Lessons from Lund: why openness wins where secrecy fails

An article spanning three settings — Sweden's networked-camera maker Axis, the open drone robotics of ČVUT (Czech Technical University) led by Martin Saska, and Ukraine's frontline FPV-drone production — shows that openness, when layered correctly (public standards and SDKs, a closed hardware core holding the keys), is not a weakness but a structurally stronger answer to a hostile environment than monolithic secrecy; theoretically, Kerckhoffs's principle already underpinned this back in 1883. The author sets Axis against China's Hikvision and against the outdated 1970s Bell-LaPadula and Biba models, and reads the domestic dispute between the University of Defence (which conceals) and ČVUT (which publishes) as two halves of the same solution that fail to talk to each other. The conclusion is normative: the Czech defence industry has the expertise, the money, and its first international investors (CSG, ERA Pardubice, Primoco), but it lacks a framework — bug bounties, a Central European standard for drone interoperability, and a state-held hardware root of trust.

Three scenes that seem to have nothing to do with one another.

Lund, September 1996. At its development center, a team from the Swedish company Axis Communications completes the world's first network camera — the AXIS NetEye 200. The public launch comes a few weeks later in Atlanta at the Networld+Interop trade show. What is interesting about the product is not so much that the camera has its own IP address and web server. What is interesting is what the founders decided to do with that technology: the protocols, interfaces, and developer kit are all to be open. The expert community judges this to be commercial suicide. Martin Gren, Keith Bloodworth, and Mikael Karlsson stand their ground.

Abu Dhabi, February 2020. In the desert near the capital of the United Arab Emirates, a swarm of drones builds a wall out of bricks. They are controlled by the Multi-Robot Systems team of the Czech Technical University in Prague, led by Associate Professor Martin Saska in collaboration with universities in Pennsylvania and New York. They go home with first place in the Grand Challenge of the MBZIRC competition and a check for half a million dollars. Within a few weeks they will publish their entire system — software, algorithms, documentation — on GitHub. A military analyst would say: you handed the adversary your map. Saska handed it out and went on collecting more victories.

Donbas, spring 2024. A Ukrainian soldier in a trench launches a four-hundred-dollar Chinese FPV drone against a Russian armored personnel carrier worth millions. The drone was created by combining the open-source ArduPilot firmware, 3D printing, and frontline feedback centralized by the government platform Brave1. The Russian army, built around classic classified systems, cannot adapt to the pace of iteration.

Nut graf

These three scenes — the Swedish camera, academic robotics, and the frontline drone — share a common denominator that the Czech defense debate keeps missing. Openness in itself is not a weakness. With the right layering, it is a structurally stronger answer to a hostile environment than monolithic secrecy. Axis proved it on market results. Saska on competition wins. The Ukrainian army on the battlefield, where it survives thanks to a decision it made not out of preference, but out of necessity.

Czech defense institutions have the competence and the money. In January 2026, the CSG group completed the largest defense IPO in history on the Amsterdam Euronext; ERA Pardubice has more than one hundred sixty installations of its passive tracker in seventy countries; in 2025 Primoco UAV became the first manufacturer in the world to certify a medium-sized unmanned system under both STANAG 4703 and EASA LUC SAIL III. Only one thing is missing: a framework in which that competence would create a lasting strategic advantage. Not a laboratory, not a prototype, but an industrial architecture.

That framework exists. It was described in 1883 by the Dutch cryptographer Auguste Kerckhoffs, working in Paris. Axis translated it into industrial practice. Ukraine built it under fire under a different name. And while Europe talks about the Eurodrone and the Czechs argue about who is right — whether the University of Defence, which conceals, or CTU, which publishes — the answer has been standing in plain sight for thirty years.

Act 1: What Axis does

Axis was founded in 1984 in Lund. It started with protocol converters for IBM mainframes. Twenty-two-year-old Martin Gren was there from day one; together with Bloodworth and Karlsson he spent a decade building a company that in September 1996 launched the network camera — together with engineer Carl-Axel Alm — and in doing so predetermined the structure of today's video surveillance. In 1999 they moved from a proprietary operating system to embedded Linux. In 2008 they co-founded the ONVIF forum for standardizing network video together with Bosch Security Systems and Sony. In February 2015 they accepted an acquisition offer from Japan's Canon for 23.6 billion Swedish kronor — that is, 2.83 billion dollars, at a premium of 49.8 percent over the market price. It was the largest Swedish technology acquisition of its time.

