The EU AI Act Explained: The Law vs the Guidelines vs the Code of Practice

If you've been reading about the EU AI Act recently, you've probably come across three different things:

They all talk about AI transparency. They all mention Article 50. And they all sound like they're telling businesses what to do.

So what's the difference?

This is probably the single biggest source of confusion we hear from businesses — but it's actually much simpler than it first appears. Let's break it down in plain English.

Imagine you're learning to drive. There are three different things involved.

First, there's the law. It says things like stop at red lights, drive under the speed limit, and wear a seatbelt. Those rules are legally binding.

Then there's the driving handbook. It explains what the law means, gives examples, and answers common questions.

Finally, your driving instructor teaches you the best way to actually drive safely every day.

The EU AI Act works in almost exactly the same way.

This is the actual law. It was passed by the European Union and creates legal obligations for organisations that develop or use certain AI systems.

For businesses using generative AI, one of the most important parts is Article 50, which contains the transparency rules. In simple terms, Article 50 says that certain AI-generated or AI-manipulated content must be disclosed so people know they are not looking at authentic content. It also contains rules for AI systems that interact with people directly, and for certain AI-generated text published on matters of public interest.

The important thing to remember: the AI Act is the law. You cannot choose whether to follow it.

The law deliberately stays quite high level — it tells you what outcome is required, not exactly how to achieve it. For example, it doesn't answer questions like where a disclosure should appear, how big it should be, whether it can be an overlay, what counts as "AI-manipulated," or what exactly qualifies as a deepfake. Those questions are answered elsewhere.

The Guidelines are written by the European Commission. They are not new laws — instead, they explain how the Commission interprets the law. Think of them as the official instruction manual.

The Guidelines answer questions like which businesses are covered, what counts as a deepfake, what "could falsely appear authentic" means, what exceptions exist, and how Article 50 should be applied in practice.

The Commission has explained that the Guidelines are intended to clarify the scope and practical application of Article 50.

Do you legally have to follow the Guidelines? Not in the same way you must follow the law. However, ignoring them is usually unwise — they explain how the regulator itself understands the law. If your business takes a completely different approach, you'll probably need to explain why your interpretation is correct if you're ever challenged.

So while the Guidelines aren't legislation, they carry significant practical weight.

This is where many people get confused. The Code of Practice is not another law — it's a practical framework that shows one recognised way of complying with Article 50. It focuses on things like marking AI-generated content, labelling deepfakes, machine-readable disclosures, accessibility, and practical implementation.

Unlike the AI Act itself, the Code contains much more operational detail.

Is the Code legally binding? No. Signing or following the Code is voluntary — but that doesn't mean it isn't important. The transparency obligations in Article 50 remain mandatory whether or not you sign the Code.

Think of it this way. The law says: you must comply. The Code says: here's one recognised way to do it.

Why would a business choose to follow the Code? Imagine two companies. Company A follows the Commission's Code of Practice — if a regulator asks how they comply, they can point to the Code and show that their processes follow a framework designed specifically for Article 50. Company B builds its own, completely different approach. That's perfectly possible, but they'll need to explain why their approach achieves the same legal outcome. Neither company is automatically right or wrong — but following the Code generally provides greater certainty and a recognised framework.

Why would someone actually sign the Code? The European Commission allows eligible organisations to become official signatories, including many providers and deployers of generative AI systems, and even certain technology providers that build marking or detection solutions. Signing the Code tells regulators "we intend to follow this recognised framework." According to the Commission, signatories benefit from greater legal certainty, a recognised compliance framework, more predictable supervision, and reduced administrative burden compared with demonstrating compliance entirely independently.

How do you sign the Code? The process is surprisingly straightforward. The European Commission asks organisations to:

Organisations can continue signing after the initial publication deadline, although those signing before the Commission's published deadline are included in the initial public list of signatories.

Can you ignore the Code? Yes — but you cannot ignore the law. If you choose not to follow the Code, you'll need to demonstrate compliance through other appropriate measures. The Commission has said that non-signatories should be prepared to explain and document how their chosen approach satisfies Article 50.

Here's the easiest way to think about it: the Law tells you what you must do, the Guidelines explain what the law means, and the Code shows one recognised way to comply.

That's it. Once you understand those three layers, the whole system becomes much easier to navigate.

People often ask us: does TickAI help me comply with the law, the Guidelines or the Code? The answer is all three — but in different ways.

TickAI helps with the law. TickAI is built to help organisations meet the transparency obligations created by Article 50 of the EU AI Act. It helps you discover potentially in-scope AI content across your website, review it, decide whether disclosure may be required, apply disclosures, and maintain an audit trail of those decisions.

Ultimately, only your organisation can decide whether a particular piece of content requires disclosure, but TickAI is designed to make that process much easier and more consistent.

TickAI reflects the Guidelines. The Commission's Guidelines explain how Article 50 should be interpreted. As those Guidelines evolve, TickAI's decision support is designed to reflect that interpretation — for example, helping answer questions like whether a type of image is in scope, whether something counts as AI manipulation, or whether an exemption applies.

TickAI aligns with the Code of Practice. The Code focuses on practical implementation, including displaying disclosures, supporting recognised labelling approaches, helping maintain records of compliance, and making disclosure easier to manage across large websites. In other words, TickAI aims to make following the Code significantly easier, whether or not your organisation chooses to become an official signatory.

If you only remember one thing, remember this:

They're not competing documents — they're three pieces of the same puzzle. Once you understand that, navigating Article 50 becomes far less intimidating.

And that's exactly why TickAI exists: to help businesses move from uncertainty to confidence by turning complex AI transparency requirements into a practical, manageable workflow.