# What is generative AI? How it works, examples, risks and rules

> Generative AI creates new text, images, audio, code and video from patterns learned in training. How the models work, what they are used for, and the risks.

- URL: https://computese.com/the-rise-of-generative-ai/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-08-18
- Updated: 2026-09-25
- Topics: AI & automation

## In short
- Generative AI produces new text, images, audio, code or video by sampling from patterns learned in training. It predicts plausible output rather than looking facts up, so a fluent answer can still be wrong.
- Large language models write one token at a time; diffusion models turn random noise into an image step by step; multimodal models handle text, images and audio in one network.
- Models are pretrained on huge datasets, then tuned on example answers and on human rankings of their answers (RLHF). That second stage is what turns a text predictor into an assistant.
- The main risks are hallucination, copyright law still being settled in court, privacy leaks, prompt injection and running cost. EU duties for general-purpose AI model providers apply since August 2, 2025.
- Start with one narrow task, an evaluation set built from real cases, and a person who reviews the output before it is sent or acted on.

Generative AI is software that creates new content, such as text, images, audio, code or video, from patterns it learned in training. A chatbot's answer or a generated picture did not exist before you asked. The model predicts what plausible output looks like rather than looking facts up, so it can be fluent and wrong.

This explainer covers what makes a model generative, how the three main families (large language models, diffusion models and multimodal models) work and are trained, the milestones from GPT-3 to the releases of September 2026, what businesses use generative AI for, its risks, the rules in the EU and elsewhere, and how an organization should start. Two related posts go further on narrower questions: [why AI matters to computer science](https://computese.com/why-ai-in-computer-science-is-important-in-today/) as a field, and [where AI's understanding falls short](https://computese.com/ai-limitations-in-understanding/).

## What makes AI generative?

Predictive AI, sometimes called discriminative AI, looks at an input and returns a label or a number: spam or not spam, a fraud score, next month's demand. Generative AI returns content. The definition in [NIST's Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) (NIST AI 600-1, July 2024) says the same thing more formally: models that emulate the structure and characteristics of their input data to generate derived synthetic content, including images, video, audio and text.

Two properties explain most of what follows:

- **The output is sampled, not retrieved.** The model generates what is likely given its training and your prompt. The same prompt can give different answers, and a confident answer can be invented.
- **The largest models are general purpose.** One model drafts an email, writes SQL and summarizes a contract, steered only by the instructions in the prompt. The EU AI Act calls these [general-purpose AI models](https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers): models that display significant generality and can competently perform a wide range of distinct tasks. The European Commission's indicative test is a model trained with more than 10²³ floating-point operations (FLOP) that can generate language, images from text or video from text.

Generative AI examples, grouped by what they produce:

| Output          | What the model does                               | Examples named in this post                 |
| --------------- | ------------------------------------------------- | ------------------------------------------- |
| Text            | Answers questions, drafts, summarizes, translates | ChatGPT, Claude, Gemini, Llama, DeepSeek-R1 |
| Code            | Suggests completions, explains and edits code     | GitHub Copilot and other coding assistants  |
| Images          | Draws a picture from a text description           | Stable Diffusion, Imagen 4                  |
| Video           | Generates a clip from text or an image            | Veo 3, which also generates the sound       |
| Audio and music | Speaks, translates speech, composes               | GPT-4o voice, Lyria 2                       |

## How does generative AI work?

Every generative model is a neural network: a very large set of adjustable numbers, called parameters or weights, that training tunes until the network's output resembles its training data. The families differ in what the network learns to predict. How such a network learns in the first place, from weights and backpropagation to embeddings, is explained in [deep learning and NLP explained](https://computese.com/the-ai-and-machine-learning-revolution/).

| Family               | What it learns to do                         | What it generates        | Example          |
| -------------------- | -------------------------------------------- | ------------------------ | ---------------- |
| Large language model | Predict the next token of text               | Text and code            | GPT-3, Llama 3.1 |
| Diffusion model      | Remove noise from an image                   | Images                   | Stable Diffusion |
| Multimodal model     | Handle text, images and audio in one network | Several kinds, per model | GPT-4o, Gemini   |

### Large language models predict the next token

A large language model (LLM) reads and writes tokens, which are words or pieces of words. For Google's Gemini models, [a token is about four characters](https://ai.google.dev/gemini-api/docs/tokens), and 100 tokens are about 60 to 80 English words. Given the tokens so far, the model scores every possible next token, picks one, appends it and repeats until the answer is complete. That is the mechanism behind [GPT-3](https://arxiv.org/abs/2005.14165), which OpenAI researchers described in May 2020 as an autoregressive language model with 175 billion parameters.

