Labelling AI-Generated Content and Deepfakes

Labelling AI generated content: what the AI Act requires

Labelling AI generated content has been a legal obligation in the EU since 2 August 2026. Article 50 of the AI Act (Regulation (EU) 2024/1689) sets out transparency obligations at two levels. Providers of AI systems that generate synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated (Article 50(2)). Deployers who use AI to create deepfakes, or to generate text published to inform the public on matters of public interest, must disclose that the content is artificial (Article 50(4)).

In addition, people must be told when they interact with an AI system such as a chatbot (Article 50(1)).

The Digital Omnibus on AI (Regulation (EU) 2026/1744) gave providers of generative systems placed on the market before 2 August 2026 a transitional period until 2 December 2026 to comply with the marking obligation. All other transparency obligations apply without a grace period. For German companies, the obligations matter in marketing, communications, customer service, media and product development.

Provider duties: machine-readable marking

Providers of generative AI systems, including general purpose AI systems, must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the type of content, implementation costs and the generally acknowledged state of the art (Article 50(2)). Typical techniques include watermarks embedded in images, audio and video, cryptographic metadata and provenance standards, and detection tools. For text, robust marking is technically more difficult, which the provision acknowledges through its feasibility qualification.

Technical options and their limits

No single technique satisfies every scenario. Visible watermarks are easy to remove by cropping; invisible watermarks embedded in pixels or audio signals survive some transformations but not all; metadata-based provenance information, such as signed content credentials, is informative but can be stripped when files are re-saved or uploaded to platforms. Providers therefore often combine several layers: an invisible watermark, signed metadata and a detection interface that allows third parties to check whether content was generated by the provider's system. Documenting why a particular combination was chosen, and how it reflects the state of the art, is the best evidence of compliance if an authority asks.

For companies that integrate third-party generative models into their own products, the question is who is the provider of the generative system. If the company places the system on the market under its own name, it is responsible for marking even if the underlying model comes from a vendor, and it should require the vendor to supply marking capabilities by contract. Labelling AI generated content then becomes part of the product specification, not a downstream marketing decision.

The obligation does not apply where the AI system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or its meaning. Spelling and grammar correction, simple image enhancement or format conversion are therefore generally not covered.

Deployer duties: deepfakes and public-interest text

A deepfake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3(60)). Deployers who generate or manipulate such content must disclose that it is artificial. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the disclosure obligation is limited to indicating the existence of generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.

Deployers who use AI to generate or manipulate text published to inform the public on matters of public interest must disclose this, unless the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication (Article 50(4)). This exception is important for publishers and corporate communications teams with an editorial process.

Typical business scenarios

Several everyday uses raise the question of disclosure. A synthetic spokesperson in an advertising video that looks like a real human is likely to be a deepfake if viewers would take it as authentic footage of a real person. AI-generated images of a product in a realistic setting can qualify if they falsely appear authentic.

Voice clones used in customer service lines combine the chatbot disclosure under Article 50(1) with the deepfake rules where a real person's voice is imitated. By contrast, clearly stylised illustrations, icons or obviously fictional scenes are not deepfakes. Labelling AI generated content in borderline cases is often the commercially safer choice, because a short notice rarely harms the message but missing disclosure can damage trust.

The information must be provided in a clear and distinguishable manner at the latest at the time of first interaction or exposure, and must meet accessibility requirements (Article 50(5)).

Labelling AI generated content in advertising and online platforms

Labelling AI generated content is not only an AI Act question. Under the German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb, UWG), advertising that creates a false impression — for example, synthetic product images that show features the product does not have, or invented customer testimonials — can be misleading under § 5 UWG, and withholding material information can be a misleading omission under § 5a UWG. AI-generated influencers and virtual brand ambassadors raise similar questions about commercial intent and authenticity. See our insights on AI washing and influencer marketing.

Very large online platforms and search engines must, as part of their risk mitigation under the Digital Services Act, ensure that generated or manipulated images, audio or video that appreciably resemble existing persons, objects, places or events and falsely appear authentic are distinguishable through prominent markings (Article 35(1)(k) DSA). Many platforms also require creators to label AI content under their terms of service, and content that is not labelled may be removed or demoted under those terms. Companies that publish on social media should therefore check both the legal rules and the platform rules.

Personality rights and deepfakes in Germany

Deepfakes that depict real people can infringe personality rights regardless of labelling. Under § 22 of the Act on Copyright in Works of Art and Photography (Kunsturhebergesetz, KUG), images of a person may in principle be disseminated only with consent, subject to the exceptions in § 23 KUG. The general right of personality protects against false attributions of statements and conduct. A label under Article 50(4) does not legitimise a deepfake that infringes these rights; it is an additional obligation.

Affected persons can claim injunctive relief and, in serious cases, damages. Synthetic voices of real persons raise comparable issues. Criminal law may also be engaged, for example by defamation offences or offences against the intimate sphere.

From 2 December 2026, the Digital Omnibus prohibits AI systems that generate or manipulate realistic intimate images, video or audio of identifiable persons without their explicit consent, as well as systems generating child sexual abuse material (Article 5(1)(ba) and (bb), as amended). These prohibitions apply to providers and deployers and are subject to the highest fines.

Codes of practice, enforcement and fines

The Commission is to encourage and facilitate the drawing up of codes of practice at Union level on the detection, marking and labelling of artificially generated or manipulated content (Article 50(7), as amended by the Digital Omnibus). Such codes can help providers and deployers to implement the obligations but, as the recitals of the Digital Omnibus note, do not by themselves grant a presumption of conformity.

Breaches of the transparency obligations in Article 50 can be fined up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher, with lower caps for SMEs (Article 99(4)(g)). In Germany, the Federal Network Agency is the main market surveillance authority under the AI Market Surveillance and Innovation Promotion Act (KI-MIG) of 22 July 2026. For providers of AI systems built on their own general purpose AI models, the AI Office may be competent. Competitors and consumer associations may also pursue misleading AI content under the UWG. See our insight on the AI Act timeline.

A compliance checklist

1. Identify where the company provides generative AI (for example in products or customer-facing tools) and where it deploys AI to create content.
2. For provided systems, implement machine-readable marking and document the technical choices; for systems placed on the market before 2 August 2026, complete this by 2 December 2026.
3. Adopt a content policy covering deepfakes, public-interest texts, editorial review and the form and placement of labels.
4. Inform users of chatbots and voice assistants that they are interacting with AI.
5. Check personality rights and consents for any depiction of real people, including employees.
6. Review advertising for misleading effects under the UWG.
7. Train communications and marketing staff and keep records.

Responsibility for these steps should be clearly allocated. In many companies, the product or IT function owns provider obligations for generative features, while marketing and communications own deployer disclosures. Legal and compliance should set the policy, review borderline cases and monitor the developing guidance from the Commission and the Federal Network Agency. Contracts with agencies that produce content for the company should require disclosure of AI use and compliance with the company's labelling policy, because the company publishing the content under its name will usually be seen as responsible for it by authorities, competitors and the public, whichever party technically operated the AI tool.

How TRW & Co helps with labelling AI generated content

We advise companies on labelling AI generated content under Article 50 AI Act, including marking solutions for generative AI products, content and editorial policies, chatbot disclosures and the interaction with unfair competition and platform rules. We also act for companies and individuals against unlawful deepfakes and misleading AI advertising. See our pages on the AI Act and digital platforms and the DSA, or contact us.