At the Linux kernel Maintainers Summit on October 8, 2026 in Prague — with EU AI Act transparency duties now in force — maintainers reached consensus to deprecate the "Assisted-by" tag — the disclosure previously expected when a kernel submission included AI/LLM-generated content. A message to the Linux mailing list announced the change and removed the tag's documentation. Linus Torvalds answered critics bluntly: banning AI-generated code is "utterly stupid" — like prohibiting compilers or text editors. His test is simpler and harder: does the contributor actually understand the code? If they can't demonstrate real understanding of what it does, the tool that wrote it is irrelevant. Meanwhile the industry is split: GCC, the compiler toolchain behind Linux itself, has drawn a hard line against AI-generated code. There is no consensus — which means your project needs its own deliberate policy, not a copy of someone else's. This 60-second check tests whether yours is sane. Free, no signup.
Key figure: 45% of AI-generated code in Veracode's 2025 study shipped with a real vulnerability (Veracode, 2025 GenAI Code Security Report).
Linux dropping AI-code disclosure tags is cybersecurity news for AI governance because it sets the precedent every open-source project will follow under the EU AI Act. If the world's largest collaborative codebase says disclosure labels do not work, the policy debate shifts from labeling to provenance. The five-line sane policy below works regardless of which side wins.
AI-code disclosure is the practice of labeling which parts of a codebase were written by AI. Linux's October 2026 decision to drop disclosure tags argues labels do not scale — provenance tooling does. The sane-policy section above works regardless of which side of the debate wins.
At the Linux kernel Maintainers Summit on October 8, 2026 in Prague, maintainers reached consensus to deprecate the 'Assisted-by' tag — the disclosure previously expected when a kernel submission included AI/LLM-generated content. A message to the Linux mailing list announced the change and removed the documentation around the tag.
Responding to critics of the removal, Torvalds called banning AI-generated code 'utterly stupid,' comparing such a ban to prohibiting compilers or text editors. His position: what matters is that contributors genuinely understand the code they submit — if someone can't demonstrate real understanding of what the code does, the tool used to write it is irrelevant.
No — the industry is split. While the kernel dropped its disclosure tag, other projects reject AI-generated contributions outright. GCC, the core compiler toolchain behind Linux itself, has drawn a hard line against AI-generated code. There is no industry consensus.
Not necessarily. The kernel's decision reflects its review culture — every line gets expert human review. Most projects don't have that. Disclosure still helps reviewers calibrate scrutiny, supports vulnerability tracing, and aligns with transparency rules like the EU AI Act's AI-content disclosure obligations. The sane policy tests understanding first and keeps disclosure as a review aid.
Yes, in most cases. Deployers of AI-generated image, audio or video must disclose it as AI-generated — the Article 50(4) deployer disclosure duty has applied since 2 August 2026 — and providers must ensure AI outputs are marked so they are machine-readable and detectable.
The notice must be clear and distinguishable, and given at first exposure. Providers must mark AI-generated content so it is machine-readable and detectable, with a phase-in deadline of 2 December 2026 for systems already on the market.
Yes, it can. The Act applies to providers and deployers placing AI systems on the EU market or whose AI outputs are used in the EU, wherever the company is based. If EU users can access your AI content, check your obligations with qualified counsel.
Does AI-generated content have to be labelled under the EU AI Act?
Yes, in most cases. Deployers of AI-generated image, audio or video must disclose it as AI-generated — the Article 50(4) deployer disclosure duty has applied since 2 August 2026 — and providers must ensure AI outputs are marked so they are machine-readable and detectable.
What are the labelling requirements for AI-generated content?
The notice must be clear and distinguishable, and given at first exposure. Providers must mark AI-generated content so it is machine-readable and detectable, with a phase-in deadline of 2 December 2026 for systems already on the market.
Does the EU AI Act apply to companies outside the EU?
Yes, it can. The Act applies to providers and deployers placing AI systems on the EU market or whose AI outputs are used in the EU, wherever the company is based. If EU users can access your AI content, check your obligations with qualified counsel.
This page checked one governance debate. DisclosureGuard tracks AI disclosure duties across regulations; the Vibe-Code sweep finds what's actually in your code.