The EU's new AI labelling rules: what every organisation needs to know

When eagle-eyed shoppers spotted that product photographs on the website of US retailer J.Crew had been generated by AI, but with no label or disclosure, the backlash was swift. The images of the retailer's "Americana-prep aesthetic" looked polished enough to pass as real – for those not paying particular attention – but, for many, the bigger offence was the silence.

In fairness to J.Crew, they are just one of many businesses which have faced the wrath of customers on AI. And a recent study, from December 2025, similarly found that, depending on the services in question, customers tend to avoid certain services advertised with AI-generated images, perceiving the companies as impersonal, less professional, lacking credibility and potentially misleading.

This all points to something larger than a brand's misstep: a steady erosion of confidence in what consumers see online. One celebrity manager speaking to The Guardian claims that "40% to 60% of the content ... from some of the big brands is actually being made through AI". As generative tools make it ever harder to distinguish synthetic content from authentic, human-made material, the risk is not merely the occasional embarrassing advertisement but a broader 'trust drought' in which audiences begin to discount imagery, text and video by default. That is precisely the issue that the EU has in mind in its new Code of Practice on Transparency of AI-Generated Content.

This Code of Practice, published on 10 June 2026, translates the marking and labelling obligations under Article 50 of the EU AI Act into a practical compliance framework of watermarks, metadata and visual icons, giving consumers the tools to verify what they are seeing, reading and hearing.

For anyone in advertising, customer relationship management and public relations, the stakes are immediate: while signing the Code is voluntary, the transparency obligations it implements under the EU AI Act are hard law, backed by fines of up to €15 million or 3 per cent of global annual turnover.

In this article we set out what you need to know about the Code of Practice.

What the Code demands

The Code splits neatly into two sections, which tracks the AI Act's own division between:

"providers": i.e., those who build or supply generative AI systems; and
"deployers": i.e., anyone who uses them under their own authority for professional purposes.

Providers

There are four commitments for providers set out in Section 1 of the Code:

marking of AI-generated or manipulated content;
detection of markings of AI-generated or manipulated content;
measures to meet the requirements for marking and detection solutions; and
testing, verification and compliance.

Marking of AI-generated or manipulated content

The primary obligation on providers is to ensure that the outputs of their AI systems are marked in a machine-readable format and are detectable as artificially generated or manipulated. In practical terms, the Code mandates a multi-layered marking approach combining at least two techniques:

Digitally signed metadata: where the content format supports it, providers must record AI-generation or manipulation information in the metadata, digitally signed and time-stamped in a tamper-evident manner; and
Imperceptible watermarking: providers must embed an imperceptible watermark within the content itself, complementing the metadata layer. For free-form text longer than 200 tokens, watermarking must still be applied, even though reliability may be lower for shorter text.

A single layer of marking is permitted only in narrow circumstances, e.g. where the AI system is embedded in a physical product operating in a technically controlled, closed environment or for free-form text, where metadata cannot be attached.

Providers must also make best efforts to preserve existing metadata markings on input data, refrain from intentionally altering or removing them and include a prohibition on downstream tampering in their terms and conditions. They must not market or promote tools whose purpose is to circumvent machine-readable markings.

Providers are also encouraged to incorporate richer information in the metadata to provide additional context, contributing to integrity and trust in the ecosystem. Providers are also encouraged to explore functionality for perceptible markings, however both these measures are listed as 'optional'.

Detection of markings of AI-generated or manipulated content

In addition to marking outputs, providers must make available a detection solution (free of charge as a general rule) enabling deployers, end-users, third-party integrators and other legitimate parties (including authorities, researchers and civil society) to verify whether content has been generated or manipulated by their AI system. This may take the form of a public specification, a downloadable piece of software or a cloud-based API.

The detection solution must be accessible through a user interface appropriate for the audience likely to be exposed to the content. Where the general public may encounter the content, the detection solution must be publicly available; where exposure is limited to professional settings with effective safeguards against wider dissemination, access may be restricted accordingly.

Providers must ensure that detection results are presented in a clear and comprehensible manner, indicating whether the result is based on metadata, watermarking, forensic detection or other techniques. They are encouraged to adopt a tiered presentation of results so as not to overwhelm users.