![A prompt document feeds a network box that adds one orange block to the end of a row of grey blocks; a curved arrow carries the whole row back into the box before the next block is chosen.](https://computese.com/images/blog/the-rise-of-generative-ai/next-token.e3c777d6d5-1536.webp)

*The answer is built by a loop, not looked up: every token the model writes becomes part of the input for the next one.*

Two consequences matter in practice. The model commits to each token before it knows how the sentence will end, so an early mistake is carried through to a confident conclusion. And because the next token is sampled rather than always the single most likely one, the same question can produce different answers; settings such as temperature control how much variety you get.

The network design underneath is the transformer, introduced in the 2017 paper [Attention Is All You Need](https://arxiv.org/abs/1706.03762). Its attention mechanism lets each token weigh every other token in view, which is how a model keeps track of what "it" refers to three paragraphs back. Meta, for example, describes [Llama 3.1](https://ai.meta.com/blog/meta-llama-3-1/) as a standard decoder-only transformer, and extended its context window, the amount of text the model can see at once, to 128K tokens in July 2024.

### Diffusion models turn noise into images

Stable Diffusion is a diffusion model. In training, the model sees images with increasing amounts of random noise added and learns to predict and remove that noise, the method set out in [Denoising Diffusion Probabilistic Models](https://arxiv.org/abs/2006.11239) in 2020. Generation runs the process backwards. The High Court in London described it plainly in [its 2025 judgment on Stable Diffusion](https://caselaw.nationalarchives.gov.uk/ewhc/ch/2025/2863): generation starts from a random noise image, and the trained network, conditioned by the user's prompt, removes the noise step by step until the image is consistent with the prompt. The same judgment records that the model does not store its training data; what training leaves behind is the learned weights.

![Four square frames run left to right from grey noise to a clear landscape of a mountain, sun and lake. An orange prompt document above sends dashed lines down to the filter between each pair of frames.](https://computese.com/images/blog/the-rise-of-generative-ai/denoise.f30c5f5a10-1536.webp)

*The model does not look up a stored picture: it removes noise one step at a time, and the prompt steers every step.*

The judgment also identifies Stable Diffusion as a latent diffusion model, from the [latent diffusion paper](https://arxiv.org/abs/2112.10752) first published in December 2021. Denoising runs on a compressed representation of the image instead of every pixel, which cuts the computing cost, and cross-attention layers let a text prompt steer each step. Video generation has followed: Google's [Veo 3](https://blog.google/innovation-and-ai/products/generative-media-models-io-2025/), announced on May 20, 2025, was the first Veo model to generate sound along with the picture, from street noise to dialogue.

### Multimodal models handle several kinds of data in one network

A multimodal model takes in, and often produces, more than one kind of data. Before [GPT-4o](https://openai.com/index/hello-gpt-4o/), announced on May 13, 2024, ChatGPT's voice mode chained three models (speech to text, a text model, then text to speech) and lost tone, multiple speakers and background sound along the way. OpenAI trained GPT-4o end to end across text, vision and audio, so one network processes all of them: it accepts any combination of text, audio, image and video, and outputs text, audio and images. Google's [Gemini 3 announcement](https://blog.google/products-and-platforms/products/gemini/gemini-3/) credits the first Gemini generation with native multimodality and long context, the base the later generations built on.

## How generative AI models are trained

Training happens in stages. Pretraining teaches the model language, code or images; the later stages teach it to follow instructions and to behave the way people want.

1. **Pretraining.** The model learns from a huge unlabelled dataset by predicting the next token, or by removing noise for images. The data is its own answer key, which is why this is called self-supervised learning. Meta trained [Llama 3.1 405B](https://ai.meta.com/blog/meta-llama-3-1/) on more than 15 trillion tokens, using more than 16,000 H100 GPUs. The European Commission [notes](https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers) that training a model at the AI Act's 10²⁵ FLOP threshold is estimated to cost tens of millions of euros, which is why organizations start from a pretrained model rather than training their own.
2. **Instruction tuning.** People write example prompts with good answers, and the pretrained model is fine-tuned on them (supervised fine-tuning, or SFT). This is what makes it answer a question instead of continuing your text.
3. **Reinforcement learning from human feedback (RLHF).** People rank several answers to the same prompt, a reward model learns their preferences, and the language model is tuned to score well against it. In OpenAI's [InstructGPT paper](https://arxiv.org/abs/2203.02155) (March 2022), people preferred the answers of a 1.3-billion-parameter model trained this way to those of the 175-billion-parameter GPT-3. [ChatGPT](https://openai.com/index/chatgpt/) was trained with the same method. Meta's post-training for Llama 3.1 used several rounds of supervised fine-tuning and direct preference optimization (DPO), another way to learn from ranked answers.
4. **Reasoning training.** With [OpenAI o1](https://openai.com/index/learning-to-reason-with-llms/) in September 2024, large-scale reinforcement learning began teaching models to work through a problem in a chain of thought before answering. OpenAI reported that performance kept improving with more training and with more time spent thinking. [DeepSeek-R1](https://api-docs.deepseek.com/news/news250120), released on January 20, 2025 under the MIT licence, brought the approach to an open-weights model.

