EU AI Act
AI content disclosure requirements: who must label what, and how
The EU AI Act requires human-facing disclosure of AI content in three situations. People must be told when they are interacting with an AI system rather than a human (Article 50(1)). Deployers must disclose that deepfake image, audio, or video content is artificially generated or manipulated (Article 50(4)). And AI-generated text published to inform the public on matters of public interest must be disclosed as such, unless a human reviewed it and a person or company holds editorial responsibility (also 50(4)). Every disclosure must be clear, distinguishable, accessible, and delivered no later than the first interaction or exposure (Article 50(5)). These duties apply from 2 August 2026.
This page covers the disclosure half of Article 50: who labels what, the exemptions, and what a compliant label concretely looks like in an interface. The machine-readable half (watermarks and provenance metadata, a provider duty) is covered in EU AI Act watermarking, and the whole legal frame lives on the Article 50 reference page.
Disclosure vs marking: two different obligations
Article 50 contains two content obligations that get conflated constantly, and the cost of conflating them is a compliance gap on whichever one you ignored.
| Machine-readable marking | Human-facing disclosure | |
|---|---|---|
| Legal basis | Art. 50(2) | Art. 50(1), 50(3), 50(4) |
| Who owes it | Provider (builds the system) | Deployer (uses the system); provider for chatbot design |
| Addressed to | Software: detectors, platforms, validators | People: viewers, listeners, readers, users |
| Form | Watermark, metadata, cryptographic manifest, fingerprint | Visible or audible label, notice, or caption |
| Scope | All generated audio, image, video, text | Deepfakes, public-interest text, AI interaction, emotion recognition |
| Can one satisfy the other? | No | No |
The scoping difference matters as much as the form difference: marking covers all synthetic output, while visible labeling is required only in the specific situations below. The EU legislator deliberately did not require a visible “AI” badge on every generated asset; it required the machine layer everywhere and the human layer where deception risk is concrete.
Which side of the provider/deployer line you sit on determines which duties you own; if that is unclear for your product, start with who must comply with the EU AI Act.
Duty 1: tell people they are talking to an AI (Article 50(1))
Providers must design AI systems intended to interact directly with natural persons so that those persons are informed they are interacting with an AI system, “unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use” (Article 50(1)).
Notes from practice:
- The obviousness exception is narrower than product teams want it to be. A chat widget on a support page is not self-evidently a bot to every reasonable user, especially when it has a human name and avatar. If the design invites the ambiguity, resolve it with a label.
- Voice interfaces deserve special care. On a phone call there is no screen; the disclosure must be spoken, up front.
Compliant patterns: a persistent “AI assistant” designation in the chat header rather than only in the first message (which scrolls away); an explicit spoken line at the start of an AI phone call (“You are speaking with an automated AI assistant”); avoiding human personas that contradict the label.
Duty 2: disclose deepfakes (Article 50(4), first limb)
Deployers of an AI system that generates or manipulates image, audio, or video content constituting a deepfake must “disclose that the content has been artificially generated or manipulated.” The Act defines a deepfake in Article 3(60) as AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful.
Both prongs matter. Content that resembles nothing real (a dragon over a fantasy city) is not a deepfake. Content that resembles something real but could not be mistaken for authentic (an obviously painted caricature) is not one either. A photorealistic render of a real CEO saying something they never said is the paradigm case, but so is a photoreal synthetic “street scene in Lyon” used as if it were a photograph: “events” and “places” are in the definition, not just persons.
The artistic carve-out. Where the content is part of an “evidently artistic, creative, satirical, fictional or analogous work or programme,” the duty softens: disclose the existence of generated or manipulated content “in an appropriate manner that does not hamper the display or enjoyment of the work.” End credits of a film, a programme-level notice on a satirical show, or a gallery placard can do the work that a burned-in overlay would ruin.
The law-enforcement exemption covers use authorised by law to detect, prevent, investigate, or prosecute criminal offences.
Duty 3: disclose AI-generated public-interest text (Article 50(4), second limb)
Deployers who publish AI-generated or manipulated text “with the purpose of informing the public on matters of public interest” must disclose that the text was artificially generated or manipulated. Two exemptions: law-enforcement use, and, critically for media, where “the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication.”
