory Committee on Evidence Rules. Proposed FRE 707 and Rule 901(c), including the May 2026 withdrawal and continuing study.
5. Chesney, R., & Citron, D. (2019). California Law Review 107 — for the liar’s dividend that Rule 901(c) would formalise, see C2.03 and Chapter 2.

Chapter synthesis

Law is doing something in this field, and it is not what either its advocates or its critics usually describe. Transparency duties are in force and bind the compliant, which critics read as futility and advocates oversell as viewer protection. The better account is that a machine-readable marking duty is the only available instrument for manufacturing the adoption that makes a missing credential informative, because that benefit is collective and no firm will fund it alone. On that reading Article 50 is provenance policy, and its most interesting clause is the one that lets an organisation substitute a named accountable human for a label.

Likeness and harm law is in force too, and the comparison between its enforcement and the New Hampshire outcome is the practical lesson of the chapter. A $6m forfeiture against an identified, admitting defendant appears uncollected; warning letters to fifteen platforms produced immediate activity. Severity is what legislatures choose and reachability is what determines collection, so an institution should plan for intermediary remedies and treat deterrence of originators as unavailable.

The third question is the one with no instrument, no date and no constituency, and it is the one that will decide whether institutions can continue to rely on their own records. Proposed Rule 901(c) would let a credible allegation of AI fabrication raise the authentication burden, which transfers the cost of synthetic media onto whoever is telling the truth. It is probably necessary and it is certainly expensive, and the only cheap answer is a provenance and retention posture established before any dispute arises. That is the clearest instance in this book of a control whose deadline is set by litigation rather than regulation, which is to say by someone else entirely.

Against Figure 0.1, Layer 5 is now specified. It raises the floor, it reaches intermediaries, it will eventually reallocate evidentiary burden, and it will not protect any individual organisation from a competent attacker. What remains is the layer that has held in every documented case in this book, and the one that no statute will build for you. Chapter 12 assembles it.