Since 2 August 2026, any organisation that uses AI to generate or manipulate a deepfake must disclose that the content is artificially generated or manipulated. This follows from Article 50(4) of the AI Act and applies to image, audio and video that appear authentic. Text is explicitly excluded; a separate and much narrower rule applies to that. The duty was not postponed by the Digital Omnibus and has no transition period: it has applied in full since 2 August 2026.
This page accompanies our practical overview of Article 50 and the guide to the provider and deployer split. Below you will find what the deepfake duty entails, who carries it, how the disclosure should look and which exceptions apply.
What is a deepfake under the AI Act?
The AI Act defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic or truthful. The key lies in that last point: a viewer or listener could mistake the content for real. According to the Commission guidelines (points 113 to 116), a realistic image of a non-existent but plausible person or place can also be a deepfake. Clearly fantastical content or an obviously cartoon style that no one would take for real does not qualify.
Important: text is not a deepfake. An AI-written article is something other than a fabricated video, and falls under a separate rule on AI-generated text for public information. Do not conflate the two.
Who must disclose a deepfake?
The duty sits with the deployer: the organisation that uses the AI system under its own responsibility to create or edit the deepfake. Not the incidental viewer, and under this provision not the provider of the model either.
| Question | Answer |
|---|---|
| Who carries the duty? | The deployer who generates or manipulates the deepfake |
| For which content? | Image, audio and video that appear authentic |
| From when? | 2 August 2026, no transition period |
| Does it apply to text? | No, a separate rule applies |
The misconception that this only concerns bad actors or the tech companies building the models is exactly where organisations go wrong. A marketing team using a synthetic spokesperson, a municipality using an AI presenter, or a trainer publishing an edited instructional video: these are all deployers, with a disclosure duty as soon as the result is a deepfake, meaning realistic and capable of being falsely taken as real. A cartoon style or mere colour correction is not.
How and when must the disclosure be made?
The disclosure must be clear and distinguishable, and given at the latest at the moment of first exposure. It must also be accessible to people with disabilities. A disclosure that is effectively impossible to find does not comply.
In practice, a disclosure fails when it:
- appears in small print in a footer;
- is placed as a faint or barely visible label on the content;
- only flashes briefly in a video;
- is buried in terms and conditions;
- is phrased vaguely.
The European Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026. Section 2, for deployers, uses the EU ‘AI’ icon or an equivalent label: top right for images and video, at the start for video. Signing is voluntary, but following that line makes it easier to demonstrate that the disclosure complies.
Which exceptions apply?
The duty is not absolute. For evidently artistic, creative, satirical or fictional work a lighter form applies: the disclosure must exist, but may be given in an appropriate manner that does not hamper the display or enjoyment of the work. The Commission reads this strictly: advertising is not automatically creative work. For content that is evidently fantastical or impossible, and that no one would take for real, the duty does not apply. There is also an exception for content lawfully used to detect, prevent or investigate criminal offences.
These exceptions are powerful, but they require discipline. Anyone relying on the artistic exception must be able to explain why the content qualifies and why the chosen form of disclosure is appropriate.
Deepfake disclosure versus machine-readable marking
Two duties are often confused. The visible deepfake disclosure under Article 50(4) sits with the deployer. The machine-readable marking under Article 50(2), such as a watermark or provenance data following a standard like C2PA, sits with the provider of the generative system. Anyone integrating an external model into their own service may face both, and is well advised to set out contractually who provides what.
What should you do now?
Map your AI use
Map where in your organisation AI is used to create or edit realistic image, audio or video. Think of marketing, communications, training and internal video.
Determine your role and disclosure
Determine per use case whether you are the deployer and whether the content falls under the deepfake definition. Record which form of disclosure you choose and where it appears.
Build the disclosure into the process
Build the disclosure into your publication process, not as a separate step afterwards. Keep evidence: screenshots, policy and the location of the label.
The duty has applied since 2 August 2026. Organisations that have not arranged this yet should do so now, not with loose labels after the fact.
Want to determine which obligation applies to your own use case? Walk through the Article 50 decision tree: per role and use case the paragraph, the steps from the guidelines and examples of good notices.
Frequently asked questions about deepfake transparency
Practical questions about the deepfake disclosure duty under Article 50(4) of the AI Act.
Sources
Newsletter
Every Tuesday, the AI Act week ahead in 5 minutes
A practical briefing on deadlines, new guidance and enforcement, so you know what matters this week. No spam and you can unsubscribe in one click.
Practical and short · No spam · One-click unsubscribe