EU AI Act Deepfake Rules: Who Must Label AI Content and How

The European Union wrote the world's first broad, horizontal law on artificial intelligence, and deepfakes got their own clause. If you create, publish, or distribute synthetic media that reaches people in the EU, the EU AI Act deepfake rules now ask you to be transparent about it. This guide explains what the law requires, who has to comply, when the duties apply, and what the penalties are, in plain English.

Disclaimer: This article is general legal information, not legal advice. The EU AI Act is new, its implementing guidance and codes of practice are still being finalized, and application dates have moved before. How the rules apply depends on your role, your content, and your facts. If you operate in or sell into the EU, consult a qualified lawyer.

The European Union wrote the world's first broad, horizontal law on artificial intelligence, and deepfakes got their own clause. If you create, publish, or distribute synthetic media that reaches people in the EU, the EU AI Act deepfake rules now ask you to be transparent about it. This guide explains what the law requires, who has to comply, when the duties apply, and what the penalties are, in plain English.

Quick answer: The EU AI Act requires anyone deploying a deepfake to clearly disclose that the content is artificially generated or manipulated, and requires AI providers to mark synthetic content in a machine-readable way. These transparency duties sit in Article 50 of the Act and carry administrative fines for non-compliance.

1. Label synthetic media

   Deepfakes must be disclosed as AI-generated or manipulated.

2. Shared duties

   Both providers and deployers carry transparency obligations.

3. Phasing in through 2026

   Obligations and codes of practice continue to roll out.

How the EU AI Act Defines a Deepfake

The Act gives "deep fake" a precise legal definition. Article 3(60) of Regulation (EU) 2024/1689 defines it as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful," per the official text on EUR-Lex.

In plain English, three things matter:

1. It is made or altered by AI. The content is generated or manipulated by an AI system, not filmed or recorded straight.
2. It resembles something real. It looks or sounds like a real person, object, place, entity, or event that could exist.
3. It could pass as authentic. An ordinary viewer or listener might reasonably take it to be genuine.

The decisive test is whether the content as a whole would appear authentic to an average person, not whether the maker intended to deceive. The European Commission's draft guidance indicates the rules can apply even when no deception was intended, and even when the depicted person is not a specific real individual. Clearly unrealistic content, such as obvious fantasy scenes, generally falls outside the definition. For a general primer on the technology, see our explainer on what a deepfake is.

The EU AI Act Deepfake Labeling Rules (Article 50)

The core deepfake rules live in Article 50 of the AI Act, the article on transparency obligations. It splits the duties between two roles: providers (those who develop or supply the AI system) and deployers (those who use the system to make content). The two roles carry different obligations.

Deployers: The Visible Disclosure Duty

If you use an AI system to create or manipulate a deepfake, Article 50(4) requires you to disclose that the content has been artificially generated or manipulated. In practice that means a clear, visible label so the audience knows the media is synthetic.

The disclosure must be provided at the latest at the time of the first interaction or exposure, and the Commission's draft guidance treats this as applying to each person who encounters the content, not just the first viewer.

Providers: Machine-Readable Marking of Synthetic Content

Providers of AI systems that generate synthetic image, audio, video, or text content carry a separate duty under Article 50(2). They must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. This points toward techniques such as embedded watermarks, metadata, or content credentials that machines can read even when a human cannot see a visible label.

The Act asks that these marking solutions be effective, interoperable, robust, and reliable as far as technically feasible, taking the state of the art into account.

The Artistic, Satirical, and Creative Exemption

Article 50(4) includes relief for creative work. Where a deepfake forms part of an evidently artistic, creative, satirical, fictional, or analogous work or programme, the transparency obligation is limited to disclosing the existence of the generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.

Read carefully: this is not a full exemption. Creative and satirical content still has to be disclosed, but the disclosure can be lighter-touch and placed so it does not spoil the work. The Commission's draft guidance frames this as flexible placement, not a free pass.

Text Content and the News Exception

For AI-generated or manipulated text published to inform the public on matters of public interest, deployers must disclose that the text was artificially generated or manipulated. There is an exception where the content has undergone human review or editorial control and a person or organization holds editorial responsibility for publication. Verify the exact wording and any guidance updates against the official text before relying on this.

Who Has to Comply (and Who Does Not)

EU Companies and Non-EU Companies Serving the EU

The AI Act reaches beyond EU borders. Its scope, set out in Article 2, covers providers and deployers established outside the EU where the output produced by the AI system is used in the EU. In plain terms, a company in the United States or anywhere else can fall under the deepfake transparency rules if its synthetic content reaches people in the EU market. Geography of the company matters less than where the output lands.

Individuals, Creators, and Small Businesses

The transparency duties focus on deployers who put deepfakes in front of others and on providers who supply the generating systems. A creator publishing AI-altered video to an EU audience can be a deployer for these purposes. The Act includes proportionality measures for small and medium-sized enterprises, including lighter penalty exposure, but the disclosure obligation itself still applies. Purely personal, private activity is treated differently from publishing to an audience; if you are publishing, assume the rules can reach you.

When the Rules Apply: AI Act Timeline

The AI Act entered into force on 1 August 2024 and applies in phases rather than all at once. The transparency obligations in Article 50, including the deepfake rules, become applicable on 2 August 2026, per the application schedule in the regulation.

