The agency problem: client sites and whose duty it is

This guide is not legal advice. It is a plain-language walk through a question the AI Act never answers directly: when an agency builds and runs a client's website, whose disclosure problem is it?

The uncomfortable arithmetic

If you run an agency, count with us. Take the number of client sites you look after. Multiply by the share of their content that was AI-assisted somewhere along the way, which for most agencies since about 2023 is not a small share, and some of it was yours. That number is the size of a compliance exposure that, as of 2 August 2026, has a law attached, and the law does not mention agencies once.

The Act places its transparency duties on the "deployer" of an AI system. For content on a website, the natural reading is the business that used AI to make the content and published it. Your client publishes. But you generated, you uploaded, you run the CMS, and in most retainers you are the only party who even knows which pages the model touched. Legally, the duty gravitates to the client. Practically, everything about it lands on you.

Why "it's the client's duty" won't keep you warm

Suppose the strict legal answer is that your client carries the duty, and suppose a client gets asked awkward questions about an unlabelled AI-generated site you built. What happens next is not a seminar on the definition of deployer. What happens is your client forwarding the letter with the subject line "???", followed by a conversation about who wrote the content, who knew it was AI-generated, and why nobody mentioned a disclosure duty that was public knowledge when the work was delivered.

Agencies survive on being the people who knew. An agency that shipped AI content without knowing about Article 50 has a professional problem regardless of where the statutory duty technically sits. And the contractual question, whether your terms of engagement quietly transferred the risk to you, or your client, or nobody, is a genuinely interesting one that neither of you wants answered by a dispute.

The asymmetry, agency edition

The two rules that matter most day-to-day, both from Article 50, translate into agency work like this.

AI-assisted text can be reviewed out of the disclosure duty entirely: the exception applies where content "has undergone a process of human review or editorial control" and "a natural or legal person holds editorial responsibility". Note "legal person": the responsible party can be a company, and the process can be run by whoever actually runs the content, which is you. Reviewed properly and recorded properly, the client's AI-drafted service pages need no label. This is a service an agency can sell, not just a risk it carries.

Images have no such exit. The generated hero images, the rendered premises, the team photo the model produced because the client never sent one: if it reads as a real photograph, it needs a visible label on the page, and no review removes that. Across a portfolio of client sites, imagery is almost always the larger and more visible exposure. Our images guide covers the detail.

What a sensible agency does now

Audit before you are asked. Know, per client site, what is AI-generated, what is AI-assisted, and what is clean, because the first client email on this subject is much nicer to answer with a spreadsheet than a promise. At portfolio scale that is a scanning job, not an afternoon job.

Decide the disclosure posture per client, with the client. Label, or review-and-sign, or replace, page by page. Put the decision in writing. The clients will not thank you for the meeting, but they will remember who raised it before it was urgent.

Make the review real. The text exception requires a process and a person with editorial responsibility. Decide who that person is for each client, agency side or client side, have them actually review, and keep a record that would satisfy a stranger. A review nobody can evidence is a review that never happened.

And fix your engagement terms going forward: who reviews AI-assisted deliverables, who holds editorial responsibility, who labels what. Three sentences in a statement of work now beats three paragraphs from a lawyer later.

Questions agencies actually ask

Our client doesn't care. Is that their choice to make? The duty is theirs to breach if they insist, but get the insistence in writing, and think about whether you want your name in the footer of the site they breached it on. Advising, documenting the advice, and proceeding on instructions is the professional pattern for a reason.

Can we, the agency, hold the editorial responsibility? The Act says a natural or legal person must hold editorial responsibility for the publication, and an agency contracted to run a client's content can credibly be that party if the engagement says so. The clean arrangement is explicit: either the client's named person signs, or yours does, and the contract records which.

Do we have to go back through sites we delivered years ago? Strictly, less than you might fear: the Commission's guidance says content published before 2 August 2026 needs no retroactive labels, and old generated imagery is likewise exempt. But the exemption covers what nobody touches, and agency retainers exist precisely because client sites get touched. Every page updated, republished or migrated after that date comes into scope as fresh publication, and a portfolio audit is how you find out which pages are genuinely dormant rather than assumed dormant.

We white-label sites for other agencies. Who is on the hook there? The same logic, one layer deeper: the publisher carries the duty, and everyone upstream carries the relationship risk. If you are two steps from the publisher, your protection is the same as at one step: know what you shipped, and put the disclosure question in the paperwork.

What do we charge for this? That is between you and your clients, but notice the shape of it: a portfolio audit, a per-site disclosure posture, an ongoing review process with records. That is not an apology; it is a service line. The rules effectively created a recurring compliance deliverable for every agency that manages content, and the agencies that productise it first will be the ones their clients tell stories about, in the good way.

Where we come in

Swornmark's Agency and Network plans exist for exactly this shape of problem: scan every client site on a schedule, get findings with drafted disclosures, have the responsible person sign off with a record, and hand each client a certificate anyone can verify. Portfolio-wide, without the spreadsheet.

If you are staring at thirty client sites and a growing sense of arithmetic, we would genuinely love a chat. We run an agency too, which is roughly how this whole product happened.

---

This guide is not legal advice. It was drafted with AI assistance and reviewed before publication. Swornmark holds editorial responsibility for it.