One consequence of this pipeline is easy to forget: a model knows nothing that happened after its training data was collected. The first ChatGPT, for example, was fine-tuned from a GPT-3.5 model that finished training in early 2022. Current facts, and your own organization's facts, have to be supplied in the prompt, which is the job of retrieval (below).

## Generative AI timeline: key milestones from 2017 to 2026

Each date below comes from the publisher's own paper or announcement. Model names change every few months; the mechanisms above change much more slowly.

| Date               | Release                                                                                                            | Why it mattered                                                                        |
| ------------------ | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| June 2017          | [Transformer paper](https://arxiv.org/abs/1706.03762)                                                              | The network design used by language models such as Llama 3.1                           |
| May 2020           | [GPT-3 paper](https://arxiv.org/abs/2005.14165), OpenAI                                                            | A 175-billion-parameter model doing new tasks from a few examples in the prompt        |
| August 22, 2022    | [Stable Diffusion public release](https://stability.ai/news-updates/stable-diffusion-public-release), Stability AI | Image generation with openly released weights, under a licence allowing commercial use |
| November 30, 2022  | [ChatGPT](https://openai.com/index/chatgpt/), OpenAI                                                               | A free research preview of a chat model trained with RLHF                              |
| May 13, 2024       | [GPT-4o](https://openai.com/index/hello-gpt-4o/), OpenAI                                                           | One network across text, audio and images                                              |
| July 23, 2024      | [Llama 3.1 405B](https://ai.meta.com/blog/meta-llama-3-1/), Meta                                                   | An openly available model Meta compared with the leading closed models                 |
| September 12, 2024 | [OpenAI o1](https://openai.com/index/learning-to-reason-with-llms/)                                                | Reasoning models that think before they answer                                         |
| January 20, 2025   | [DeepSeek-R1](https://api-docs.deepseek.com/news/news250120), DeepSeek                                             | An open-weights reasoning model under the MIT licence                                  |
| May 20, 2025       | [Veo 3 and Imagen 4](https://blog.google/innovation-and-ai/products/generative-media-models-io-2025/), Google      | Video with generated sound, alongside a new image model                                |
| August 7, 2025     | [GPT-5](https://openai.com/index/introducing-gpt-5/), OpenAI                                                       | One system that routes each request to a fast model or a reasoning model               |
| November 18, 2025  | [Gemini 3](https://blog.google/products-and-platforms/products/gemini/gemini-3/), Google                           | The first Gemini model shipped in Google Search on launch day                          |
| September 1, 2026  | [Claude Fable 5.1 and Claude Mythos 5.1](https://www.anthropic.com/claude-fable-and-mythos-5-1), Anthropic         | One model in two versions with different safeguards; Mythos only via trusted access    |
| September 3, 2026  | [GPT-6 Astra](https://openai.com/index/gpt-6-astra/), OpenAI                                                       | OpenAI's new flagship, which it describes as state of the art at computer use          |

Read down the right-hand column and the direction is clear: from writing text, to handling images, sound and video, to reasoning, and by 2026 to operating software on a user's behalf. Open-weights releases (Stable Diffusion, Llama 3.1, DeepSeek-R1) appear throughout; they are the option for organizations that need to run a model on their own infrastructure. Our [Gemini explainer](https://computese.com/google-unveils-gemini-the-most-advanced-and-versatile-ai-model-yet/) follows one model family in more detail, and our post on [GPT-4 Turbo](https://computese.com/openai-unveils-gpt-4-turbo-the-most-powerful-ai-yet/) follows one OpenAI model from its 2023 launch to its scheduled shutdown in October 2026.