One update to note: under the AI Omnibus package (politically agreed in May 2026, with formal adoption expected mid-2026), generative AI systems already on the market before 2 August 2026 get until 2 December 2026 to meet the Article 50(2) machine-readable marking requirement. The deployer disclosure duty in Article 50(4) still applies from 2 August 2026. The Omnibus also adds an Article 5 prohibition on non-consensual intimate and child sexual abuse "nudifier" deepfakes from 2 December 2026. Because the Omnibus is agreed but not yet formally adopted, confirm the final text against the European Commission and EUR-Lex at publish, and re-check every quarter.

Penalties for Breaking the Deepfake Rules

The AI Act sets its penalty tiers in Article 99. Non-compliance with the transparency obligations for providers and deployers under Article 50 is subject to administrative fines of up to 15,000,000 EUR or, if the offender is a company, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher, per the regulation text on EUR-Lex.

Two points keep this in perspective. First, the Act directs that for small and medium-sized enterprises, including start-ups, the fine is capped at the lower of the percentage or the fixed amount, not the higher. Second, the deepfake transparency duty sits in a middle penalty tier; the heaviest fines in the Act, up to 35,000,000 EUR or 7% of turnover, are reserved for breaches of the prohibited-practices rules, not for labeling failures. Enforcement practice under the Act is still young, so we make no predictions about how regulators will apply these figures.

How to Label a Deepfake Under the AI Act

Operationally, compliance has two layers that map to the two roles.

Visible Disclosure That Users Cannot Miss

If you deploy a deepfake, give your audience a clear signal that the content is artificial. That can be an on-screen label, a caption, an overlay, or a stated disclosure, provided before or at the moment a person is exposed to the content. For creative or satirical work, the disclosure can be lighter and placed so it does not ruin the piece, but it still has to be there.

Machine-Readable Marking: Watermarks, Metadata, and Content Credentials

If you provide a generating system, mark outputs so machines can detect them as synthetic. Common approaches include embedded watermarks, signed metadata, and content provenance standards such as C2PA Content Credentials. The Act calls for solutions that are effective and interoperable; the emerging Code of Practice is expected to give more detail on accepted methods.

A simple working checklist:

1. Identify whether you are a provider, a deployer, or both.
2. Add a visible disclosure for deployed deepfakes, shown at first exposure.
3. Apply machine-readable marking to generated outputs if you are a provider.
4. Document any artistic or editorial exemption you rely on.
5. Re-check obligations against Commission guidance, which is still evolving.

How the AI Act Compares With US Deepfake Laws

The EU and the United States take structurally different approaches to deepfakes.

The EU asks a transparency question first: is this synthetic, and is that disclosed? US law tends to ask a harm question: what was the deepfake used for? For the US picture, see our guides on whether deepfakes are illegal and deepfake laws by state. The two systems are not mutually exclusive: a single piece of content can trigger EU disclosure duties and US harm-based liability at the same time.

What This Means for Detection

Labels and watermarks help, but they do not solve the whole problem. A disclosure rule only works when people follow it, and bad actors do not. Unlabeled deepfakes, stripped watermarks, and adversarial content will keep circulating, which is exactly the gap that detection fills. Platforms, newsrooms, and businesses increasingly verify claims rather than trust them, checking whether a file is synthetic regardless of whether anyone labeled it.

That is the role of a detector. DeepfakeDetector.ai returns a whole-file verdict of Authentic, Likely Synthetic, or Inconclusive, paired with a TrustScore from 0 to 100, across image, video, and audio. For teams handling EU content duties at volume, API access starts at the Starter plan at $49 per month.

FAQ

Does the EU AI Act ban deepfakes?

No. The Act does not prohibit deepfakes; it requires that they be disclosed as artificially generated or manipulated under the Article 50 transparency rules.

Who must label deepfakes under the AI Act?

Deployers who use AI to create deepfakes must provide a visible disclosure, and providers of generating systems must mark synthetic outputs in a machine-readable way.

Are memes and parody exempt from the AI Act deepfake rules?

Not fully. Evidently artistic, satirical, or fictional work gets a lighter disclosure obligation that should not spoil the work, but the content still has to be disclosed as synthetic.

What is the penalty for not labeling a deepfake?

Breaching the Article 50 transparency duties can draw administrative fines of up to 15,000,000 EUR or up to 3% of worldwide annual turnover, whichever is higher, under Article 99.

Does the EU AI Act apply to US companies?

Yes, if the output reaches people in the EU. The Act applies to providers and deployers outside the EU when their AI system's output is used in the EU market.

Conclusion: Disclosure Is Now the Law of the EU Market

The EU AI Act deepfake rules turn a norm into a legal duty: if your synthetic media reaches the EU, say so. Deployers disclose visibly, providers mark outputs for machines, creative work gets a lighter touch, and the transparency obligations in Article 50 are scheduled to apply from 2 August 2026, backed by fines tied to turnover. The picture is still settling, with Commission guidance and a Code of Practice in progress, so treat dates and details as live and re-check them.

Labels are only half the answer, because the people most likely to ignore them are the ones you most need to catch. When the question is "is this real," you can check a suspicious image, video, or audio file free, 50 detections a month, no card required.

This article is general information, not legal advice. Last updated June 2026; provisions cited were verified against EUR-Lex and the European Commission at that date. Scheduled for re-review by September 2026.

Related reading