If you publish realistic AI-generated images, video or audio, run an AI chatbot, or publish AI-written text on public-interest topics, part of the EU AI Act now applies to your work. The rules don't ask you to label everything AI touches. They ask you to be upfront when content could be mistaken for something real, and to know which of your tools and partners carry which duty. Most of the confusion comes from mixing up deadlines that moved with deadlines that didn't.
Transparency rules are live, even though other deadlines moved
Article 50 of the AI Act, the transparency provision, applies from 2 August 2026. The Digital Omnibus, which entered into force on 27 July 2026, did delay obligations, but for high-risk systems: rules for certain high-risk areas such as biometrics, employment and education now apply from 2 December 2027, and rules for AI embedded in regulated products from 2 August 2028. Nothing in that postponement touches the transparency layer.
The Act is risk-based, but Article 50 doesn't depend on risk classification. Its duties apply to any AI system used in the situations it covers, not just high-risk ones. A team with no high-risk AI at all can still have obligations if it runs a customer-facing chatbot, publishes realistic synthetic imagery or distributes AI-written public-interest text.
The stakes are real. Breaches of Article 50 fall in the tier of administrative fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. Enforcement sits with national market surveillance authorities, so expect approaches to differ between member states.
Preparedness looks uneven. A World Federation of Advertisers webinar poll found that only 25% of respondents said their organisation already had a clear policy and framework in place, while over 75% of brands were already using AI-generated or AI-enhanced content in marketing creative.
Start with the content and the audience, not the tool
The most useful test isn't "Did AI touch this?" It's closer to "Could someone reasonably mistake this for reality?" That framing separates routine production help from content that needs a visible disclosure.
Usually no disclosure trigger:
Drafting, tightening or translating copy that a person reviews and approves
Resizing, cropping, colour correction or light cleanup
Obviously illustrated, fantastical or physically impossible visuals
AI used internally for research, ideation and early concepts
Usually worth a closer look or a label:
A photorealistic video of a real executive saying something they never recorded
A cloned voice presented as a real spokesperson
An image of an event that never happened
A materially altered image that changes what appears to have occurred
Context moves content across that line. A surreal visual in a playful campaign is unlikely to pass as documentary evidence. The same visual presented as a real customer story carries a different risk. Practitioners writing for marketers say that when an asset sits close to the line, transparency is usually the safer choice.
Some of these calls are genuinely hard. The advertising industry's own guidance stresses that whether content counts as a deepfake often depends on a contextual, case-by-case assessment, and that the Commission's guidelines place considerable emphasis on contextual assessment and judgement. That is an argument for a documented decision process, not for blanket labelling.
The four Article 50 duties and where content teams meet them
Article 50 is four separate duties aimed at different actors. Collapsing them into one "labelling rule" leads to both over- and under-compliance.
Interacting with AI (Article 50(1)). Providers of chatbots, virtual assistants and similar systems must design them so users are told they're dealing with AI, unless that's obvious to a reasonably well-informed, observant and circumspect person. If your brand runs a shopping assistant or lead-generation bot, this is your exposure. A single line at the start of the conversation, such as "Hi, I'm [brand]'s AI assistant," covers the basic need.
Machine-readable marking (Article 50(2)). Providers of generative systems must mark synthetic audio, image, video and text outputs so they're detectable as AI-generated. This duty sits with the tool vendor, not usually with you.
Emotion recognition and biometric categorisation (Article 50(3)). Deployers must inform the people exposed. If you use AI to read sentiment or sort audiences by biometric data, this applies and GDPR considerations come with it.
Deepfakes and public-interest text (Article 50(4)). Deployers who publish deepfakes must disclose them. Deployers who publish AI-generated or manipulated text intended to inform the public on matters of public interest must disclose that too.
The last duty is where content marketers are most likely to get tripped up, and the text provision is narrower than it sounds. The trigger is the publisher's purpose in informing the public on matters of public interest, not merely the topic. The obligation falls away when the text has been through human review or editorial control and a person or organisation holds editorial responsibility. That review has to be substantive, not limited to superficial matters or cursory approval.
For ordinary marketing copy, such as product descriptions, emails and ad variants, this means most human-reviewed text doesn't need an AI label. A bank's public-facing guide to the economy is a different case: it needs real review or a label.
Deepfakes in marketing: where realistic content needs review
The Act defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The word "existing" has caused debate. A narrow reading would catch only content that replicates a specific real person. The Commission's guidelines take a broader view. As summarised by one law firm, they set three cumulative criteria:
A high level of similarity between the AI content and the subject being simulated.
The simulated subject exists, could plausibly exist, or could plausibly have existed.
The content has the potential to deceive a person about its authenticity or truthfulness, judged by context, message, deployment setting and audience expectations.