## What businesses use generative AI for

The business uses that hold up share one shape: the model drafts or finds, and a person or a rule decides what happens next.

| Use              | What the model does                                           | What a person still checks                          |
| ---------------- | ------------------------------------------------------------- | --------------------------------------------------- |
| Drafting         | First versions of emails, reports, product copy, translations | Facts, tone, anything that commits the organization |
| Summarizing      | Condenses long documents, tickets, calls and meeting notes    | That nothing important was dropped or invented      |
| Coding help      | Suggests code, writes tests, explains unfamiliar code         | Correctness and security of what it adds            |
| Customer support | Suggests replies and next steps to a human agent              | The reply that is actually sent                     |
| Internal search  | Answers questions from your own documents, with citations     | That the cited passage says what the answer claims  |

### Drafting and summarizing

Summarizing a document you supply is safer than asking a model what it knows: the source is in front of the model, and a reviewer can check the summary against it. Drafting from the model's memory is where invented facts slip in, so the first draft is where the model's job ends and an editor's begins. If the drafts are web pages, read how search engines treat them in [AI-generated content and SEO](https://computese.com/the-rise-of-ai-generated-content-in-seo/). For the drafting tools built into Gmail, Copilot and ChatGPT, and how to use them safely at work, see [what Draft AI is](https://computese.com/what-is-draft-ai-complete-guide/).

### Coding help

Coding assistants suggest completions, explain code, write tests and, as agents, make changes across many files. The evidence on productivity depends on the task. In a [2023 controlled experiment](https://arxiv.org/abs/2302.06590), developers with GitHub Copilot implemented an HTTP server in JavaScript 55.8% faster than developers without it. In a [2025 randomized trial by METR](https://arxiv.org/abs/2507.09089), 16 experienced open-source developers working on mature projects they knew well took 19% longer with early-2025 AI tools, even though they estimated afterwards that the tools had saved them 20%. The two studies measured very different work, which is the lesson: measure on your own tasks before you assume a number. Our guide to [the future role of software engineers](https://computese.com/the-future-role-of-software-engineers/) sets out every trial and what it means for the job.

### Customer support

A [study of 5,179 customer support agents](https://www.nber.org/papers/w31161) (NBER working paper, 2023) found that a generative AI assistant raised the number of issues resolved per hour by 14% on average and by 34% for novice and low-skilled agents, with minimal effect on the most experienced. The design is the point: the assistant suggests, and the agent decides what the customer receives.

### Search over internal documents with retrieval

Retrieval-augmented generation (RAG), described by [Lewis et al. in 2020](https://arxiv.org/abs/2005.11401), is the pattern behind "chat with our documents" tools. The question is first used to search your own content, the best passages are placed in the prompt, and the model answers from them, citing the passage it used.

![A laptop sends a question to a magnifying glass over a stack of documents. One orange passage travels with the question into the model, which returns an answer pinned back to that passage.](https://computese.com/images/blog/the-rise-of-generative-ai/retrieval.b1dff5ad26-1536.webp)

*Retrieval puts the right passage in front of the model when the question is asked, so the answer can cite something a person can check.*

[Microsoft's Azure AI Search documentation](https://learn.microsoft.com/en-us/azure/search/retrieval-augmented-generation-overview) lists the hard parts: understanding vague questions, reaching content spread across SharePoint, databases and storage, fitting results into a limited token budget, and making sure users and agents retrieve only content they are authorized to see. Retrieval gives the model the right facts; it does not guarantee the model uses them correctly, and it opens a new attack path (prompt injection, below). For questions over structured data, the equivalent is text-to-SQL, covered in [generative AI for databases](https://computese.com/generative-ai-for-databases/).

## How widely is generative AI used?

Adoption figures depend on who is asked.

- **Surveys of managers.** McKinsey's Global Survey on AI found in [mid-April 2023](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-in-2023-generative-ais-breakout-year) that one-third of respondents' organizations used generative AI regularly in at least one business function. [In February and March 2024](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-2024) the share was 65%.
- **The latest survey.** [McKinsey's 2026 edition](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai), fielded from May 4 to June 8, 2026 with 1,719 participants in 97 countries, reports its headline figures for AI as a whole. Nearly nine in ten respondents report regular AI use in at least one function and 44% say AI is scaling across their enterprise, but only 37% attribute any EBIT impact to it, about the same share as a year earlier.
- **Official statistics.** [Eurostat](https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Use_of_artificial_intelligence_in_enterprises) found that in 2025, 19.95% of EU enterprises with 10 or more employees used any AI technology: 8.76% used AI that generates written or spoken language or code, and 9.55% used AI that generates pictures, video or audio. Among large enterprises, 55.03% used AI.