Measures to meet the requirements for marking and detection solutions

The Code sets four cumulative quality requirements for providers' marking and detection solutions, to be met holistically across all marking techniques rather than technique by technique:

Effectiveness - solutions must be fit-for-purpose, enabling a person to distinguish AI-generated content. This is assessed on a user-based basis, not through a quantitative metric alone.
Reliability - solutions must achieve a high level of accuracy in detecting markings across diverse contexts and use cases, measured by metrics such as error rates across varied sample types.
Robustness - solutions must maintain performance under both common processing operations (compression, cropping, format conversion, print-and-scan) and adversarial attacks (copying, removal, regeneration of markings).
Interoperability - solutions must operate seamlessly across multiple systems and actors. By 2 February 2027, providers must implement an interoperability solution, such as a standardised API for routing detection queries, a publicly readable signpost mechanism or a shared provider detection solution.

There is a further optional requirement to "advance the state of the art in marking techniques and detection mechanisms for AI-generated and manipulated content".

Testing, verification and compliance

Providers must establish a documented compliance process describing how they implement each measure. They must test their solutions both prior to market placement and regularly thereafter, under conditions representative of real-world use. They are required to train relevant employees and to co-operate with competent market surveillance authorities, providing documentation and access to marking and detection solutions upon "reasoned request".

Deployers

Moving on to deployers, the four commitments set out obligations that are narrower in subject-matter than those imposed on providers: they do not encompass all AI-generated content, rather they specifically target synthetic content that may deceive or mislead the public.

Disclosure of deep fakes and published text

The centrepiece of the deployer regime is a disclosure obligation (set out in Section 2). Deployers must ensure that deep fakes and published text are clearly and distinguishably labelled as AI-generated or manipulated, at the latest at the time of a person's first exposure to the content. In practice, this means deployers must apply a visible label, preferably the standardised EU icon provided in Annex 1 to the Code, or an equivalent icon or label that meets the Code's design and placement specifications. The EU icon features the capitalised acronym "AI" as its main visual element and has been empirically user-tested across several Member States for noticeability, understandability and trust. Where visual disclosure is not possible, e.g. for audio-only content, an audible disclaimer in plain language must be included at the beginning of the deep fake.

Deployers must follow detailed placement specifications: the label must be positioned so that it is immediately perceivable without requiring user interaction, must remain visible for a sufficient duration and should ideally be embedded directly into the content. For video, the label must appear at the start and be repeated at regular intervals, particularly after interruptions such as advertising breaks. For published text, the label is to be placed above or at the top of the text, near the headline or in the colophon/inscription at the beginning of the text.

The Code also places considerable emphasis on ensuring disclosure is accessible to all persons, including those with disabilities, children and the elderly. Deployers must comply with applicable EU accessibility legislation and are encouraged to implement relevant accessibility standards.

Internal processes

Deployers must put in place or maintain internal compliance processes proportionate to their size and resources, documenting how they implement their disclosure obligations. They must also ensure awareness and literacy among relevant employees and external contractors, covering the circumstances in which disclosure is legally required, accessibility considerations and procedures for correcting missing or incorrect labels.

Deployers must also support the effective implementation of labelling through internal review and external feedback mechanisms. They are encouraged to provide channels for individuals or third parties (such as trusted flaggers, researchers and fact-checkers) to flag missing or incorrect disclosures and they must co-operate with competent national authorities.

Disclosure for artistic, creative and similar works

A lighter-touch regime applies to deep fakes forming part of evidently artistic, creative, satirical, fictional or analogous works. In such cases, disclosure is still required but it must be implemented in a manner that does not hamper the display or enjoyment of the work. The label may, for instance, be placed in credits, accompanying notes or as a non-obtrusive icon with a hover-over information layer.

For non-digital or non-interactive content falling into this category, e.g. exhibitions, art galleries, cinemas, festivals etc., disclosures may be provided at the online or physical point of entry or sale, as part of the introductory or accompanying information, e.g. exhibition leaflet or entrance ticket or information provided via packaging.

Human review and editorial control for published text

A notable carve-out exists for published text. The disclosure obligation does not apply where the AI-generated text has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication. Media service providers subject to existing editorial standards and regulatory frameworks may rely on this exception, provided they apply their established professional review procedures.

For all other deployers, the Code requires them to establish, adapt or maintain appropriate policies for human review or editorial control prior to publication, including identifying the person with editorial responsibility and documenting the organisational measures and resources allocated to ensure adequate review.

Why it bites harder than you think

Three features make this Code more potent than the typical voluntary instrument.