Critics at the time expected Canon either to siphon the Lund know-how to Tokyo or to burden the company with bureaucracy. The opposite happened. Between 2015 and 2024, Axis increased its headcount from roughly 1,900 to nearly five thousand across fifty countries, opened a development center in Linköping and an office in Hong Kong. Revenues grouped under Canon's Network Cameras & Others segment (Axis plus the software vendor Milestone) reached roughly 357 billion Japanese yen in 2024, that is 2.27 billion dollars, with year-on-year growth of 12.8 percent. Investment in research and development holds at fifteen percent of revenue. For comparison: Hikvision reports around six percent, Dahua around ten.

But the key does not lie in the numbers. It lies in the way Axis architects openness.

This is not a naïve "publish everything." It is three distinct layers, each with a different policy. Standards and interfaces are fully open: ONVIF today brings together more than five hundred members and has certified more than thirty thousand conformant products, and was adopted as the international standard IEC 62676-2-3 and IEC 60839-11-31. With this, Axis relativized its own dominance — in favor of a larger, interoperable market, where it nonetheless remains the technology leader. The development kit for third-party applications is open: since 2009 the ACAP platform has allowed external developers to write applications running directly on the camera's chip, the SDK is on GitHub, and more than seven hundred global partners supply applications to the catalog. And the hardware core remains closed: the ARTPEC-9 chip from November 2024, the Edge Vault system with a hardware-anchored secure boot, a device identifier per IEEE 802.1AR set at manufacture — this is the proprietary crypto-identity that the company keeps to itself.

The result is not a compromise. It is a structurally stronger architecture. And the empirical evidence demonstrates it brutally clearly.

The negative control is Hikvision

China's Hikvision is number one on the global video surveillance market. In 2024 it reported revenue of 92.5 billion yuan, that is roughly 12.85 billion dollars. Dahua had 32.2 billion yuan, 4.5 billion dollars. Both companies sell cameras twenty to thirty-five percent cheaper than Axis.

At the same time, both became synonymous with a security catastrophe. The vulnerability CVE-2021-36260 in Hikvision cameras — unauthenticated remote code execution rated CVSS 9.8 — affected over seventy models and, by some estimates, more than a hundred million devices. Since the end of 2021 it has been actively exploited by the Moobot botnet. A researcher under the pseudonym Watchful IP then identified in Hikvision firmware prior to version 5.4.5 a so-called magic cookie — a secret string allowing administrator operations without login credentials. Community consensus labels it a backdoor, not an ordinary bug. The U.S. NDAA §889 of 2018 banned federal agencies from purchasing Hikvision and Dahua starting in 2019, and barred federal contractors from using them starting in 2020. In November 2022 the FCC banned new equipment authorizations; a U.S. court of appeals upheld this in April 2024. The United Kingdom, Scotland, and the states of Florida, Indiana, Wisconsin, and Georgia followed.

Here the record needs to be set straight. Axis does not have a clean record. In 2017 researchers from the firm Senrio discovered in 249 of its models the Devil's Ivy vulnerability — a stack buffer overflow in the gSOAP library that allowed remote code execution. The flaw lay in a third party, but the Axis firmware carried it. A year later the Israeli firm VDOO disclosed seven vulnerabilities in nearly four hundred Axis camera models; three of them together formed a chain by which an unauthenticated attacker obtained a root shell. These flaws were already in its own code. In 2025 the Team82 team of the company Claroty published four critical vulnerabilities in the Axis Camera Station Pro software rated CVSS 9.0.

These are serious incidents. After a superficial CVE count, someone might argue that Axis is comparably bad to Hikvision.

The difference is in what happened next.

For Devil's Ivy, Axis released within days a patch for all 249 models, and contacted both the gSOAP maintainer and the entire ONVIF forum. VDOO stated explicitly in its report that, to its knowledge, the vulnerabilities had not been exploited in real-world deployment — the flaws were fixed before anyone could take advantage of them. In 2025 the fixes proceeded within the standard ninety-day disclosure cycle with ample lead time. Since April 2021 Axis has operated its own CVE Numbering Authority, publishes security advisories quarterly, and since December 2022 has run a bug bounty program with rewards of up to 25,000 dollars — fourteen CVEs were identified by precisely this program. In 2025 the company signed the CISA Secure-by-Design Pledge.