The gap is not a contradiction. A survey of managers measures something different from a statistical survey of all enterprises, and 36% of McKinsey's 2026 respondents work for organizations with more than $1 billion in annual revenue. Read together: most large organizations now use AI, most smaller ones do not yet, and in McKinsey's data the financial impact lags behind the use.

## The risks of generative AI

[NIST's Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) lists 12 risks that generative AI creates or makes worse. The sections below cover the four that any business deployment has to handle (confabulation, intellectual property, data privacy and information security, which includes prompt injection), plus one NIST does not list: cost.

### Hallucination

Models state false things confidently. NIST calls this confabulation, and the first limitation OpenAI listed when it [launched ChatGPT](https://openai.com/index/chatgpt/) was answers that sound plausible but are incorrect. The 2025 paper [Why Language Models Hallucinate](https://arxiv.org/abs/2509.04664) argues that the causes are statistical: training and evaluation reward guessing over admitting uncertainty. The consequences land on whoever deploys the system. In [Moffatt v. Air Canada](https://decisions.civilresolutionbc.ca/crt/crtd/en/item/525448/index.do) (February 2024), British Columbia's Civil Resolution Tribunal rejected the airline's argument that it could not be held liable for its chatbot, found that it was responsible for all the information on its website, and ordered it to pay damages to a customer the chatbot had misinformed about bereavement fares. Our post on [AI limitations in understanding](https://computese.com/ai-limitations-in-understanding/) explains why fluent models fail this way.

### Copyright disputes still in court

Two questions are open: whether training on copyrighted work without a licence is lawful, and who owns what a model produces.

- **United States.** [The New York Times v. Microsoft and OpenAI](https://www.courtlistener.com/docket/68117049/the-new-york-times-company-v-microsoft-corporation/), filed on December 27, 2023 in the Southern District of New York, was still active in September 2026. The U.S. Copyright Office released a pre-publication version of its [report on generative AI training](https://www.copyright.gov/ai/) on May 9, 2025; the courts, not the Office, will decide the cases.
- **United Kingdom.** In [Getty Images v. Stability AI](https://caselaw.nationalarchives.gov.uk/ewhc/ch/2025/2863) (November 4, 2025), the High Court held that a model which does not store or reproduce the copyright works is not an "infringing copy". Getty won only a trade mark point about watermarks that the judge called historic and extremely limited, and it had abandoned its training claim because there was no evidence the training took place in the UK.
- **Outputs.** The Copyright Office [concluded in January 2025](https://www.copyright.gov/newsnet/2025/1060.html) that AI output is protected by copyright only where a human author determined sufficient expressive elements. Prompts alone are not enough.

### Privacy

Privacy risk runs in both directions. What staff paste into a prompt goes to the provider, and whether it is kept or used for training depends on that provider's terms for your plan. What a model learned can also leak: researchers [extracted hundreds of verbatim sequences](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting) from GPT-2's training data, including names, phone numbers and email addresses, simply by querying it (USENIX Security 2021). In the EU, the [European Data Protection Board said in December 2024](https://www.edpb.europa.eu/news/edpb-opinion-on-ai-models-gdpr-principles-support-responsible-ai_en) that a model trained on personal data counts as anonymous only if identifying people, or extracting their data through queries, is very unlikely, assessed case by case.

### Prompt injection

Prompt injection is to language models what SQL injection is to databases: data the system ends up treating as instructions. It is [LLM01 in OWASP's 2025 Top 10 for LLM applications](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). A direct injection comes from the user's own prompt; an indirect one hides in content the model reads, such as a web page, an email or a retrieved document, and it does not have to be visible to a human. OWASP notes that RAG and fine-tuning do not fully mitigate it.

> [!WARNING]
> Never let a model that reads untrusted content (email, web pages, uploaded files) act on its own: send messages, change records or spend money. Give it only the tools the task needs, and require a person's approval for anything that writes.

### Cost

Generative AI is billed by use, and the bill grows in ways a licence fee does not. APIs charge per million tokens, and output costs more than input. On [Google's Gemini API price list](https://ai.google.dev/gemini-api/docs/pricing) as of September 2026, Gemini 3.1 Pro Preview costs $2.00 per million input tokens and $12.00 per million output tokens for prompts up to 200,000 tokens, and the output price includes the model's thinking tokens. Agents cost more again, because every intermediate step in their loop is billed as tokens. In [McKinsey's 2026 survey](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai), about 20% of respondents said AI operating costs, including token costs, constrained their use of AI.