This is aimed at news-like publishing, not every blog post. A newsroom that uses a model to draft market summaries and publishes them after genuine editorial review, under a named editor’s responsibility, is exempt. The same summaries auto-published without review must carry the label. The exemption assumes a real review process; a pro-forma click-through by someone who reviews four hundred pieces an hour is the kind of arrangement regulators and courts will test.
Duty 4: emotion recognition and biometric categorisation (Article 50(3))
Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them about the operation of the system, and process the personal data in line with the GDPR. This duty is about systems reading people rather than content shown to people, so it sits outside content labeling programs, but it belongs on the same compliance checklist because it shares the Article 50(5) timing and clarity requirements.
How to label: the Article 50(5) bar and concrete patterns
Article 50(5) sets the delivery standard for all of the above: information must be provided “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure” and must conform to applicable accessibility requirements. Unpacked:
- At first exposure means the label cannot live only on a details page, in metadata, or after the content. A viewer who sees the deepfake sees the label.
- Clear and distinguishable means visually (or audibly) separated from the content and legible at the size and duration it is displayed.
- Accessible means usable by people with disabilities: alt text and screen-reader exposure for visual badges, captions for audio disclosures.
Label patterns that meet the bar
| Context | Pattern that works | Pattern that fails |
|---|---|---|
| Deepfake video | Overlay badge (“AI-generated”) on-screen at the start and available throughout, plus a description-line notice | A note only in the video description below the fold |
| Deepfake image in a feed | Persistent corner badge rendered by the platform, with alt-text equivalent | Watermark-only (machine-readable but invisible) |
| Synthetic voice / audio ad | Spoken or displayed notice before or at the start of playback | A disclosure at the end of the clip |
| AI phone agent | Spoken disclosure in the first sentence of the call | Disclosure only in the terms the caller never saw |
| Chatbot | ”AI assistant” designation persistent in the interface | A one-time notice in message one, or a human name and photo with no label |
| Auto-published news text | Byline-level note: “This article was generated by AI” at the top of the article | A site-wide footer statement |
| Fiction film using deepfake techniques | Credits or programme-level disclosure of the use of synthetic content | Nothing, on the theory that fiction is exempt (the carve-out still requires disclosing existence) |
The EU’s standard icons
The AI Office’s draft Code of Practice on Transparency of AI-Generated Content (first draft 17 December 2025, second draft March 2026) proposes a common EU label for AI-generated content, with an interim two-letter icon scheme localised by language (“AI”, “KI”, “IA”) until a uniform icon is finalised, and the European Commission has published voluntary transparency icons to support Article 50(4) disclosures (Jones Day’s summary of the draft code; the Commission’s Article 50 service-desk page). Adopting the common iconography when it stabilises is the cheap way to make “clear and distinguishable” uncontestable, because a label users have learned elsewhere carries meaning your custom badge has to earn.
Timing and penalties
The disclosure duties apply from 2 August 2026, and unlike the machine-readable marking duty they got no grace window from the 2026 AI Omnibus: the legacy-system relief to 2 December 2026 covers only the Article 50(2) marking mechanism (Sidley’s compliance overview). Non-compliance with Article 50 sits in the EUR 15 million or 3 percent of total worldwide annual turnover tier of Article 99(4). Timeline and penalty detail on the Article 50 reference page.
A note of honesty: this page is guidance for planning, not legal advice, and edge cases (satire, mixed human-AI workflows, borderline deepfakes) genuinely turn on facts. Get qualified EU counsel on the close calls.
Webisoft builds the disclosure layer alongside the watermarking one: label rendering tied to provenance data, so what the machine-readable manifest asserts is exactly what the user sees.
Frequently asked questions
Do I have to label every AI-generated image I publish?
Not under the AI Act. The human-facing disclosure duty in Article 50(4) covers deepfakes: AI-generated or manipulated image, audio, or video that resembles real persons, places, objects, entities, or events and would falsely appear authentic. A stylized illustration that no one would take as real is not a deepfake, though the provider's machine-readable marking duty still applies to it.
Does human editing remove the disclosure duty for AI-written articles?
For text published to inform the public on matters of public interest, disclosure is not required where the AI-generated content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for publication. A real review process, not a rubber stamp, is what the exemption assumes, and you should be able to evidence it.
Is a machine-readable watermark enough, without a visible label?
No. Watermarking under Article 50(2) and disclosure under Article 50(4) are separate obligations on separate parties. A deepfake with a perfect C2PA manifest but no visible label still breaches the deployer's disclosure duty.