For Hikvision, CVE-2021-36260 unfolded, according to community analyses, differently. The company quietly patched the vulnerability several months before the public announcement and did not publish it as a CVE. By the time Watchful IP disclosed the case, Moobot was already harvesting vulnerable devices by the hundreds of thousands. The magic cookie from the old firmware is to this day considered a backdoor by community consensus.

The openness of the process, paradoxically, makes it impossible to hide flaws. And the obligation to address them publicly is exactly what disciplines the company. Both Axis and Hikvision have flaws; Axis is professionalized by them, Hikvision is consumed by them.

The paradox that a company which publishes its interfaces, SDK, and even its own vulnerabilities holds a stronger security position than a company that conceals everything has its theoretical answer. It is 143 years old.

Act 2: Kerckhoffs, 1883

In January 1883, Auguste Kerckhoffs — a Dutch linguist working in Paris as a professor of German — published in the journal Journal des sciences militaires the article La cryptographie militaire. In it he formulated six principles of military cryptography. The second of them is to this day cited as Kerckhoffs's principle: a system must remain secure even if the adversary knows everything about it except the key. Claude Shannon reformulated this more pointedly in 1949: the enemy knows the system.

With this, Kerckhoffs overturned the entire military thinking of his time. He did not doubt the usefulness of secrecy. But he argued that what must be kept secret is the key, not the algorithm. The algorithm should be public, subjected to the criticism of the expert community, and survive it. The whole of modern cryptography — from the American AES standard competition of 1997 to 2001, through SHA-3 from 2007 to 2012, to the post-quantum standards that NIST finalized in August 2024 — is the operationalization of this idea. The algorithms DES, AES, SHA-3, and Kyber went through international public review. None of the long line of proprietary vendor ciphers, from A5/1 in GSM to CSS in DVDs, survived it.

The Lund architecture is Kerckhoffs transferred from cryptography into product design. The public algorithms became public standards and SDKs. The key became a hardware root of trust.

Why this principle is not discussed in the Czech defense debate is no mystery. The paradigm in which decisions about the security of a drone, an engine, or a communication protocol are still made was not formed in 1883. It was formed in 1977.

That was when Kenneth Biba published, as MITRE technical report MTR-3153, the model that to this day bears his name. Four years earlier, David Bell and Leonard LaPadula had published at the same MITRE a set of reports defining the Bell-LaPadula model. Both were meant to ensure multilevel security — the ability to process data ranging from Unclassified to Top Secret on a single computer without cross-contamination. Bell-LaPadula protected confidentiality: no process at a lower level may read a document higher up, and no process higher up may write down. Biba reversed the flow to protect integrity: high-integrity data must not be contaminated by low-integrity inputs.

Both models were formally elegant and verifiable by mathematical methods. They became the basis of the American Orange Book certification of 1983 and are taught in every textbook course on computer security. And in the context of 2026 they are structurally obsolete.

As early as 1987, John McLean of the Naval Research Laboratory showed that the Bell-LaPadula model has a fatal gap. He constructed System Z, a system that formally satisfies all the axioms but in practice is trivially nonsensical: at every read request it simply reclassifies the document to the requester's level and then grants access. A formally secure system; in reality a violation of every intuition about security.

System Z is not an academic toy. It is a symptom of a deeper problem. The models of the 1970s define security through permitted information flows, but they do not address economics, incentives, and dynamics. They do not account for the fact that information changes over time. They do not address covert channels through which information leaks via the timing of operations, energy consumption, or the cache behavior of a processor. Spectre and Meltdown in 2018, Rowhammer, TLBleed, and the whole array of side-channel attacks are empirical proof that a formally secure system per Bell-LaPadula can be dramatically vulnerable.

But the deepest critique is economic. The British professor Ross Anderson of Cambridge argued in 2001 that security fails primarily because of incorrectly built incentives, not because of bad mathematics. The markets in zero-day vulnerabilities, where Zerodium in 2021 paid up to 2.5 million dollars for a chain of exploits in Android, ransomware as a business model, supply-chain abuse from SolarWinds to the backdoor in XZ Utils of 2024 — none of this is thematized by Bell-LaPadula and Biba. They are not incorrect. They answer a question that is no longer the main one.

