Scan rule · RSC-PRV-021
Generated media without a visible notice
For apps that generate images or audio, checks whether the visible text says anywhere that content comes from an AI.
Why this matters
Article 50 of the AI Act requires **two** different things for generated content, and they are regularly confused. Paragraph 2 wants a marking machines can read — the invisible note inside the image file. Paragraph 4 wants one people can see. Neither replaces the other.
We check them separately because the remedy sits in different places: the invisible note is fixed in the image pipeline, the visible notice in the interface. Two findings side by side are two tasks, not a duplicate report.
We never claim a particular image is AI-generated — no tool could do that reliably. The rule is triggered by the generation endpoint in the shipped code, not by the image. Hence a low-severity hint only: the endpoint may serve a feature whose output never becomes public, and a caption that appears only after loading is invisible to a scan.
Scan tier
How to fix it
Put the notice where the generated content sits — as a caption on the image, not only in the privacy policy.