EU AI Labels Are Now Enforceable—Deepfakes Face a New Disclosure Test

Article 50 of the EU AI Act became applicable across the European Union on August 2, 2026, making its chatbot, biometric and synthetic-content transparency duties enforceable. The European Commission’s Article 50 guidance confirms that providers and professional deployers must now comply, subject to a narrow transition for machine-readable marking by certain systems already on the market.

The August 2 change was not postponed with the Act’s broader high-risk regime. Contemporary reporting likewise found that chatbot and synthetic-content rules took effect on schedule, while the principal obligations for high-risk systems moved to later dates. The result is a two-track calendar: Article 50 disclosures are live, but much of the specialised high-risk framework is not.

Four Article 50 duties now apply

The live obligations depend on whether an organisation is a provider or a deployer. Providers develop an AI system, have it developed, or place it on the market or put it into service under their own name. Deployers use a system under their authority in a professional context; purely personal, non-professional use is excluded.

• Direct interaction with AI: providers of systems designed to interact directly with people must ensure that users are informed they are dealing with AI, unless this is already obvious to a reasonably well-informed, observant person. The information must appear clearly from the start of the first interaction.
• Machine-readable marking: providers of systems that generate synthetic text, audio, images or video must make covered outputs detectable as artificially generated or manipulated using effective, reliable, robust and interoperable machine-readable marks. Outputs produced through standard editing assistance and some narrowly defined technical or industrial uses may fall outside the duty.
• Emotion and biometric notices: deployers of emotion-recognition or biometric-categorisation systems must inform people exposed to their operation, whether the analysis happens in real time or later.
• Deepfake and public-interest disclosures: deployers must disclose covered deepfake images, audio and video. They must also label AI-generated or manipulated text published to inform the public about matters of public interest unless it has undergone qualifying human review or editorial control and a person holds editorial responsibility.

The provider and deployer requirements are separate. A machine-readable mark embedded by a system provider does not satisfy the deployer’s audience-facing duty for a deepfake: that disclosure must be perceptible and understandable without specialised tools, no later than the audience’s first exposure.

The deepfake rule depends on context, not synthesis alone

Article 50 does not treat every AI-generated picture or altered recording as a deepfake. Covered content must resemble an existing person, object, place, entity or event—or one that plausibly could exist or have existed—and be capable of falsely appearing authentic or truthful.

The assessment turns on more than technical manipulation. Relevant factors include the degree of resemblance, the content’s substantive message, where and how it will be distributed, and what the intended or reasonably foreseeable audience expects. Synthetic special effects in an obviously fictional production may therefore be treated differently from a realistic fabricated recording distributed as evidence of a real event.

When content meets the test, a professional deployer must disclose the manipulation clearly. Evidently artistic, creative, satirical, fictional or analogous works are not wholly exempt, but their disclosure may be presented in a way that does not obstruct the display or enjoyment of the work.

Public-interest text follows a distinct test. Substantive examination by a person with relevant knowledge can qualify as human review, while genuine editorial control requires authority to approve, alter or reject the substance. Spell-checking, grammatical correction and other superficial or procedural checks do not meet that standard.

The high-risk delay is a separate legal track

The delayed deadlines concern the AI Act’s specialised obligations for high-risk systems, not Article 50 as a whole. IT Pro’s August 3 account places stand-alone high-risk systems covered by Annex III on a December 2, 2027 timetable and high-risk systems embedded in regulated products under Annex I on an August 2, 2028 timetable.

Those later dates do not defer chatbot notices, emotion-recognition and biometric-categorisation notices, deepfake disclosures or the public-interest text rule. A business may consequently have a live Article 50 obligation even when the same system’s high-risk requirements have not yet begun to apply.

Article 50 does contain one limited transition. A provider that placed a generative AI system on the market before August 2, 2026 has until December 2, 2026 to comply with the machine-readable marking and detection duty. The extension attaches to that provider-side obligation for pre-existing systems; it does not create a general grace period for audience-facing disclosures, and content generated before August 2 need not be labelled retroactively.

Enforcement will test both the label and the underlying decision

National market-surveillance authorities are responsible for most Article 50 enforcement. The European AI Office has a more limited role for specified systems connected to general-purpose AI models and designated very large platforms or search engines, while the European Data Protection Supervisor covers AI systems used by EU institutions, bodies and agencies.

The disclosure itself is only part of what may need to be demonstrated. Providers must be able to establish how covered output is marked and made detectable; deployers may need to substantiate why content was or was not treated as a deepfake, when an audience-facing notice appeared, or whether public-interest text received substantive human review and editorial responsibility.

The immediate legal position is therefore split but no longer ambiguous: Article 50 has applied since August 2, 2026, while the main high-risk-system obligations remain on the 2027 and 2028 tracks. The next Article 50 milestone is December 2, 2026, when the limited transition for machine-readable marking by pre-existing generative systems ends.

Also read:

• Test Data Management: Strategies for Efficient and Effective Testing
• If You Voted, Now Your Address and Party Registration Are Publicly Available Online
• YouTube’s AI Disclosure Setting Explained: Which Edits, Voices and Images Need a Label?