Today's question reads: how to ensure security in an environment where it is assumed that the adversary will have complete knowledge of the system, access to the supply chain, will exploit insiders, and will attack through channels that are not part of the formal architecture. Axis is built on precisely this question. And modern security engineering in general moves in precisely this paradigm — the Zero Trust Architecture codified by the American NIST in the standard SP 800-207 in 2020, capability-based systems such as the formally verified microkernel seL4 or the CHERI project from Cambridge University.

Act 3: Two Czech halves

When we return to the domestic scene with this framework, the picture changes.

The University of Defence in Brno is an institution built on the premise that what is not known cannot leak. The Faculty of Military Technology, with thirteen departments, includes the Department of Aviation Technology, the Department of Military Robotics (led by Colonel Associate Professor Jan Mazal), and the Department of Air Defence. In 2025 a student FPV squadron of the UoD was created — sixteen students under the command of Sergeant Daniel Mahdal piloting drones at speeds up to 313 kilometers per hour on a polygon at the Černá Pole barracks, which simulates the Ukrainian battlefield. In March 2026 the company U&C UAS donated three units of the STORK LR unmanned system worth over ten million crowns as an entry stake into the EUDIS Defence Hackathon Spring 2026.

All of these are legitimate activities. The problem is not the mission; the problem is the measurable output. The journal Advances in Military Technology, which the UoD publishes, has an h-index of 14 and in the 2024 volume seven articles in quartile Q4. Publication activity in the area of unmanned systems is counted in single-digit numbers of articles per year. Key staff do not have public Google Scholar profiles. Spin-offs are not possible — the legal status of an organizational unit of the Ministry of Defence rules them out. Technology transfer to industry takes place contractually with VOP CZ, Česká zbrojovka, or CSG, but without a public trace.

In the Lund architecture the UoD would be the third layer. It holds the keys, protects integrity, takes care of the core. But it plays only that one layer — without public standards, without a bug bounty program, without a developer kit that third parties would build on. It cuts itself off from peer review, academic collaboration, and from the testing in a hostile environment that would genuinely harden its systems. This is not Kerckhoffs. This is exactly the concealment of the algorithm that Kerckhoffs wrote against.

At the other end stands the Multi-Robot Systems group at the Faculty of Electrical Engineering of CTU. Around thirty researchers under the leadership of Martin Saska; the broader Center for Robotics and Autonomous Systems numbers over seventy people across faculties. Saska himself belongs, according to Google Scholar, to the international robotics elite — over five thousand citations, a level comparable to the best institutions in the field of autonomous unmanned systems. The competition record speaks clearly: three wins at MBZIRC (2017 Challenge 3, 2020 Grand Challenge, 2020 Challenge 2), second place in the virtual part of the DARPA Subterranean Challenge 2021, and sixth in the finals with real robots. On an absolute scale nothing dizzying — the DARPA SubT finals were won by team CERBERUS led by ETH Zürich with partners from Nevada, Oxford, and Norway, with a budget several times larger — but per million dollars invested, CTU has one of the best output-to-input ratios in the entire competition.

Culturally it is a light-year away from the UoD. MRS operates a public GitHub under the user ctu-mrs with dozens of repositories. The flagship system mrs_uav_system is explicitly advertised by the faculty as deployed in MBZIRC 2017 and 2020 and in DARPA SubT. A complete analysis of the competition deployment was published as a preprint on arXiv a few months after the finals.

In the Lund architecture, CTU is the first and second layers. It builds open standards, publishes developer kits, produces excellent research. But it lacks the third layer — the structured protection of the critical core that its technology would need for transfer into a combat-deployable military system. In an academic environment this is a virtue. In a real adversarial acquisition it would turn into a vulnerability: anyone could take over the code, and no one could guarantee that a component delivered to a Czech military buyer had not been modified along the way.

The UoD and CTU therefore are not settling a dispute about who is right. Each holds one half of a solution that makes sense only together. Between them there exists no interface through which those halves could communicate. And this is not a philosophical problem. It is an institutional hole.

