The EU AI Act and automated comment moderation

Regulation (EU) 2024/1689 entered into force on 1 August 2024, but it applies in stages. It classifies AI systems by intended purpose rather than by technology: what a system does, and in what context, decides which duties attach. For a tool that pre-sorts comments under your own posts, that is good news - and not an all-clear.

This article is not legal advice. It is an attempt to make the articles that come up in every conversation about AI moderation readable, and to say which duty sits with us as the provider and which sits with you as the deployer.

The timeline

The Annex III deadlines were pushed back in 2026 as part of the Digital Omnibus. Check the current state before you write it into an internal policy - this is the part of the article that ages fastest.

The AI Act knows four tiers: prohibited practices, high-risk systems, systems carrying transparency duties, and everything else. Which tier applies does not follow from a judgement call. It follows from two lists.

Annex III enumerates the areas in which an AI system counts as high risk: critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration and border control, and the administration of justice and democratic processes. Annex I covers AI built into already regulated products as a safety component. Moderating comments under your own posts appears on neither list.

Anyone selling you a moderation tool as high-risk certified is selling you a badge for a category the product does not fall into.

The classification is not without consequences, though. The transparency duties of Article 50, the AI literacy duty of Article 4 and the whole of the GDPR apply regardless of risk class. And the line can move: if the same automation decides access to a service rather than the visibility of a comment, that is a different purpose and possibly a different class.

Article 50 is the part that touches most companies from 2 August 2026 - not because it is hard, but because almost every company uses AI somewhere in customer contact.

• Paragraph 1 - anyone operating an AI system that people interact with directly has to disclose it. The classic case is a chatbot. An automation deciding in the background, with nobody talking to it, is not what this means.
• Paragraph 2 - providers of generative systems have to mark their outputs as artificially generated in a machine-readable way, through watermarks or metadata. That is an obligation on model providers, not on you.
• Paragraph 3 - emotion recognition and biometric categorisation have to be disclosed to the people subjected to them.
• Paragraph 4 - deep fakes have to be labelled, and so does AI-generated text published to inform the public on matters of public interest - unless a human reviewed it and holds editorial responsibility.
• Paragraph 5 - the information has to be given at the first interaction at the latest, clearly and distinguishably. A note somebody only finds in the legal notice does not satisfy it.

What this means for comments under your posts

• A reply you wrote and stored yourself is not AI content - not even when an AI decided when it fits. That is exactly how Smart Reply works.
• A reply the AI phrases and you approve before sending is a human-reviewed text. That is what the exception in paragraph 4 is aimed at - and why approval in Copilot is not a convenience feature that can be switched off.
• Hiding a comment is not an interaction within the meaning of paragraph 1: nobody is talking to a system.
• Independently of that, it stays transparent if you make it transparent. One sentence in your privacy notice or your community rules saying that comments are automatically pre-screened costs nothing and answers the question before it is asked.

For high-risk systems, Article 14 requires that a person can monitor the output, interpret it correctly and intervene. Comment moderation is not a high-risk system - but the idea is the right yardstick for a product that can make something invisible. The GDPR points the same way in Article 22: a person significantly affected by a solely automated decision has the right to human intervention.

Two rules that always hold

• If the model does not answer, or answers ambiguously, the comment counts as needing review - never as cleared. An outage therefore makes your review queue longer, not your page quieter.
• Every hide is reversible. A hidden comment is not deleted: it stays with Instagram or Facebook and is no longer visible to others. One click undoes it.

Human oversight is only real oversight when it happens before the effect. An approval given afterwards is a correction.

• AI literacy under Article 4: anyone on your team working with AI tools has to understand what the tool does and where its limits are. This has applied since February 2025 and requires no certificate, only a documented briefing.
• A record of processing activities under Article 30 GDPR in which moderation appears as a purpose of its own.
• A data processing agreement under Article 28 GDPR with every tool that processes your community's comments. Without it what is missing is not a formality but the legal basis.
• One sentence in your privacy notice naming the automated pre-screening of comments - including the information that a human can intervene.
• A short note on which decisions the automation may take and which it may not. That is the documentation a supervisory authority asks for first.

The fines are in Article 99: up to EUR 35 million or 7 % of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3 % for breaches of the other obligations - including the transparency duties of Article 50.

Is automated comment moderation a high-risk system under the EU AI Act?

No. High risk is defined through the lists in Annex I and Annex III - critical infrastructure, education, employment, law enforcement and comparable areas. Moderating comments under your own posts is not on them. The transparency duties of Article 50, the AI literacy duty of Article 4 and the GDPR still apply.

Do I have to disclose that comments are screened by an AI?

Article 50(1) targets systems people interact with directly - background pre-screening does not fall under it. A note is still worth adding: one sentence in the privacy notice and in your community rules answers the question before it is asked in public. Replies the AI phrased are approved individually in Doorman anyway, which makes them human-reviewed content.

Am I a provider or a deployer under the AI Act?

As a rule, a deployer: you use a system somebody else provides. You become a provider only if you place a system on the market under your own name, or change an existing one so substantially that it becomes a different system. Configuring your own moderation rules is not such a change.

What happens when the AI gets a decision wrong?

Every hide is reversible with one click, and each decision names the rule of yours that matched. If the model is uncertain or fails, the comment is not handled automatically but lands in the review queue. Those two properties are the practical core of what Article 14 means by human oversight.

• Security, GDPR and the EU AI Act at a glance - the overview page with the data flow, the permissions and the retention windows.
• GDPR in automated comment moderation - legal bases, data minimisation and data subject rights.
• EU inference and the provider split - where each step of the processing runs.

Last reviewed: 3 September 2026. This article is revisited when deadlines or interpretations change; it is not legal advice.