The EU AI Act asks AI to identify itself. I checked 30 years of that experiment on my server.

Article 50 of the EU AI Act, effective from August 2, 2026, mandates AI system providers to mark their outputs in a machine-readable format, signaling they are artificially generated. This requirement applies to systems already on the market until December 2, 2026. The burden of proof lies with the regulated party, as the assumption is that a declaration by the party being regulated holds weight.

My analysis over the past 30 years, using a server that logs User-Agent headers, provides insight into this issue. The User-Agent header is not the focus of Article 50, but rather a common mechanism shared by both AI detection and provenance systems. By examining logs from a small service experiencing primarily machine traffic, I found that 71% of attributable traffic came from sources where the claimed vendor does not operate.

This majority consisted of two sources: a consumer broadband address sending requests as multiple AI crawlers, and a Google-owned address cycling through seven different crawler identities in a short period. In contrast, real traffic, such as requests from Anthropic and Meta, were straightforward to verify. The fix lies in refusing to treat the User-Agent header as evidence, as it is freely chosen by the sender and forgeable.

Instead, the source address should be resolved to its registered owner via RDAP, and compared against a table of who each crawler is allowed to originate from. This approach is cheap, robust, and does not require maintaining opinions about individual crawler policies. However, it acknowledges that the problem of unreliable declared signals will persist, and enforcement may shift to relying on "vibes" rather than reliable indicators.