First, signatories who follow it can demonstrate compliance with Article 50 uniformly across all Member States, sparing themselves the burden of proving adequacy to each national market surveillance authority individually. Those who decline to sign must instead show that their own measures meet the same standard, i.e., assessed case by case, authority by authority. For multinational deployers, this fragmentation alone is a powerful incentive to opt in.
Second, the Code imposes ongoing governance. Deployers must maintain internal compliance documentation proportionate to their size, train relevant personnel, co-operate with market surveillance authorities, and follow up on reported instances of non-compliance "without undue delay". A flagging mechanism allows third parties to report mislabelled or unlabelled content, creating an external accountability loop that did not exist before.
Third, responsibility sits with the deployer, not the vendor. The platform you license supplies the tools; compliance is yours. A CRM provider that integrates generative AI into outreach campaigns or a PR firm that uses synthetic media for client work, cannot outsource its Article 50 obligations to upstream technology suppliers.

The compliance clock

The clock is rapidly ticking down to the 2 August 2026 deadline, when the transparency obligations in Article 50 of the EU AI Act come into force, as well as the enforcement powers of the Commission and national market surveillance authorities. There is a little wiggle room for AI systems placed on the market before 2 August 2026 as they will have to comply with the marking and detecting obligations from 2 December 2026, but compliance work should be well underway whether your AI systems are on the market now or in a few weeks' time!

EU Guidelines on transparency obligations

In addition to the Code of Practice, on 20 July 2026 the EU Commission also published guidelines to assist providers and deployers of AI systems in meeting the EU AI Act's transparency obligations. These guidelines complement the Code of Practice, explaining certain concepts and exemptions and providing examples, e.g. what constitutes "directly interactive AI systems", i.e. chatbots, synthetic content, including partially or fully AI-generated text, deepfakes and AI-generated text on matters of public interest, as well as examples for relevant exceptions such as standard editing, e.g. spelling and grammar correction.

The guidelines also explain how to demonstrate compliance with the transparency obligations of the EU AI Act, including through adherence to the Code of Practice, which provides "legal certainty and a simple and practical way to demonstrate compliance with the AI Act".

Practical tips on what to do now

familiarise yourself with both the Code of Practice and the guidelines: understanding what is required and what you need to do will help demonstrate your compliance with the obligations in the EU AI Act which is even more important given the enforcement powers also come into force on 2 August 2026;
find your AI content: map where AI generates or alters anything you publish, e.g. website imagery, social posts, chatbots, marketing copy, reports etc. You can't label what you haven't located;
work out which obligations are yours as the duties split by role. Providers who place generative AI systems on the market must mark and make outputs detectable, deployers who use those systems to publish content must label deepfakes and certain AI-generated text. Many businesses are both;
decide whether to sign the Code. It's voluntary, but signatories can rely on it to show compliance, which cuts administrative burden and gives predictability across Member States. If you go your own way, you'll have to prove your alternative measures are adequate, assessed individually by market surveillance authorities;
don't lean on a single marking technique. The Code expects a multi-layered approach: digitally signed metadata, imperceptible watermarking and optional fingerprinting or logging as a fallback for short or heavily transformed outputs. One watermark on its own won't meet the Article 50(2) tests of effectiveness, reliability, robustness and interoperability;
label deepfakes and use the EU icon. Deployers must disclose AI-generated or manipulated image, audio or video that constitutes a deepfake. The EU has published a set of icons for this purpose;
use the editorial carve-out for text and document it. AI-generated text published to inform the public on matters of public interest needs disclosure, unless it has had genuine human review and someone holds editorial responsibility. If you rely on that exception, keep records proportionate to your size showing the review actually happened;
push obligations down your supply chain. Require compliant output marking from your AI vendors contractually, rather than assuming the tool you bought already does it;
build your human layer. Train staff to spot AI-generated content, keep human oversight over labelling decisions and give users a way to flag mislabelled or unlabelled material; and
check any overlap with the Digital Services Act (DSA). If you run a platform as well as deploying AI, line up Article 50 against your DSA duties on content moderation and deepfake labelling so the two don't pull in different directions.

The EU has made its position plain: synthetic content must declare itself. The businesses that treat that principle as a design constraint, rather than an afterthought, will find themselves better placed when enforcement begins.

If you have any questions or wish to discuss the EU's labelling requirements, please do reach out to your usual LS contact.