AI-Generated Content Labelling Under the EU AI Act

The proliferation of AI-generated content — from synthetic images and audio to AI-drafted articles and code — has driven one of the EU AI Act's more pragmatic interventions: a layered labelling regime that aims to preserve the integrity of the information environment without prohibiting AI generation outright.

This article walks through the labelling requirements step by step: what counts as AI-generated content, what marking and disclosure are required, who is responsible for each, and how compliant implementations work in practice.

The Two Layers of Article 50

Article 50 imposes labelling obligations on AI-generated content in two distinct paragraphs that operate independently. Article 50 sits in Chapter IV, which is not covered by any of the derogations in Article 113, so these obligations have applied since the Regulation's general application date of 2 August 2026 and are live now. Regulation (EU) 2026/1744 ("Digital Omnibus on AI") deferred parts of the Chapter III high-risk regime, but left Article 50 untouched.

Article 50(2) — Provider Machine-Readable Marking

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.

This applies to the provider of the AI system — the entity that places the generation tool on the market under its own name or trademark. It is a machine-readable mark — meant to be detected by automated tools, not necessarily visible to humans. And it applies to audio, image, video, and text content (all four modalities).

Article 50(4) — Deployer User-Facing Disclosure

Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. […] Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated.

This applies to the deployer — the entity using the AI to generate or publish content. It is a user-facing disclosure — visible or perceivable to humans. And it applies specifically to deepfakes (image, audio, video content meeting the Article 3(60) definition) and to AI-generated text used in public-interest communications.

The two layers are complementary. The Article 50(2) machine mark enables platforms, fact-checkers, and downstream consumers to detect AI generation automatically. The Article 50(4) disclosure ensures individual users see explicit labelling at the point of consumption.

What Counts as "AI-Generated or Manipulated Content"

The scope of Article 50(2) is broad: any synthetic audio, image, video, or text content generated by an AI system. This includes:

• Fully synthetic images from text-to-image models (Midjourney, Stable Diffusion, DALL-E, etc.)
• AI-generated audio (voice synthesis, music generation, sound effects)
• AI-generated video (text-to-video, video synthesis)
• AI-generated text (LLM outputs)
• AI-manipulated content (real images modified by AI tools, AI-cleaned audio, AI-edited video)

It does not include:

• Standard photo editing (cropping, exposure adjustment, basic colour correction) that does not involve AI generation
• Algorithmic processing that does not involve generative AI (e.g., spell-check, traditional image compression)
• Content with only minor AI assistance (e.g., AI-suggested edits that a human accepts or rejects manually)

The line between "AI-assisted" and "AI-generated" is fact-specific. A text where a human writes the substance and uses AI for proofreading is generally not AI-generated. A text where AI drafts the substance and a human reviews lightly is generally AI-generated. Article 50(2) itself carves part of this out: the marking obligation "shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof". Recital 133 explains the rationale, noting that the limit is needed for the obligation "to remain proportionate". A separate carve-out — for content that has undergone "a process of human review or editorial control" where a natural or legal person holds editorial responsibility — applies only to the deployer's Article 50(4) text-disclosure duty, not to the provider's Article 50(2) marking duty.

What Counts as a Deepfake

Article 3(60) defines a deepfake narrowly:

AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.

Three elements:

1. AI-generated or AI-manipulated
2. Resembles existing persons, objects, places, entities, or events — Recital 134 glosses this as content that "appreciably resembles" them
3. Would falsely appear to be authentic or truthful

This is narrower than "any AI-generated image." A stylised cartoon image generated by AI is not a deepfake (it does not appear authentic). A photorealistic image of a wholly invented person sits at the edge of the definition: Article 3(60) requires resemblance to existing persons, objects, places, entities or events, so an invented face alone does not obviously qualify — though a realistic scene built around it may resemble existing objects, places or events and bring the image within scope. A realistic-looking video of a real political figure giving a speech they never gave is the paradigm case.

Provider Implementation: Machine-Readable Marking

For providers of generation tools, Article 50(2) compliance requires implementing a machine-readable mark on every output. Several approaches are now standard:

C2PA Content Credentials

The Coalition for Content Provenance and Authenticity (C2PA) has developed an open technical standard for cryptographic content provenance metadata. C2PA-compliant tools attach signed metadata to image, video, audio, and document outputs, indicating:

• The tool that created or modified the content
• The provenance chain of edits
• The signing entity's identity (via certificate)

C2PA is widely adopted by major AI image-generation tools, Adobe products, news organisations, and camera manufacturers. It provides cryptographic verifiability and tamper-evidence.

