AI labeling and disclosure

The term covers two layers. Visible labeling is aimed at people: a note under an image, an icon in a video, a sentence in a text. Machine-readable marking is aimed at software and platforms: metadata in the file or an invisible watermark in an image, audio or text. Both are meant to make clear that content was artificially generated or manipulated.

In the EU, Article 50 of the AI Act sets the obligations. It has applied since August 2, 2026 and assigns them by role. Providers of generative AI systems must mark their outputs in machine-readable form. Deployers, meaning organizations that use such systems under their own authority, must disclose deepfakes and certain published AI-generated text. Most companies are deployers. For providers whose systems were already on the market before August 2, 2026, amending Regulation (EU) 2026/1744 moved the marking obligation to December 2, 2026.

For executives, disclosure is a question of the approval process. Anyone publishing AI-assisted content has to be able to decide for each item whether an obligation applies, and to show who reviewed it. Under Article 99, violations of Article 50 can draw fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher; for small and medium-sized enterprises the lower amount applies (as of November 2026).

What Article 50 requires.

Article 50 contains four obligations. First, providers must design systems that interact directly with people, such as chatbots, so that people know they are dealing with AI, unless that is obvious. Second, providers of systems that generate synthetic text, images, audio or video must mark the outputs in machine-readable form and make them detectable as artificial. Assistive functions for standard editing that do not substantially alter the content are exempt. Third, deployers of emotion recognition or biometric categorization systems must inform the people exposed to them.

The fourth obligation falls on deployers of generative systems. They must disclose that a deepfake has been artificially generated or manipulated. The regulation defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to be authentic. For evidently artistic, satirical or fictional works, a notice that does not spoil the work is enough. Deployers must also disclose AI-generated or manipulated text published to inform the public on matters of public interest.

The information must be clear and distinguishable, provided no later than the first interaction or exposure, and meet accessibility requirements. Other transparency obligations under EU or national law remain explicitly unaffected.

The exception for reviewed text.

The disclosure obligation for text does not apply if the AI-generated content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication. Deepfakes have no such exception.

In its July 2026 FAQ on Article 50, the European Commission explained what counts as review: a deliberate examination of the substance by one or more people. Spell-checking or grammar correction is not enough, because it is superficial and purely formal. The Commission lists public health, environmental protection and consumer safety among matters of public interest, along with economic, financial, political, scientific and cultural developments.

A corporate blog article, a market report or a press release can fall under it. Whether ad copy or a product description does is a case-by-case question for technology lawyers.

The exception only holds up with a record of who reviewed the text for substance, when, and who is responsible for publishing it. A sign-off entry in the content management system makes that review traceable.

Deadlines and guidance, as of November 2026.

The AI Act entered into force on August 1, 2024, and Article 50 has applied since August 2, 2026. Amending Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, has been in force since July 27, 2026 and added a transition period for marking. Providers of generative systems placed on the market before August 2, 2026 must comply with Article 50(2) by December 2, 2026. The amendment did not postpone deployers’ disclosure obligations for deepfakes and text.

The voluntary Code of Practice on Transparency of AI-generated Content was published on June 10, 2026. On July 8, 2026, the Commission concluded that the code adequately covers the obligations in Article 50(2), (4) and (5). Guidelines on the transparency obligations followed on July 20, 2026, and the FAQ shortly after.

Guidelines, code and FAQ are interpretive aids. The regulation’s text is what counts, and interpretation in individual cases rests with regulators and courts. Check the current position again before changing workflows.

Watermarks and C2PA: how technical marking works.

There are two families of machine-readable marking. Metadata attaches provenance information to the file. The leading open standard is C2PA, from the Coalition for Content Provenance and Authenticity. A C2PA manifest, also called a Content Credential, describes the origin and editing history of a piece of content and can record that AI was involved. It is digitally signed with the key of the software or hardware that created it, so later changes can be detected.

Watermarks alter the content itself in ways people barely notice. In images and video they sit in the visual signal, in audio in the waveform, in text in the word choices made during generation. One example is Google DeepMind’s SynthID, which marks output from its own models across images, video, audio and text and makes it checkable through a detection portal.

Every method has weaknesses. Metadata is lost when a platform strips it on upload or someone takes a screenshot. Watermarks are designed to survive cropping and compression, but heavy editing or rewording can weaken them. The Code of Practice therefore asks signatory providers to combine at least two layers of machine-readable marking where necessary, such as metadata and watermarks, and to offer tools that let third parties check whether content is AI-generated.

Visible labeling in practice.

Deployers label for people. The Code of Practice gives guidance on how and where a notice should appear and points to a publicly available EU icon or equivalent labels. For audio-only formats, spoken disclaimers are an option.

In day-to-day work, labeling starts with an inventory: which tools generate content, and where is it published? From there, each item gets a short three-step check. Is it a deepfake, meaning a realistic image, video or audio clip that reproduces real people, objects, places or events? Then a notice is required, regardless of any review. Is it published text on a matter of public interest? Then the obligation depends on whether a person reviewed it for substance and someone holds editorial responsibility. Is a chatbot talking to customers? Then it has to be clear that it is AI. That obligation sits with the system’s provider, and a company offering a chatbot under its own name can itself be the provider.

A short record for each published item is enough: tool, type of content, reviewer, date, notice applied.

Common misconceptions.

First misconception: all AI-generated text must be labeled. The AI Act requires disclosure for published text on matters of public interest, and even there the obligation falls away if a person reviewed the text for substance and someone holds editorial responsibility. The obligation is tied to publication; internal drafts are not publications.

Second misconception: a label makes content safe. It shows origin. The C2PA documentation itself states that provenance information alone cannot tell whether content is true, accurate or factual. Anyone who publishes labeled text with false claims remains responsible for it.

Third misconception: AI detection replaces labeling. Third-party detection tools estimate after the fact whether content was machine-generated and return probabilities. A label is applied deliberately by the creator or publisher, who can document it.

Fourth misconception: this only concerns media companies. Any business that shows generated images of real people, places or objects in advertising or on social media can publish a deepfake within the meaning of the regulation, even without any intent to deceive.

Where the term stops working

AI labeling says that AI was involved, not whether the content is correct. It is distinct from AI detection, where third parties estimate after the fact whether content was machine-made, and from checking for hallucinations, which concerns accuracy. Obligations under copyright, personality rights or unfair competition law continue alongside Article 50.