EU AI Act Article 50(4): Deepfake & AI-Generated Content Disclosure — Complete Compliance Guide 2026

1. The Legal Text — What Article 50(4) Says

"Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences. Where the content forms part of an evidently creative, satirical, artistic or fictional cinematographic or analogous work, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work." — EU AI Act, Article 50(4), first subparagraph

"Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content." — EU AI Act, Article 50(4), second subparagraph

Article 50(4) thus creates two distinct disclosure regimes: one for deepfakes (images, audio, video) and one for AI-generated text. Each has different scope, different exemptions, and different practical implications. Understanding the boundary between them is essential for compliance.

2. What Is a Deepfake — The Three Criteria

Article 3(60) provides the legal definition. A piece of content qualifies as a deepfake only when all three criteria are met simultaneously:

Applying the criteria in practice

3. Content Types Covered

Article 50(4) covers four content types, but applies different rules to each:

4. Who Must Comply — Deployer Obligation

Like Article 50(3), the disclosure obligation falls on deployers — the organisations or individuals that use an AI system to generate or manipulate content and then distribute that content. In practice, this means:

5. AI-Generated Text and the Public Interest Test

The second subparagraph of Article 50(4) creates a narrower obligation for AI-generated text than for deepfakes. Disclosure is required only when two conditions are both met:

Borderline cases

6. The Editorial Review Exemption

AI-generated text published on matters of public interest does not require disclosure if two conditions are met: (1) the content has undergone "a process of human review or editorial control," and (2) a natural or legal person "holds editorial responsibility for the publication of the content." Both must be satisfied — editorial responsibility alone, without genuine review, is not sufficient.

What constitutes genuine editorial review

The editorial responsibility requirement

The exemption requires that "a natural or legal person holds editorial responsibility for the publication." This means a named individual or organisation must accept accountability for the content's accuracy, fairness, and compliance. This is modelled on the concept of editorial responsibility in media law. A news outlet with an editor-in-chief who signs off on AI-assisted articles satisfies this requirement. An anonymous content farm that bulk-publishes AI text without any named editorial figure does not.

7. Artistic, Satirical & Creative Exemption

The deepfake disclosure obligation is modified — not eliminated — for content that forms part of an "evidently creative, satirical, artistic or fictional cinematographic or analogous work." This exemption recognises that deepfake technology has legitimate creative applications: films using de-ageing technology, satirical videos, artistic installations, and entertainment.

What the exemption changes

The exemption does not remove the disclosure obligation entirely. Instead, it limits the obligation: disclosure of the AI-generated or AI-manipulated nature must still be made, but "in an appropriate manner that does not hamper the display or enjoyment of the work." This means:

When the exemption applies

8. Disclosure Format and Technical Implementation

Article 50(4) requires disclosure to be made "at the latest at the time of first distribution or publication" in a manner that is "clear and distinguishable" and, where technically feasible, "machine-readable." The Code of Practice on AI Transparency (finalised June 10, 2026) provides operational guidance on implementation.

Dual-layer disclosure model

Best practice — and what the Code of Practice recommends — is a dual-layer approach: a human-perceptible label visible to viewers, plus machine-readable metadata embedded in the file.

C2PA integration

The Coalition for Content Provenance and Authenticity (C2PA) standard is the most mature framework for machine-readable content credentials. C2PA embeds a cryptographically signed manifest in the file that records the content's origin, creation method, and any modifications. For Article 50(4) compliance, C2PA credentials should indicate:

9. Pass/Fail Compliance Scenarios

10. Platform and Social Media Considerations

Article 50(4) places the disclosure obligation on deployers — the individuals or organisations that create and distribute the content. Platforms that host user-generated content are not directly "deployers" of the deepfakes their users upload. However, platforms have parallel obligations under the Digital Services Act (DSA) and may face indirect liability:

11. Implementation Checklist

12. Penalties

The penalties apply to each non-compliant deployment or publication. A media company that systematically publishes unlabelled deepfakes across multiple channels could face separate enforcement actions for each channel. Penalties are determined by national market surveillance authorities, taking into account the nature, gravity, and duration of the infringement, the number of persons affected, the level of damage suffered, and whether the infringement was intentional.

13. Frequently Asked Questions

Does Article 50(4) apply to AI-generated email marketing?

Generally no — email marketing copy is commercial content, not content published to inform the public on matters of public interest. The deepfake provisions could apply if the email contains AI-generated images or video that meet the three criteria (resembles reality and appears authentic), but most marketing emails would not trigger Article 50(4). However, if a company sends an AI-generated email newsletter that includes public interest content (market analysis, regulatory updates, policy commentary), the text disclosure obligation could apply.

If I use AI to translate an article into another language, is the translation AI-generated text?

Translation is a grey area. If the original article was human-written and the AI only translates it, the substantive content is human-originated. However, if the translation is published to inform the public on matters of public interest, a cautious approach would be to note that AI translation was used — particularly if the translation has not been reviewed by a human fluent in the target language. The editorial review exemption could apply if a bilingual editor verifies the translation.

What about AI-assisted code generation — is published code "text" requiring disclosure?

Software source code is not "published with the purpose of informing the public on matters of public interest" in the ordinary sense. Code published in open-source repositories, technical documentation, or developer guides is not typically covered by Article 50(4). However, if AI-generated code is included in a published article or report about public interest topics (for example, a cybersecurity analysis), the surrounding text would need to comply if it is AI-generated.

Can I rely on the provider's machine-readable marking as my disclosure?

No. Machine-readable metadata (Article 50(2) — provider obligation) and human-perceptible disclosure (Article 50(4) — deployer obligation) are complementary, not alternatives. A viewer who encounters a deepfake image on a website cannot read C2PA metadata — they need a visible label. Machine-readable marking enables detection tools and platform verification; human-perceptible disclosure informs the individual viewer.

What if I purchase stock AI-generated images from a commercial library?

If you use AI-generated stock images in a publication, you are the deployer. Apply the three deepfake criteria: if the image is a generic illustration that does not resemble any real person, place, or event, it likely does not qualify as a deepfake (criterion 2 not met). If it is a photorealistic image of a recognisable location or person, disclosure may be required. The stock library (provider) should indicate whether images are AI-generated; as a deployer, you should verify this and apply disclosure where needed.