Act 4: Ukraine as proof

If you wanted to see today the sharpest security-technology laboratory in the world, you would have to fly to Kyiv. The Ukrainian government platform Brave1, launched on 26 April 2023, today brings together over 2,300 companies and nearly five thousand registered development projects. Over two years it has handed out more than 540 grants worth two billion hryvnias. In August 2025, 22,000 FPV drones worth 24 million dollars passed through the Brave1 Market platform. By mid-2025, 95 percent of combat engagements relied on drones built on the basis of domestic specifications. Production is estimated at two million drones in 2024, with a plan of five million in 2025.

Ukraine did not arrive at this model out of theoretical preference. It arrived at it out of necessity. Classic defense acquisition — one big project, one big supplier, a multi-year development cycle, a classified specification — does not work in the Donbas. The British think tank Royal United Services Institute states in its 2025 yearbook that the technological advantage in any subcategory of drone warfare falls to zero on a scale of weeks. A defender who has a better jammer than the adversary loses it as soon as the adversary adapts. And adaptation happens faster where the process is distributed and shared than where it is unified and slow.

The Hudson Institute formulates the same thing in other words: the essence of drone warfare is not a one-off technological breakthrough, but the ability to update faster than the enemy. Brave1 is precisely this ability institutionalized. The first and second layers radically open — thousands of companies, shared specifications, real-time feedback from the front. The third layer in the form of a curatorial platform that holds the standards and controls distribution.

For Europe and for NATO a harsh lesson follows from this. The Eurodrone project, which has been in the works since 2015 with a first flight in 2025 and a planned deployment in 2028, is technologically ambitious, but structurally built on a model that would not survive the first week at Donbas tempo.

Yet the Czech defense industry has the makings that could work within such a framework. The CSG group reported consolidated revenue of four billion euros in 2024 — growth of 131 percent from 1.7 billion euros in 2023 — and an order backlog of over 11 billion euros. On 23 January 2026 it became the largest defense IPO in history on the Amsterdam Euronext; it sold investors approximately 15.2 percent of share capital for 3.8 billion euros at a market capitalization of around 25 billion. ERA Pardubice operates more than 160 installations of the VERA-NG passive ESM tracker in over seventy countries, and in 2025 delivered to the Czech Army three units of the complementary PLESS system with a range of over seven hundred kilometers. Primoco UAV reported consolidated revenue of 471 million crowns for 2024 and, as the first manufacturer in the world, obtained for its One 150 unmanned system simultaneous certification under NATO STANAG 4703 and EASA LUC SAIL III.

The technological competence is here. The framework is missing. No Czech defense supplier operates a public coordinated vulnerability disclosure program. None publishes interface specifications in a way that would create an industrial standard for Czech or Central European interoperability of unmanned assets. None has adopted the principle that Axis has operationalized for two decades and that Ukraine operationalizes under fire.

Where the truth is more complicated

A reader who moves in security engineering might now object on several counts. I recapitulate them, because no thesis survives without counterarguments.

Not everything can be published. The American NSA operates cryptographic algorithms of the Suite A category for the highest level of secrecy and has never published them. Specialized solutions for crossing between classified domains still require classic multilevel security per the Bell-LaPadula model. This argument holds, but its applicability is narrow. It concerns less than one percent of the defense IT portfolio. For the vast majority of systems — from cyber defense through drones to logistics — it holds that an open architecture with a closed core produces better results than monolithic secrecy.

A civilian product is not the same as a military one. Axis makes IP cameras for shopping centers and parking lots, not for combat deployment. In the civilian sector there is lower pressure for operational secrecy, there is no adversarial testing environment like the Ukrainian front, and the metrics are vulnerabilities and resistance to botnets, not survival under electronic jamming. This holds for some layers of the product — the firmware of the flight computer, the keys for signal jamming, the detection of GPS spoofing. But the layered framework is transferable. And Edge Vault — hardware-anchored secure boot with an identity set at manufacture — is directly applicable to military drone platforms. Brave1 is, after all, empirical proof that the same architecture works even in a clearly military environment.

The structural differences between Sweden and the Czech Republic are fundamental. Swedish R&D intensity reached 3.57 percent of GDP in 2023, the Czech 1.82 percent. The Swedish defense budget in 2024 was 2.6 percent of GDP with a plan of 3.5 percent by 2030; the Czech 2.08 percent with a plan of three percent. Sweden has institutional continuity in the research institute FOI, which has operated without interruption since 1945. The Czech defense research structure is fragmented among VZLÚ, VOP CZ, VÚ 070, UoD Brno, and CTU. This objection holds and is serious. No architectural reform can replace missing R&D intensity. But that is a reason to begin, not a reason not to begin.

