EU AI Act Deepfake Labelling Rules: Article 50(4) Disclosure Duties Explained

Where the Deepfake Rules Sit

The EU AI Act does not ban deepfakes. Regulation (EU) 2024/1689 instead attacks deception through transparency: Article 50 — the transparency obligations for providers and deployers of certain AI systems — requires that people are told when content has been artificially generated or manipulated. The deepfake-specific rule is Article 50(4), and it applies, with the rest of Article 50, from August 2, 2026. Breaches fall under the general penalty regime, with fines for transparency violations of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.

What Counts as a Deep Fake

Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. Each element matters. The content must be generated or manipulated by AI; conventional editing is outside the definition. It must resemble something existing — a real person's face or voice, a real place, a real event. And it must be capable of deceiving: obviously stylised or fantastical content that no one would take as real falls outside, while a photorealistic video of a politician saying words never spoken sits at the centre of the definition.

The Core Duty: Deployer Disclosure

Article 50(4) places the duty on deployers — those who use the AI system in the course of a professional activity. Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. The disclosure must be clear and distinguishable and provided at the latest at the time of first interaction or exposure, in an accessible manner. In practice this means visible labels on video, audible or written notices for audio, and captions or overlays for images, placed where the audience actually encounters the content.

Two qualifications soften the rule. Where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences, the disclosure duty does not apply. And where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligation is limited to disclosing the existence of generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work — a credits notice rather than a banner across every frame.

The Companion Rule for Text

Article 50(4) contains a second, often-overlooked limb: deployers of AI systems that generate or manipulate text published with the purpose of informing the public on matters of public interest must disclose the artificial generation or manipulation. The duty does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication — the carve-out that lets newsrooms use AI tools within a controlled editorial process without labelling every article, while catching fully automated news-like publication.

The Provider Layer Underneath

Deployer disclosure under Article 50(4) is reinforced by a provider duty one paragraph earlier. Under Article 50(2), providers of AI systems that generate synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated — watermarking, metadata and provenance technologies — to the extent technically feasible, effective and reliable given the state of the art. The two layers are complementary: machine-readable marking enables platforms and tools to detect synthetic media automatically, while deployer disclosure addresses the human audience directly. A deployer cannot rely on the provider's invisible watermark to satisfy its own visible-disclosure duty, and a provider cannot point to deployers' labels to excuse missing machine-readable marks.

Who Needs a Compliance Programme

The rule reaches far beyond malicious actors, who will ignore it anyway. Legitimate organisations squarely in scope include: marketing and advertising teams using generative video or voice cloning in campaigns featuring real people or places; media and entertainment producers using AI de-aging, voice synthesis or scene manipulation; political and advocacy organisations, where undisclosed synthetic content also intersects with other Union and national rules; corporate communications using synthetic presenters or cloned executive voices; and platforms and agencies that deploy generation tools on behalf of clients. Purely personal, non-professional use is generally outside the deployer definition, though platform terms and other laws still apply.

How Disclosure Interacts with Other Rules

Article 50(4) operates inside a wider lattice of EU rules, and compliant labelling under the AI Act does not exhaust the analysis. The Digital Services Act obliges very large online platforms to address risks from manipulated media and to provide prominent marking tools; platform policies increasingly require uploaders to declare synthetic content, with the AI Act label as the natural trigger. The GDPR governs the personal-data dimension of cloning a real person's face or voice, which generally requires a lawful basis independent of any disclosure. National rules on personality rights, image rights and unfair commercial practices continue to apply — a labelled deepfake can still be unlawful for other reasons — and election-related synthetic content attracts additional scrutiny under both Union and national instruments. The practical consequence: disclosure is necessary but rarely sufficient, and content involving real, identifiable people needs a rights clearance step alongside the label.

Deployers should also anticipate the evidence question. The duty is discharged at the moment of exposure, so screenshots of published posts, archived broadcast versions and platform metadata records are what prove compliance later. Teams that log where and how each disclosure appeared — alongside the content itself — close the gap between having complied and being able to show it.

A Concrete Example

A production agency creates a commercial for an EU client featuring a synthetic version of a deceased celebrity, licensed from the estate. The video is a deep fake — AI-generated content resembling an existing person that viewers could take as authentic footage. As deployer, the agency adds a clear on-screen notice at the start of the spot and in persistent platform captions stating that the likeness is AI-generated. Because the commercial is arguably a creative work, the agency could rely on the lighter artistic disclosure, and it documents that judgement; it chooses prominent labelling anyway, since advertising aims to be believed. The generation platform it used, as provider, embeds machine-readable provenance metadata in every export — so when the spot circulates on social platforms, their detection systems can flag the synthetic origin independently of the visible label.

Common Pitfalls

Five mistakes dominate early compliance reviews. Treating the rule as a ban — it is a disclosure duty, and lawful, labelled synthetic content remains lawful. Assuming the artistic exception erases the duty — it only lightens the disclosure, which must still exist somewhere appropriate. Confusing the provider and deployer layers, and assuming someone else's watermark covers your label. Forgetting the text limb for automated public-interest publication, which catches AI-written news summaries published without editorial responsibility. And ignoring timing: disclosure is due at first exposure, so a label buried in a description field the audience opens after watching fails the test. The cleanest implementations standardise a disclosure pattern per channel — video slate, audio notice, image caption, article byline note — and apply it automatically wherever generative output ships.

Action Plan

Before August 2, 2026, organisations using generative media should inventory every workflow that produces image, audio, video or public-interest text; classify outputs against the deep fake definition; design channel-appropriate disclosure patterns and bake them into publishing pipelines; verify that generation tools embed machine-readable marks, and contract for it; and train creative teams on when the artistic carve-out applies and who signs off on that judgement. Disclosure done well costs a caption; disclosure done late costs a regulatory file and the audience's trust at the same time.

A sensible internal rule of thumb for creative organisations: if a reasonable viewer could mistake the asset for authentic capture of a real person, place or event, label it as generated and record the decision; if the synthetic nature is self-evident, record why. The judgement takes a minute per asset once templated, builds a defensible audit trail, and spares teams the far harder conversation that begins when a journalist, a platform or a market surveillance authority finds the unlabelled version first. Organisations that already operate editorial review can usually fold the rule into existing sign-off checklists within a single sprint, which makes early adoption cheaper than any alternative.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.