Cryptographic Watermarks

Robust watermarking techniques embed imperceptible patterns into AI-generated content that survive common transformations (compression, cropping, format conversion). Modern approaches include:

• SynthID (Google DeepMind) for images, audio, video, and text
• Stable Signature for image diffusion models
• Voice watermarks integrated into text-to-speech systems
• Token-distribution watermarks for LLM outputs

Watermarks are more robust than metadata (which can be stripped on save) but harder to verify by third parties without access to the watermark detector.

Detector Models

Provider-trained classifiers that detect content generated by a specific model. Less robust than watermarks (detection accuracy decreases with content transformations and against adversarial inputs) but easier to deploy retroactively.

Metadata Tags

Standard formats like EXIF, XMP, and ID3 can carry "AI-generated" flags. These are easy to implement but easy to strip; they should not be the only marking approach.

Practical Implementation

A robust provider implementation typically combines:

1. C2PA Content Credentials for cryptographic provenance
2. Cryptographic watermark for robustness to metadata stripping
3. Detector model as a backup
4. Acceptable-use restrictions in terms of service requiring users not to remove marks

Article 50(7) sets the route to further specification. The AI Office is to encourage and facilitate a Union-level code of practice on the detection and labelling of artificially generated or manipulated content, which the Commission may approve by implementing act under the Article 56(6) procedure. Only if the Commission deems that code inadequate may it adopt an implementing act specifying common rules under the Article 98(2) examination procedure. Either instrument is likely to press for interoperability with established standards (notably C2PA) while leaving room for the state of the art to evolve.

Deployer Implementation: User-Facing Disclosure

For deployers, Article 50(4) compliance requires user-facing disclosure when publishing deepfakes or AI-generated public-interest text.

Disclosure Patterns for Deepfakes

Visible labelling options include:

• Overlay or watermark on the image, video, or audio (e.g., "AI-generated" badge)
• Caption or attribution below or alongside the content
• Platform-level label automatically added by the hosting service based on detected machine-readable marks
• End-card for video content
• Spoken disclosure for audio (e.g., "This audio was generated by AI" at the start of a clip)

Under Article 50(5), the disclosure must be provided "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and it "shall conform to the applicable accessibility requirements". A purely visual overlay is therefore not sufficient for users relying on screen readers, and a purely spoken disclosure is not sufficient for deaf users.

Disclosure Patterns for AI-Generated Text

For AI-generated text published to inform the public on matters of public interest:

• Author attribution identifying the AI nature (e.g., "Drafted with AI, edited by [name]")
• Header or footer disclosure ("This article contains AI-generated content")
• Sentence-level marking for partially AI-generated articles
• Platform-level metadata indicating AI generation

The editorial-review carve-out is significant: Article 50(4) disapplies the text-disclosure duty "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content". Human review and editorial control are alternatives, but the editorial-responsibility limb is cumulative — someone must actually own the publication decision. Newsroom workflows where editors review and sign off on AI-drafted material can rely on this carve-out.

The Artistic/Creative/Satirical Carve-Out

Article 50(4) provides that where the content forms part of an "evidently artistic, creative, satirical, fictional or analogous work or programme", the disclosure is limited to "disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work."

Examples of compliant disclosure in artistic contexts:

• Film and TV credits naming the AI generation tools used
• Liner notes in music albums identifying AI-generated tracks
• Hashtag or caption on satirical social media posts (e.g., #aigenerated, #deepfake)
• Wall text or catalogue notation in art exhibitions

The carve-out adjusts the form of disclosure but does not waive it entirely.

Specific Deployment Scenarios

A Photo-Editing App with AI-Powered Image Generation

Provider implements C2PA marking on AI-generated outputs. Users posting those outputs on social media in a professional or organisational capacity are deployers — they have Article 50(4) disclosure obligations if the output is a deepfake (realistic-looking depiction). Private individuals posting in a purely personal, non-professional capacity fall outside the deployer definition in Article 3(4), and Article 2(10) disapplies deployer obligations for natural persons acting in that capacity, so the Article 50(4) duty does not reach them.

A News Organisation Using AI to Generate Article Drafts

Writers and editors review and edit AI drafts before publication. Editorial responsibility lies with named editors. The editorial-review carve-out applies — Article 50(4) disclosure for the text is not required, though many news organisations choose to disclose voluntarily.

