Translation, transcription and content services

• Regulation (EU) 2016/679 — GDPR, Article 27
• Regulation (EU) 2024/1689 — AI Act transparency and deepfake disclosure
• Directive (EU) 2019/790 — copyright and text and data mining
• Regulation (EU) 2022/2065 — DSA where user content is hosted

Who has to appoint one

Providers outside the Union offering translation, transcription or synthetic media services to customers in the EU. Audio and video submitted for processing routinely contains personal data and sometimes special-category data, and voice cloning raises identity questions beyond data protection.

Thresholds and exemptions

No threshold. Synthetic content obligations under the AI Act apply to providers of generative systems regardless of size.

What must appear on the label

Not physical. The representative in the privacy notice, disclosure that content is AI-generated or manipulated where the AI Act requires it, and machine-readable marking of synthetic output.

Marketplace fields

Enterprise buyers require processing terms and confidentiality guarantees, and public sector customers frequently exclude vendors that reuse submitted content for training. Rights holders scrutinise text and data mining reservations.

Documentation you must hold

Article 30 records, Article 28 terms, the Article 27 designation, retention rules for submitted files and outputs, the transfer mechanism, and where generative models are involved, the copyright policy and the summary of training content required for general-purpose models.

Standards and testing

Not applicable, though the marking of synthetic output must actually work: watermarking claims that do not survive ordinary editing have been criticised.

Language requirements

Notices in the language of the users, which is intrinsic to this sector.

When it applies

The representative before processing begins. AI Act transparency obligations for synthetic content apply from 2 August 2026, with general-purpose model obligations already applicable since August 2025.

How long records are kept

Submitted content only for the period contracted, with deletion on completion unless retention is separately agreed. Retaining client audio for model training without a basis is the standard failure.

What happens if you do not comply

Up to €20 million or 4% of turnover under the GDPR, and up to €15 million or 3% under the AI Act. Voice cloning without consent additionally engages personality rights, which are protected nationally and can be enforced by injunction faster than any regulator acts.

Who enforces it

Data protection authorities, AI Act market surveillance authorities from 2026, and national courts for personality and copyright claims.

Where the boundary lies

Voice and likeness are protected by national personality rights that exist alongside the GDPR, so consent from the speaker is needed even where a data protection basis could be argued. Text and data mining for training is permitted only where rights holders have not reserved their rights, and many now do so machine-readably.

Questions we are asked

Can we use client files to improve our models?

Only with a separate basis and transparency to the individuals in the recordings, and usually only with the client's contractual permission as well.

Do we have to label AI-generated audio?

From August 2026 providers must mark synthetic content in a machine-readable format, and deployers must disclose deepfakes.