Axis was absorbed by Canon. Indeed — and one can object that the Swedish state thereby lost strategic control over the most advanced European manufacturer of IP cameras. The counterargument: the headquarters, development, and management all remained in Lund, the company tripled its headcount after the acquisition, and revenues continue to grow. This is more a capital infusion than colonization. For the Czech defense ecosystem it is relevant that January's CSG IPO on the Euronext is a structurally similar model. The capital market disciplines, but the national center of decision-making remains. It is not Swedish neutrality, but neither is it a hollowing-out.

What remains valid even after all the counterarguments: openness as an architectural principle is not a luxury of free-thinking academics. It is a strategic necessity in an environment that changes faster than classic classified acquisition can keep up.

Kicker

In September 1996 the team from Lund launched a product that the military analysts of the day would have classified. They decided the opposite. Three decades on, they stand at the head of a company that, in a market with prices half the Chinese level, maintains profitability and grows.

In February 2020 Martin Saska won in Abu Dhabi a competition that military developers of the traditional schools would have lost by publishing. He published everything. A year later he won, for that, silver in the virtual part of the DARPA Subterranean Challenge against teams with budgets several times larger.

In spring 2024 a Ukrainian soldier in the Donbas launched a four-hundred-dollar drone against a million-dollar system. That disproportion is not the work of an individual's genius, but the consequence of a decision Ukraine made out of necessity. Not to bet on one big project with one big supplier. To build a platform where thousands of companies compete, share specifications, and iterate every week.

Three scenes, three decades, three environments. Civilian, academic, military. One pattern. Those who share win — while standing guard over the one thing that must be protected. The keys, the identity, the critical small area that is genuinely secret, because it is allowed to be secret.

The Czech defense community has the technical competence, the money, the first international investors. It does not have a framework. The concrete shape of that framework is not a theoretical question. A bug bounty program as a competitive criterion in public tenders. A Czech or Central European standard for the interoperability of unmanned assets inspired by the ONVIF model of 2008. A hardware root of trust that the state keeps to itself. Software layers held by the army, industry, and academia together.

Kerckhoffs wrote it in 1883. Gren built it in 1996. Saska validated it in 2020. The Ukrainian army pays for it with lives in 2026.

The Czech debate does not yet hear it.

Methodological note

The article draws on a trilogy of analytical reports prepared in April 2026: a comparison of the innovation models of the University of Defence and CTU MRS, an analysis of Axis Communications as a model of layered openness, and a theoretical synthesis on the obsolescence of the Bell-LaPadula and Biba models. The quantitative data are verified against primary sources: CSG's consolidated results from the group's official materials and Euronext press releases of 23 January 2026, the Axis data from Canon financial reports and from materials on newsroom.axis.com, the Hikvision and Dahua data from the companies' financial reports as well as from the CVE database, the Ukrainian data from Brave1 materials and from the analytical outputs of RUSI, CSIS, and the Hudson Institute. The specific Axis CVEs (Devil's Ivy 2017, the VDOO chain 2018, Team82/Claroty 2025) are verified in the NIST NVD database and in the reports of the primary researchers (Senrio, VDOO, Claroty). Kerckhoffs is cited from the original article in the Journal des sciences militaires (January/February 1883), Anderson from the lecture Why Information Security is Hard (2001).

The main limitation: causal attribution of the type "Axis wins because it publishes" is based on a strong correlation and theoretical reasoning, not on a randomized experiment. The claim about the transferability of the Lund model to Czech defense architecture is a normative recommendation — it can be verified only by implementation. The comparison of the responses of Axis and Hikvision to vulnerabilities relies on community analyses (IPVM, Watchful IP, VDOO), not on a formal DoD assessment.

The conception, structure, and editorial line of the article are the work of the author, who drew up the content sketch, established the key theses, and directed the entire creative process. Generative AI (Claude, Anthropic) was used as a tool for research, fact-checking, and elaborating the author's outline.

The author edited the outputs throughout, verified the key findings, and approved the final wording. No part of the text was published without human oversight. All factual data were verified against the publicly available sources cited in the text.

The procedure complies with the requirements of Art. 50 of EU Regulation 2024/1689 (AI Act) on the transparency of AI-generated content. #poweredByAI