A Marketing Agency Using AI to Generate Product Imagery

AI generates photorealistic product imagery for ad campaigns. The agency is the deployer; the AI tool's provider implements Article 50(2) marking. Article 50(4) deepfake disclosure may apply if the imagery depicts real people or specific real environments; otherwise generally does not apply. Advertising law (UCPD, national advertising standards) may add specific disclosure requirements separately.

A Political Campaign Using AI to Generate Social Media Posts

Article 50(4) text disclosure applies (public-interest communications). Editorial-review carve-out may apply if a human signs off. Annex III, point 8(b) may make the AI system high-risk if it is "intended to be used for influencing the outcome of an election", although the Chapter III obligations attaching to Annex III high-risk systems now apply from 2 December 2027 (deferred from 2 August 2026 by Regulation (EU) 2026/1744). Article 5(1)(a) manipulation prohibition may apply if the content is manipulative and causes significant harm.

A Voice-Cloning Service for Audiobook Narration

Provider implements voice watermarking. Audiobook publisher (deployer) may need to disclose AI-narrated content; many platforms (Audible, etc.) provide platform-level labelling that satisfies this.

A Customer Service Chatbot

Article 50(1) (chatbot disclosure) applies. Article 50(4) text disclosure for AI-generated public-interest text may apply if the chatbot is used in public-information contexts (government services, public-interest advisory).

A Content-Creation Platform Allowing Users to Generate AI Images

Platform combines roles: it is a provider of the generation tool (Article 50(2) applies — must implement machine-readable marking) and a host of user content (DSA obligations apply for platform-level moderation and labelling).

Interaction with Other Regulations

Digital Services Act

The DSA imposes additional content-moderation and transparency obligations on platforms hosting AI-generated content. Article 34 requires VLOPs and VLOSEs to assess systemic risks, and Article 35(1)(k) expressly requires them, where appropriate, to ensure that generated or manipulated image, audio or video content which "appreciably resembles existing persons, objects, places or other entities or events and falsely appears to a person to be authentic or truthful" is "distinguishable through prominent markings" on their online interfaces, and to provide an easy-to-use functionality letting recipients flag such content.

GDPR

AI-generated content depicting real people processes personal data. GDPR applies independently: a lawful basis is needed under Article 6 (often consent for non-public figures, legitimate interests under Article 6(1)(f) for satire of public figures), and Article 9 applies only where special categories of data are involved — including biometric data, but only where it is processed "for the purpose of uniquely identifying a natural person", which generating a face does not necessarily entail.

National Copyright and Image Rights

National copyright laws and image-rights laws apply to AI-generated content. Article 17 of Directive 2019/790 governs platform liability for copyright-protected content. National personality and image rights apply to deepfakes of real individuals.

Sector-Specific Rules

Advertising laws (UCPD, national advertising standards), broadcasting laws (AVMSD), and electoral laws may impose additional disclosure or restrictions on AI-generated content in specific contexts.

Compliance Checklist

For Providers of AI Generation Tools

1. Implement machine-readable marking. Choose an approach (C2PA, watermark, detector, metadata) or combination.
2. Verify robustness. Test that marking survives common transformations.
3. Document the approach. Maintain a brief technical note describing the marking and its limitations.
4. Provide downstream documentation. Help deployers understand how to comply with Article 50(4) using your tool's outputs.
5. Update as state of the art evolves. The Article 50(2) standard is "as far as technically feasible" — keep current.

For Deployers Using AI to Generate Content

1. Inventory your AI content. What content do you publish that is AI-generated or AI-manipulated?
2. Classify deepfakes. Apply the Article 3(60) test to image, audio, and video content.
3. Classify public-interest text. Determine which AI-generated text is published for the purpose of informing the public.
4. Apply the editorial-review carve-out where appropriate. Document the editorial control workflow.
5. Implement disclosure. Choose a disclosure pattern appropriate to each content type and context, and check that it meets the accessibility requirements Article 50(5) applies to it.
6. Address the artistic carve-out for genuinely creative or satirical works — but still disclose, in adjusted form.
7. Train your content team. Make sure people creating, editing, and publishing AI-generated content understand the labelling obligations.

Conclusion

The Article 50 labelling regime is one of the more practical interventions in the EU AI Act. It does not prohibit AI generation; it requires that the AI nature of content be detectable and disclosed. The provider-side machine mark and the deployer-side user-facing disclosure together create a coordinated system that supports trust without preventing creative or commercial use.

For deeper coverage of the deepfake-specific provisions, see deepfakes and the EU AI Act. For the broader transparency framework that Article 50 establishes, see transparency obligations under the EU AI Act.