A regulation-aware architecture for governing AI-generated content: provenance, labeling, privacy, safety, and institutional compliance

Abstract

The rapid adoption of generative AI across multiple modalities has raised concerns about authenticity, labeling, privacy, safety, accountability, and legal compliance in AI-generated content produced within public-interest institutions, particularly in education and public administration. Although prior research has advanced techniques such as watermarking, provenance tracking, and content authentication, these solutions are often developed in isolation, leaving institutions without an integrated governance approach across the content life cycle. This paper follows a conceptual architecture design approach combining an integrative literature review with a design-science research logic. Based on this synthesis, the paper introduces a layered, regulation-aware governance framework structured around five interdependent dimensions: provenance and authenticity, labeling and disclosure, privacy and safety safeguards, accountability and compliance controls, and operational governance workflows. The framework conceptualizes synthetic-content governance as a systems-level challenge requiring coordination between technical mechanisms and institutional oversight, specifying how provenance metadata, labeling protocols, privacy-preserving controls, safety filters, audit logs, and human review processes can be operationally combined. The framework is positioned in relation to established governance instruments—including the NIST AI Risk Management Framework, the OECD AI Principles, the EU AI Act, the UNESCO Recommendation on the Ethics of Artificial Intelligence, and the General Data Protection Regulation—and its layers are mapped to concrete regulatory and standards-based obligations. Its applicability is examined through an illustrative analytical application to documented institutional incidents involving non-consensual synthetic imagery in educational settings. The paper contributes by integrating security, privacy, safety, and regulatory compliance into a unified architecture, translating regulatory expectations into implementable institutional controls, and advancing a public-interest perspective that frames AI-generated content governance as a matter of institutional risk and responsibility. The paper's contribution is thus integrative and operational: it consolidates fragmented and weakly operationalized mechanisms into a single life-cycle framework of governance functions that institutions can adapt across contexts.