Recording Where AI Drafted Your Documents and Customer Messages

In late October, China Briefing published a review of how China's AI rules were applied during 2026. Its central point is that new rules are only part of the picture. How regulators enforce them, how courts interpret them and how each sector applies them determine the risk businesses actually face. The review highlighted three developments. Regulators began actively enforcing requirements to label AI-generated content, the Supreme People's Court issued unified guidance on AI-related disputes, and on 18 June 2026 the National Financial Regulatory Administration released Guiding Opinions on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance Sectors, covering seven areas that run from governance structure and data governance to risk management and supervision.

Whether any of this applies to you directly depends on whether you do business in China. A medical device company selling there, or a manufacturer or logistics firm with operations there, should have counsel who practices in China review the labelling requirements against the content it produces. For readers without that exposure, the labelling enforcement still raises a question I think every regulated company should be able to answer today. When a document or message leaves your company, can you say whether AI drafted any part of it, and who approved it before it went out?

A label depends on a record

Labelling is the visible end of a record-keeping problem. To put a label on content, someone has to know at the moment of creation that AI produced it, and that fact has to survive every step between drafting and sending. The court guidance approaches the same issue from the other side. Once disputes about AI-assisted work have a settled path through the courts, I think the party that can reconstruct what the tool produced and what a person changed will be in a far stronger position than the party that can't.

In a regulated mid-market company, AI-drafted text can show up in complaint response letters, supplier correspondence, nonconformance summaries, account team emails to customers and the internal reports that feed management review. The workflows that carry those documents were mostly built before generative tools existed, so they had no reason to record where a first draft came from. They capture an author and an approver, and the author field shows whoever pasted the text in.

The hand-off is where the information drops out

I think the hardest part of this is the hand-off. A person drafts a response in a chat tool, copies it into an email or the document management system, edits it, and routes it for review. By the time the reviewer opens it, nothing distinguishes the AI-drafted paragraphs from the rest, and the reviewer approves the document as the work of the person whose name is on it. Each move from one tool to another strips away context about how the content was made.

I think most of the pain in operations comes from this kind of gap in visibility across hand-offs. When Laminar built LeaseIQ for Healthpeak Properties, the lease approval, legal document review and tenant improvement workflows it covered had been running on email, spreadsheets and phone calls. Work that runs that way makes any question about a document's history hard to answer, because the history is spread across inboxes and call notes. Moving that work into a single workflow system puts the history in one place where it can be checked.

AI involvement follows the same logic. If the drafting step happens inside a workflow that records it, the label becomes a byproduct of the record. If it happens in a browser tab, the record depends on someone remembering to mention it.

Set the rules before adding the field

The technical change here is small: a field on the document record and a workflow step that sets it. The harder decisions are about definitions. Does a grammar suggestion count? If a person rewrites most of an AI draft, is the result still AI-generated? What about a summary of a customer call that someone then quotes in a letter? I think the usual situation is a working document process with no rules for these cases, and a field nobody knows how to fill in produces a record nobody can rely on.

The answers can reasonably differ by content type. An outbound complaint response or a regulatory submission deserves stricter treatment than an internal meeting summary. Compliance and legal are the right people to set the definitions, ideally with worked examples. Operations then has to confirm the rules can be followed on a busy day, and IT has to find a place to capture them in the systems people already use.

Expect friction. Staff who already use AI tools informally may stop mentioning it if disclosure feels like an admission of cutting corners, so the rule should be presented plainly as a record of how the document was produced. Older document management systems may have no place for the metadata, and changing a validated system goes through change control, which takes time in medical device and financial services settings. Starting with the one or two content types that carry the most risk keeps that change request small.

Where to start