4 November 2026 · 8 min read

Do You Have to Label AI Images? The EU AI Act Rules for 2026

Do you have to label AI images in the EU? What Article 50 of the AI Act requires from August 2026, who it covers, and what creators should actually do now.

Short answer: under Article 50 of the EU AI Act, which the European Commission says applies from 2 August 2026, anyone using AI professionally to publish realistic images, video or audio that could pass as real — a deepfake — has to disclose that the content is artificially generated or manipulated. The companies that build the generators carry a separate duty: their output must be marked in a machine-readable way. A plainly fantastical illustration made for fun is a much lighter case. Below: what the article says, who it applies to, and a practical routine for creators and small businesses. This is a plain-language guide, not legal advice.

What does Article 50 of the EU AI Act require?

Article 50 is the AI Act's transparency article. It splits duties between providers — the companies that develop an AI system and put it on the market — and deployers, meaning anyone using an AI system under their own authority, which includes businesses, agencies and creators using AI for work.

The Act also says the information has to be clear and distinguishable, and given at the latest when people first see or interact with the content. A disclosure buried three clicks away is unlikely to meet that.

What counts as a deepfake under the AI Act?

The Act defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing people, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. Two things matter: it resembles something real, and someone could reasonably take it as real.

• Likely in scope: a realistic photo of a real public figure at an event that never happened; a hotel's pool extended with AI to look twice the size; a 'customer testimonial' video of a person who does not exist, presented as genuine; a cloned voice of a real person.
• Probably lower risk: a clearly stylised illustration, a cartoon mascot, an obviously impossible scene. Context still matters, and official guidance is expected to draw the lines more precisely.
• Artistic, satirical and fictional work: disclosure is still required for deepfakes, but the Act allows it to be done in a way that does not spoil the display or enjoyment of the work — a credit line rather than a stamp across the middle.

On the provider side, the marking duty does not apply where AI only performs assistive standard editing or does not substantially alter the input. Exactly where AI denoise, sky replacement or object removal fall is one of the details the guidance is meant to settle.

Does the AI Act apply to me as a creator or small business?

• Purely personal, non-professional use is outside the deployer obligations. A silly edit for your family group chat is not what the rules target.
• Using AI images for a business, a brand, a client, a monetised channel or advertising is professional use, and the deployer rules can apply.
• Location: the Act reaches providers anywhere that place AI systems on the EU market, and providers and deployers outside the EU where the output is used in the EU. If your audience is in Europe, assume it is relevant to you.
• Size: we are not aware of a blanket small-business exemption from Article 50. The penalty rules are gentler for SMEs, but the disclosure duty itself is not.

Breaches of the transparency obligations can be fined. The Act sets maximums of up to €15 million or 3% of worldwide annual turnover, with SMEs and start-ups capped at the lower of the two. Enforcement sits with national authorities, and how actively they will police everyday social posts remains to be seen.

When do the AI Act labelling rules start?

According to the European Commission, the Article 50 transparency obligations apply from 2 August 2026. Some implementation details are still being finalised:

• The Commission has been preparing guidelines and a Code of Practice on marking and labelling AI-generated content, to spell out what good marking and disclosure look like in practice.
• The Digital Omnibus package the Commission proposed in late 2025 included changes to AI Act timelines, among them a proposed grace period for some providers' marking obligations. Proposals can change before they are adopted.
• Each member state designates its own authorities, so who enforces and how will vary by country.

Before relying on any date, check the official AI Act pages on the European Commission's website (digital-strategy.ec.europa.eu) and, if you run a business, your national authority or a lawyer.

How do C2PA Content Credentials relate to the AI Act?

The Act does not name a technology. It asks providers for marking that is effective, interoperable, robust and reliable as far as technically feasible. C2PA Content Credentials — signed provenance metadata embedded in the file — are one of the approaches most often discussed, usually alongside invisible watermarks, because metadata on its own disappears with a screenshot or a careless re-save.

• Machine-readable marking (credentials, watermarks) is the provider's job. It is built into the generator, not something you add.
• Disclosure as a deployer is the human-readable layer: a label, caption or statement people actually see.
• One does not replace the other. Many platforms read credentials and show their own 'AI info' label, but do not count on a platform to do your disclosure for you.

What should creators and small businesses do now?

• List where you use AI imagery: ads, product pages, social posts, thumbnails, newsletters, client work.
• Sort each use by one question: does it show a real person, product, place or event realistically enough that someone could take it as genuine? Those need a clear disclosure.
• Pick standard wording and a standard place. 'Image generated with AI' or 'AI-edited photo' in the caption, near the image, and in the alt text.
• Use the platforms' own AI-content labels when you post realistic AI material.
• Keep provenance intact on AI images you publish. Do not strip credentials from content you are supposed to disclose, and keep the original generated files and prompts so you can show what was AI.
• Check your exports before publishing: run them through a checker to see which markers they carry. It also catches the opposite problem — a real photo that picked up an AI tag from a minor edit.
• Brief anyone who makes content for you: freelancers, agencies, staff. The rules follow the work, not the person who clicked generate.
• Revisit your routine when the Commission's guidance and Code of Practice are final.

Can I just remove the metadata instead?

Not to hide AI provenance where disclosure is required. That defeats the purpose of the rules and misleads your audience — and the duty is about what you publish, not what is inside the file. Skrubly's Metadata Cleaner is built for privacy data: GPS coordinates, camera serial numbers, timestamps. If an image is AI-generated or substantially manipulated and the rules say disclose, disclose.

Quick answers

• Is an AI-retouched photo a deepfake? Light retouching that does not change what the photo shows is unlikely to be. An edit that makes a real scene look like something that did not happen may well be.
• Does a visible watermark count? For deployers, a clear visible disclosure is the point. For providers, the requirement is machine-readable marking.
• Where do I check the current rules? The European Commission's AI Act pages and your national authority.