## Generative AI regulation: the EU AI Act and other jurisdictions

The [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), Regulation (EU) 2024/1689, entered into force on August 1, 2024 and applies in stages. The dates below come from the Act and the [Commission's timeline](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), which includes the extensions that followed the political agreement on the AI Omnibus simplification proposal.

| From             | What applies                                                                                      |
| ---------------- | ------------------------------------------------------------------------------------------------- |
| February 2, 2025 | Prohibited AI practices and AI literacy obligations                                               |
| August 2, 2025   | Obligations for providers of general-purpose AI models, and the governance rules                  |
| August 2, 2026   | The Act in general, enforcement by the AI Office and national authorities, and transparency rules |
| August 2, 2027   | Deadline for general-purpose AI models placed on the market before August 2, 2025                 |
| December 2, 2027 | High-risk AI in sensitive use cases (Annex III), as extended by the AI Omnibus                    |
| August 2, 2028   | High-risk AI embedded in regulated products (Annex I)                                             |

According to the [Commission's questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers), a provider of a general-purpose model must draw up technical documentation for downstream providers and authorities, put a copyright policy in place and publish a summary of the content used for training. The Act presumes that a model trained with more than 10²⁵ FLOP has high-impact capabilities, which makes it a model with systemic risk; its provider must also notify the Commission, evaluate and mitigate the risks, report serious incidents and secure the model. The [General-Purpose AI Code of Practice](https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai), published on July 10, 2025, is the voluntary route to showing compliance. Under [Article 101 of the Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), which applies from August 2, 2026, the Commission can fine providers of these models up to 3% of annual worldwide turnover or €15 million, whichever is higher.

If you use these models rather than build them, most of those duties sit with the provider. The rules most likely to reach a business that deploys generative AI are the transparency rules: [since August 2, 2026](https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august), chatbots must tell people they are dealing with AI, deepfakes must be labelled, and AI-generated content must carry machine-readable marks. Providers are building the marks in; Anthropic, for example, [says it watermarks text](https://www.anthropic.com/claude-fable-and-mythos-5-1) from its models released after August 2, 2026.

Elsewhere, briefly:

- **China** has regulated public generative AI services since August 15, 2023, under the [Interim Measures for the Management of Generative AI Services](https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm) issued by the Cyberspace Administration of China and six other agencies.
- **United States.** California's [SB 53](https://www.gov.ca.gov/2025/09/29/governor-newsom-signs-sb-53-advancing-californias-world-leading-artificial-intelligence-industry/), the Transparency in Frontier Artificial Intelligence Act, signed on September 29, 2025, requires large frontier developers to publish a framework describing how they apply national and international standards and industry best practices.
- **Canada.** The proposed Artificial Intelligence and Data Act, part of [Bill C-27](https://www.parl.ca/legisinfo/en/bill/44-1/c-27), was still in committee when that session of Parliament ended on January 6, 2025, so it did not become law. Personal data you send to a model is governed by existing privacy law.

> [!NOTE]
> This is a summary, not legal advice. Your obligations depend on your role (provider or deployer), where your users are and what the system decides.

## How to start using generative AI in your organization

Start with a task small enough to measure. A broad "assistant for everyone" is hard to evaluate and harder to fix.

1. **Pick one narrow, frequent task** where a draft or an answer saves time and a person already checks the result: summarizing support tickets, drafting replies from a knowledge base, pulling fields out of invoices.
2. **Decide what data may go to which model**, under which provider terms, before anyone pastes a document into a chat window.
3. **Build an evaluation set** from real cases with known good answers, including the awkward ones. [Anthropic's guidance on evaluations](https://platform.claude.com/docs/en/test-and-evaluate/develop-tests) makes the same point: test cases should mirror the real task, include edge cases and be graded automatically where possible.
4. **Prototype against that set**, with retrieval over approved sources if the task needs your facts. Record accuracy and cost per case.
5. **Keep a person in the loop** for anything that leaves the organization or changes a record, and log what the model saw and produced.
6. **Re-run the evaluation before every model, prompt or source change.** The timeline above shows how often models are replaced, and a new version can be better on average and worse on your task.

> [!TIP]
> If a feature you already license, such as the assistant built into your office suite, does the job, use it. Build only what it cannot do.

If you want help choosing and testing a first use case, our [AI and automation service](https://computese.com/services/ai-automation/) starts with one real workflow, reviewed with the people who run it, before anything is built, and every model, prompt or source change must answer the same set of real questions before it ships. For building AI into a product rather than a workflow, see [intelligent apps](https://computese.com/artificial-intelligence-and-intelligent-apps/).