On that reading, a photorealistic synthetic performer on a concert stage can be a deepfake even if it resembles no identifiable person. Only clearly unrealistic or physically impossible content, such as unaided flying humans, falls outside.
The same analysis applies the test to typical advertising scenarios:
| Scenario | Likely treatment | Why |
|---|---|---|
| Fully AI-generated virtual model wearing a new collection | Label | Photorealistic person who doesn't exist, presented as real |
| AI "tech reviewer" in an unboxing-style video presented as an independent review | Label | Simulated authenticity is the point |
| Before-and-after photos smoothed by AI beyond the product's real effect | Label | Materially altered, presented as unretouched |
| Product photo with denser weave or glossier finish than the shipped item | Label | Altered product presented as accurate |
| Real model and product placed against an AI-generated street or stadium backdrop | Generally not a deepfake | Subject unchanged; only the background is synthetic |
| Colour and light correction, studio backdrop extension, removing a stray pedestrian | Generally not a deepfake | Adjustment without changing the substance of what's shown |
| Speaker addressing a crowd of animals | Not a deepfake | Obviously unrealistic |
This is an interpretation of the guidelines by one firm, so treat the table as a starting point for your own review rather than a ruling. Your own asset might land differently depending on how it's presented.
There is a creative-work exception. Where deepfake content forms part of an evidently artistic, creative, satirical or fictional work, the duty is reduced to disclosing the existence of the generated content in a way that doesn't hamper the display or enjoyment of the work. Don't assume an ad automatically qualifies. The same law firm notes that the guidelines indicate the carve-out does not extend to a number of common marketing and advertising use cases, including several of those in the table above.
Using a real person's likeness without consent is a separate problem. Even with a label, a realistic depiction of a real person doing or saying something they didn't do raises personality-rights and consent issues, and that includes your own CEO "speaking" in several languages.
Provider or deployer: who owns which obligation
The provider builds or places an AI system on the market. The deployer uses one under its own authority in a professional activity. A brand generating campaign imagery with a commercial tool is, in the ordinary case, a deployer.
That split matters because the two duties land differently:
Providers must embed machine-readable, detectable marking in generated outputs.
Deployers must show visible disclosure for deepfakes and covered public-interest text.
So when a vendor's tool produces an image, the technical watermark or metadata is the vendor's job, while the decision to put a visible label on your published ad is yours. Your part of the machine-readable duty is procurement: ask your AI vendors whether they add the required labelling and get the answer in writing, and check that the mark survives your editing and export chain.
Roles aren't fixed by job title. If you adapt a model or put your own brand on an AI tool, you may count as its provider and take on much heavier obligations. A white-labelled chatbot or a custom generator offered to clients is the typical trap. Get a legal read before assuming you're only a deployer.
One transition is easy to misread. Providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to implement machine-readable marking, while systems launched from 2 August onward must comply immediately. That is a short engineering grace period for specific vendors. It doesn't pause your deployer duties, which have applied since 2 August.
Make disclosure visible at the point of exposure
Information must be clear and distinguishable, meet accessibility requirements and be provided no later than the first interaction or exposure. For a chatbot, that means before or at the start of the conversation. For a clip, at the beginning. Things that won't pass: a small snippet in a website footer, a faint label on an image, a label flashing for an instant in a video, or a disclosure buried in terms and conditions.
The Code of Practice on Transparency of AI-generated Content gives the most developed picture of what good looks like. It's voluntary, but the Commission and the AI Board have confirmed it is an adequate voluntary tool for demonstrating compliance, and about 190 companies and organisations had signed by the end of July 2026. Teams that choose other methods have to show those methods are adequate, and market surveillance authorities will assess that individually. The legal obligations stand either way.
The code's published EU icons are built around an "AI" mark, with "GENERATED" or "MODIFIED" as optional additions. Commentary on the code describes these format expectations:
Static images: a clearly visible icon or label inside the image, such as the top-right corner.
Video: the icon at the start and, where possible, at regular intervals and after interruptions such as ad breaks. An audible statement alone doesn't replace a visual one where visual labelling is possible.
Audio: a short audible disclaimer at the start in plain language, repeated at suitable intervals for long-form content, with an icon added where a screen is available.
Embedding the label in the content matters because overlays may not survive downloads or screenshots. Brands don't have to use the EU icons exactly, but a consistent system of your own design and placement is the practical minimum.
A workflow for content teams and partners
You don't need to relabel your back catalogue or put legal review behind every asset. Content generated before 2 August 2026 doesn't have to be labelled retroactively, though the Commission encourages it where possible. A lightweight process does the job:
Inventory AI use. List image generation, voice cloning, synthetic presenters, face swaps, chatbots and AI-assisted public-facing copy, and note which tools and vendors are involved.
