From 2 August 2026, anyone using AI to generate images, audio, video or, in some cases, text for professional purposes may need to label that content as AI generated or manipulated. This obligation comes from Article 50(4) of the EU AI Act (the "Act"), which requires "deployers" of AI systems to clearly disclose that content has been artificially generated or manipulated in two distinct scenarios. The first is where image, audio or video content qualifies as a "deepfake", a broadly defined concept likely to capture a significant amount of AI-generated advertising and creative visual assets. The second is where AI-generated or manipulated text is published to inform the public on matters of public interest and has not undergone human review or editorial control, though routine AI-drafted advertising copy will generally fall outside this scenario provided it does not include claims relating to health, consumer safety or sustainability. The underlying purpose is to let audiences distinguish fact from fabrication, rather than being quietly deceived by a photorealistic AI creation. 

Who is caught, and from where?

The rules are not confined to EU-based businesses. The Act has "extra-territorial" reach, applying both to deployers established in the EU and to deployers based in third countries, including the UK or the US, where that deployer itself foresees, directs or authorises distribution of AI content into the EU, including by posting deepfakes on the "globally accessible internet". There is, however, a carve-out: non-EU deployers are not expected to be caught where their content reaches EU audiences only through channels that are "unforeseeable and outside their control". Practically, agencies and advertisers running campaigns with obvious EU reach, such as via the publicly accessible internet, should assume the rules apply even without formal EU targeting, whereas a campaign geo-targeted to the UK only, which reaches the EU incidentally (for example, shared privately via WhatsApp), is unlikely to be caught. 

Who counts as a "deployer"?

"Deployers" are those who use AI systems under their "authority" and who control how the system is used, with "authority" understood broadly to mean responsibility for the decision to deploy the system and for the manner of its use, rather than hands-on technical control. It is enough that a party decides for what purposes and how the AI system is used, even across decentralised or multi-party supply chains. Applied to an advertising campaign, both the advertiser and the agency can be "deployers" in the same chain, each in a different respect: the advertiser may set the parameters governing AI use and sign off final creative, while the agency retains day-to-day control over which AI tools are used and how. Neither party has exclusive control, yet both can hold "authority", meaning compliance is very likely a joint responsibility that cannot be quietly left to the other party. 

What is a "deepfake"?

Content must satisfy a two-stage test. First, it must resemble existing people, objects, places, entities or events, a limb interpreted broadly so that it is enough for the subject to plausibly exist or have existed, meaning only genuinely fantastical content, such as dragons, falls outside it. Because this first limb is drawn so broadly, the real assessment usually turns on the second limb: does the content falsely appear to a person to be authentic or truthful? This is assessed objectively, without requiring any intention to deceive, and depends on factors including the level of resemblance, the message conveyed, the foreseeable context and audience, and whether vulnerable groups like children or older people may be exposed. Guidance makes clear that minor or technical interventions, such as background tidying, lighting and colour adjustments, cosmetic touch-ups, or product re-scaling, are unlikely to meet the test. The focus belongs on the advertised product, not the scene dressed around it, so an AI-generated backdrop is unlikely to require labelling unless it affects perceptions of the actual product, person or event being sold, for example a product rendered better, bigger or different than reality. 

Labelling and consequences

Where labelling is required, the disclosure must be clear, distinguishable and understandable, appearing when content first reaches its audience rather than buried in metadata. The European Commission recommends, but does not mandate, an "AI" icon under its Code of Practice on Article 50. Platform-embedded or invisible AI markings are not sufficient on their own; a human-perceivable, prominent label is still required, and advertisers and agencies remain responsible for assessing compliance even where a platform label is visible. Non-compliance carries fines of up to €15 million or 3% of global annual turnover, whichever is higher, and labelling a deepfake does not itself make content lawful under other regimes such as data protection, IP, personality rights, or UK advertising self-regulation and consumer protection law. 

Practical takeaways

Both advertiser and agency should assess, asset by asset, whether they are "deployers" and whether the deepfake test is met, focusing on whether the AI element affects perceived authenticity of the actual product, person or event. Given both parties can be independent deployers, they should agree early in the creative process what label to use, where it appears, and how to allocate labelling responsibility and risk contractually, rather than leaving this to the eleventh hour. 

For the full analysis, read The new AI labelling rules for "deployers" in the advertising supply chain.