## Key terms
- **Generative AI**: AI models that produce new content, such as text, images, audio, code or video, that resembles the data they were trained on, instead of returning only a label or a score.
- **Large language model (LLM)**: A neural network, usually a transformer, trained on large amounts of text to predict the next token. Chat assistants such as ChatGPT, Claude and Gemini are built on LLMs.
- **Token**: The unit a language model reads and writes: a word or a piece of one. For Gemini models Google puts it at about four characters. Context limits and API prices are counted in tokens.
- **Diffusion model**: A model that learns to remove noise from images, then generates a new image by starting from pure noise and removing it step by step, steered by a prompt. Stable Diffusion is one.
- **Multimodal model**: A model that takes in, and often produces, more than one kind of data, such as text, images, audio and video, within a single network.
- **Pretraining**: The first training stage, in which a model learns from a huge unlabelled dataset by predicting the next token or removing noise, before any tuning for a task.
- **RLHF (reinforcement learning from human feedback)**: A tuning stage in which people rank a model's answers, a reward model learns those preferences, and the model is trained to produce answers that score well against it.
- **Hallucination (confabulation)**: Output that is fluent and confident but false or unsupported, such as an invented fact, policy or citation. NIST's term for it is confabulation.
- **Retrieval-augmented generation (RAG)**: A design in which an application searches approved sources when a question is asked and passes the relevant passages to the model, so the answer can be drawn from them and checked.
- **Prompt injection**: Input that changes a model's behaviour in ways its developers did not intend, either typed by a user or hidden in a web page, email or file the model reads.

## Common questions

### What is the difference between generative AI and traditional AI?

Traditional, predictive AI returns a label or a number, such as a fraud score or a demand forecast. Generative AI returns new content: text, images, audio, code or video. The largest generative models are also general purpose, so one model can handle many tasks from instructions in the prompt.

### What are some examples of generative AI?

Chat assistants such as ChatGPT, Claude and Gemini write and summarize text; coding assistants such as GitHub Copilot suggest code; Stable Diffusion and Imagen generate images; Veo generates video with sound; and Lyria generates music. In business, the common uses are drafting, summarizing, coding help, customer support and search over internal documents.

### How is generative AI trained?

First by pretraining on a very large dataset, where the model learns to predict the next token of text or to remove noise from images. Then by instruction tuning on example answers and by learning from human rankings of its answers, through RLHF or DPO. Reasoning models add reinforcement learning on step-by-step problem solving.

### Why does generative AI make things up?

Because it generates a plausible continuation, not a checked fact, and research published in 2025 argues that training and benchmarks reward guessing over admitting uncertainty. Answering from your own documents with retrieval, asking for citations and having a person review anything consequential reduce the risk; none of them removes it.

### Who owns content created with generative AI?

It depends on the country, and parts of it are still in court. The US Copyright Office's position since January 2025 is that AI output is protected only where a human author determined sufficient expressive elements, and prompts alone do not qualify. Cases about training on copyrighted work, such as The New York Times against Microsoft and OpenAI, were still open in September 2026.

### Is generative AI regulated?

In the EU, yes: the AI Act's obligations for providers of general-purpose AI models apply since August 2, 2025, and its transparency rules for chatbots, deepfakes and AI-generated content since August 2, 2026. China has had rules for public generative AI services since August 15, 2023. Elsewhere too, existing privacy, consumer protection and copyright law already applies to how you use it.