Flag realistic or materially altered assets. Mark anything photorealistic, anything depicting a real person, place or event, and anything changed beyond routine correction.
Set review and escalation criteria. Define what goes to legal or a senior reviewer, such as real-person likenesses, anything resembling news or testimonials, and text on public-interest topics.
Decide who owns the label. Agree in writing whether the brand, agency, production partner or platform identifies the need and applies the disclosure. Supply-chain ambiguity is one of the most cited practical problems, since brands, agencies and production companies often all touch campaign assets.
Record decisions. Note the tools used, what was generated or altered, who reviewed it, and which labelling method was chosen, so you can show your reasoning if challenged.
Check the published result. The duty attaches to what the audience sees, not to a file in storage. An asset can carry clean provenance metadata all the way through your library and still be published in an ad that discloses nothing. Preserve content credentials where assets arrive with them, and build the label into templates where you can.
Write it into contracts. Require vendors and agencies to confirm their marking and labelling responsibilities.
Global campaigns. Your head office location doesn't settle this. The labelling duty reaches deployers outside the EU where the output is used in the EU, for example where they publish or authorise distribution of deepfakes accessible there. Content that reaches EU audiences through unforeseeable channels outside your control is outside the obligation. A campaign built in the US and targeted at European audiences is in scope, and so is a UK business whose chatbot talks to visitors in Ireland. Your targeting settings matter more than your registered address.
Private enforcement. One law firm expects the more immediate risk in some markets to come from competitors and consumer groups rather than regulators. In Germany, it reasons, Article 50(4) is likely to be treated as a market conduct rule under unfair competition law, opening the door to warning letters and cease-and-desist actions. That is a forecast rather than settled practice, but it's a reason to keep your records tidy.
What a proportionate approach gains you, and what it costs
Benefits
You keep using AI. Drafting, resizing, translating and analysing need no label, so efficiency gains stay intact.
Fewer inconsistent calls. Written criteria mean two designers don't reach different conclusions about the same kind of asset.
Less over-labelling. Labelling everything dilutes the signal. Targeting the content that can really deceive keeps labels meaningful.
Consumer trust. Retailers, platforms and enterprise clients already ask brands whether AI was involved in an asset. Having an answer helps those conversations.
Cleaner vendor coordination. Clear ownership of marking and labelling reduces finger-pointing across the supply chain.
Costs and limits
Judgement calls remain. The deepfake test is contextual, and guidance is still new. No workflow removes uncertainty on borderline assets.
Operational overhead. Flagging, approvals and record keeping take time, especially where provenance data disappears in some editing tools.
Template and production changes. Labels need to survive export, resizing and republishing by others.
Legal review still needed. Whether a specific asset triggers a duty is a legal question, and none of this substitutes for advice from counsel.
These are operational benefits. Good governance makes it easier to show you acted reasonably, but it doesn't guarantee a particular outcome with a regulator or a court.
Frequently asked questions
Do I have to label all AI-generated marketing content?
No. The visible disclosure duty for deployers covers deepfakes and AI-generated text published to inform the public on matters of public interest. Routine assistance such as drafting, resizing and basic edits isn't the target. Machine-readable marking is a separate duty that falls on the providers of generative tools.
Did the Digital Omnibus delay the transparency rules?
No. It moved high-risk obligations to 2 December 2027 and 2 August 2028. Article 50 has applied since 2 August 2026. The only transition is a limited one for providers of generative systems already on the market, who have until 2 December 2026 to implement machine-readable marking.
Is AI-written copy covered?
Only in the narrow public-interest case. If you publish AI-generated text to inform the public on matters of public interest, you need to disclose it unless it has gone through substantive human review and someone holds editorial responsibility. Ordinary marketing copy reviewed and approved by a person generally doesn't need a label.
Is an AI-generated background a deepfake?
Generally not, when the real product and real model are unchanged. Commentary on the Commission's guidelines treats backgrounds, light and colour correction and studio backdrop extensions as unlikely to qualify. Changing the product or the person is different, and so is a fabricated scene presented as a real event.
Do I have to sign the Code of Practice?
No, it's voluntary. Signing lets you rely on its measures to demonstrate compliance. If you use other methods, you'll need to show they're adequate, and that may be assessed by different national authorities.
Does this apply if my company is outside the EU?
It can. The rules follow where the output is used. If the AI-generated content is published or distributed to audiences in the EU, deployer obligations can apply regardless of where you're based.
Who is responsible when an agency makes the content?
The Act places the deployer duty on whoever uses the AI system under its authority in a professional activity, which can be the brand, the agency or both depending on the setup. Decide this in your contracts and approval process instead of leaving it to be discovered after publication.