Five Years, Billions Spent, Zero Vision
The EU AI Act was designed as a massive regulatory framework to stop synthetic deepfakes and protect public trust. European lawmakers spent five years, consumed huge budgets, and ran endless expert panels to draft it.
The entire effort suffered from a total lack of vision. Regulators failed to see how their rules would reshape digital ownership, creating a paper exemption for editing that tech giants simply ignored out of fear of massive fines. To protect themselves, corporations default to labeling every single export as AI – erasing human authorship across the board and handing complete control over to tech platforms.
The Three Structural Blind Spots
1. They Forgot the Creator as a Legal Entity
Regulators focused on AI providers and AI users.
They did not properly account for the fact that an AI user is a person who actually creates the work while using AI as a tool.
A professional creator can direct the software, make creative decisions, edit its output, combine it with their own work and decide what becomes the final result. AI is part of the creative process, but it is not the creator unless it starts producing without any human interaction.
The problem is that the regulatory framework does not give that person a corresponding identity layer in the provenance of the work.
The AI provider can identify its own system. The human creator is left without an equivalent, standardized way to identify their own role.
That is not a small omission. It changes who is visible in the history of the work.
2. They Assumed That Writing the Exemption Was Enough
Article 50(2) of the EU AI Act contains an important exemption for AI systems performing an assistive function for standard editing. The law therefore recognizes that not every use of AI should result in a work being treated in the same way as fully AI-generated content.
But the regulation stops at the legal distinction.
It does not provide the creator with a simple interface mechanism to make that distinction part of the provenance of their work.
This is where the failure becomes visible.
A rule saying that an assistive use is different is one thing. Giving the person using the software a way to record that fact is another.
Without that mechanism, the software provider remains in control of what the exported file says about its origin.
The result is a system where the safest position for the provider can become the most visible position for everyone else: AI was used.
The much more relevant information – how it was used and who directed the work – does not exist.
3. They Missed the Identity Layer
The technology needed to approach this problem already exists.
Authenticated user accounts already exist. Cryptographic provenance already exists. C2PA provides a standard for creating tamper-evident provenance records, and its own guidance recognizes creator control, identity and opt-in use as important parts of the creator experience.
The problem is not that we need to invent another complicated technology.
The problem is that the human creator was not put into the picture.
The software can record what software was used. It can record actions and provenance. But the person directing the process also needs a way to make an explicit, voluntary assertion about their role.
That can be very simple:
Sign your work.
The Shift in Perspective
This requires a change in perspective more than another layer of regulation.
AI software is a tool. The fact that a tool is powerful does not make the tool the creator.
The relevant question should therefore not be only:
Was AI used?
It should also be:
Who directed the work, and does that person want to identify themselves as the creator?
That distinction is particularly important because the answer does not have to be forced.
The creator can be given a choice.
They can use the software normally, or they can choose to sign the work.
That one choice can connect the human creator to the provenance record without removing the information about the AI tools that were used.
The Creator Attribution Amendment
The purpose of the Creator Attribution Amendment:
The proposal introduces a voluntary Human Author Assertion Mechanism into AI software.
At export, the user can choose to sign their work.
The authenticated user session can then be connected to the provenance record, using existing provenance infrastructure such as C2PA, so that the resulting record contains both the information about the tools involved and the human user’s voluntary authorship assertion.
The important part is what this does not require.
- It does not require every creator to disclose their identity.
- It does not require every work to be signed.
- It does not require the software provider to decide who deserves to be called a creator.
- It simply gives the creator the capability to make the assertion themselves.
- And that is why this is a very different type of regulatory proposal.
- It does not need to replace the existing system.
- It adds something that is missing.
The proposal was submitted to the European Parliament Petitions Portal and to Coimisiún na Meán to address this exact interface gap.
A Win-Win-Win Situation
The creator gets something they currently lack: a way to attach their own voluntary authorship assertion to the provenance of the work.
The AI provider gets a clear mechanism for the user to declare their role instead of leaving the provider to treat every output according to the same broad category.
Search engines and other platforms get an additional machine-readable signal that can help them understand the difference between AI involvement and the absence of human involvement.
Regulators and courts get a verifiable record that can provide useful evidence about the creation process when that evidence later matters.
And nobody is forced to use it.
This is the part that makes the proposal so unusual.
Giving the creator the option to sign their work does not take anything away from the other participants.
The AI provider can still identify the AI system.
The provenance can still record what happened to the file.
The platform can still see that AI was involved.
The creator simply gets the ability to add their own side of the story.
The Missed Opportunity
The real failure was therefore not simply a missing technical feature.
It was a failure to see the creator.
Regulators spent years designing rules around AI systems and the companies providing them, while the person using those systems to create the work remained largely invisible in the resulting provenance structure.
The technology to change that is already here.
The provenance standards are already here.
The authenticated user is already here.
What is missing is the simple connection between them.
A small change in the software interface can give the person directing the work a choice that should have been obvious from the beginning:
I used AI as a tool. I am the human creator. I choose to sign my work.
That is the shift in perspective behind the Creator Attribution Amendment.