## Sources
1. [Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf), NIST
2. [General-Purpose AI Models in the AI Act: Questions & Answers](https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers), European Commission
3. [Understand and count tokens](https://ai.google.dev/gemini-api/docs/tokens), Google AI for Developers
4. [Language Models are Few-Shot Learners (GPT-3)](https://arxiv.org/abs/2005.14165), arXiv
5. [Attention Is All You Need](https://arxiv.org/abs/1706.03762), arXiv
6. [Introducing Llama 3.1: Our most capable models to date](https://ai.meta.com/blog/meta-llama-3-1/), Meta AI
7. [Denoising Diffusion Probabilistic Models](https://arxiv.org/abs/2006.11239), arXiv
8. [Getty Images (US) Inc & Ors v Stability AI Limited [2025] EWHC 2863 (Ch)](https://caselaw.nationalarchives.gov.uk/ewhc/ch/2025/2863), High Court of England and Wales (The National Archives)
9. [High-Resolution Image Synthesis with Latent Diffusion Models](https://arxiv.org/abs/2112.10752), arXiv
10. [Fuel your creativity with new generative media models and tools](https://blog.google/innovation-and-ai/products/generative-media-models-io-2025/), Google
11. [Hello GPT-4o](https://openai.com/index/hello-gpt-4o/), OpenAI
12. [A new era of intelligence with Gemini 3](https://blog.google/products-and-platforms/products/gemini/gemini-3/), Google
13. [Training language models to follow instructions with human feedback (InstructGPT)](https://arxiv.org/abs/2203.02155), arXiv
14. [Introducing ChatGPT](https://openai.com/index/chatgpt/), OpenAI
15. [Learning to reason with LLMs](https://openai.com/index/learning-to-reason-with-llms/), OpenAI
16. [DeepSeek-R1 Release](https://api-docs.deepseek.com/news/news250120), DeepSeek
17. [Stable Diffusion Public Release](https://stability.ai/news-updates/stable-diffusion-public-release), Stability AI
18. [Introducing GPT-5](https://openai.com/index/introducing-gpt-5/), OpenAI
19. [Introducing Claude Fable 5.1 and Claude Mythos 5.1](https://www.anthropic.com/claude-fable-and-mythos-5-1), Anthropic
20. [GPT-6 Astra: A new generation of intelligence](https://openai.com/index/gpt-6-astra/), OpenAI
21. [The Impact of AI on Developer Productivity: Evidence from GitHub Copilot](https://arxiv.org/abs/2302.06590), arXiv
22. [Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity](https://arxiv.org/abs/2507.09089), METR (arXiv)
23. [Generative AI at Work (Working Paper 31161)](https://www.nber.org/papers/w31161), National Bureau of Economic Research
24. [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://arxiv.org/abs/2005.11401), arXiv
25. [Retrieval-augmented generation (RAG) in Azure AI Search](https://learn.microsoft.com/en-us/azure/search/retrieval-augmented-generation-overview), Microsoft Learn
26. [The state of AI in 2023: Generative AI's breakout year](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-in-2023-generative-ais-breakout-year), McKinsey & Company
27. [The state of AI in early 2024: Gen AI adoption spikes and starts to generate value](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-2024), McKinsey & Company
28. [The state of AI in 2026: On the road to ROI](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai), McKinsey & Company
29. [Use of artificial intelligence in enterprises](https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Use_of_artificial_intelligence_in_enterprises), Eurostat
30. [Why Language Models Hallucinate](https://arxiv.org/abs/2509.04664), arXiv
31. [Moffatt v. Air Canada, 2024 BCCRT 149](https://decisions.civilresolutionbc.ca/crt/crtd/en/item/525448/index.do), Civil Resolution Tribunal of British Columbia
32. [The New York Times Company v. Microsoft Corporation, 1:23-cv-11195 (S.D.N.Y.), docket](https://www.courtlistener.com/docket/68117049/the-new-york-times-company-v-microsoft-corporation/), CourtListener (Free Law Project)
33. [Copyright and Artificial Intelligence](https://www.copyright.gov/ai/), U.S. Copyright Office
34. [Copyright Office Releases Part 2 of Artificial Intelligence Report](https://www.copyright.gov/newsnet/2025/1060.html), U.S. Copyright Office
35. [Extracting Training Data from Large Language Models](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting), USENIX Security 2021
36. [EDPB opinion on AI models: GDPR principles support responsible AI](https://www.edpb.europa.eu/news/edpb-opinion-on-ai-models-gdpr-principles-support-responsible-ai_en), European Data Protection Board
37. [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), OWASP Gen AI Security Project
38. [Gemini Developer API pricing](https://ai.google.dev/gemini-api/docs/pricing), Google AI for Developers
39. [Regulation (EU) 2024/1689 (Artificial Intelligence Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), EUR-Lex
40. [AI Act: regulatory framework for AI](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), European Commission
41. [The General-Purpose AI Code of Practice](https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai), European Commission
42. [Commission starts enforcing AI Act rules and new transparency requirements on 2 August](https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august), European Commission
43. [Interim Measures for the Management of Generative Artificial Intelligence Services](https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm), Cyberspace Administration of China
44. [Governor Newsom signs SB 53, advancing California's world-leading artificial intelligence industry](https://www.gov.ca.gov/2025/09/29/governor-newsom-signs-sb-53-advancing-californias-world-leading-artificial-intelligence-industry/), Office of the Governor of California
45. [C-27 (44th Parliament, 1st session): Digital Charter Implementation Act, 2022](https://www.parl.ca/legisinfo/en/bill/44-1/c-27), Parliament of Canada (LEGISinfo)
46. [Define success criteria and build evaluations](https://platform.claude.com/docs/en/test-and-evaluate/develop-tests), Anthropic (Claude Platform Docs)