EU AI Act deepfake labelling: what Article 50 requires

This page is part of the deepfake detection hub and sits beside the deepfake laws overview, which covers the United States, United Kingdom and China alongside the EU. It describes what the regulation's text says and where each statement sits; it does not interpret how the text applies to any situation.

01What does the regulation mean by a deep fake?

Article 3(60) of the regulation defines the term: a "deep fake" means "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (Regulation (EU) 2024/1689, Article 3). The definition has three parts that all have to hold: the content is AI-generated or manipulated, it resembles something that exists, and it would falsely appear authentic. Text is not in the definition; a separate sentence of Article 50(4) deals with text, described below.

The same article defines the two parties the duties fall on. A "provider" is a person or body that develops an AI system or has one developed and places it on the market or puts it into service under its own name, "whether for payment or free of charge" (Article 3(3)). A "deployer" is a person or body "using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity" (Article 3(4)). The personal use carve-out is in the definition of deployer itself, not in Article 50.

02What must providers do under Article 50(2)?

Article 50(2) reads: "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." The paragraph goes on to require that the technical solutions be "effective, interoperable, robust and reliable as far as this is technically feasible", taking into account the type of content, the cost of implementation and "the generally acknowledged state of the art, as may be reflected in relevant technical standards".

Recital 133 lists the kinds of technique the legislators had in mind: "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques". The Content Credentials page on this site describes the main metadata-and-signature approach in that list; the regulation itself names no standard. The provider duty covers text as well as audio, image and video, which is wider than the deep fake definition.

Article 50(2) states its own exceptions. The marking duty does not apply "to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences".

03What must deployers do under Article 50(4)?

The first sentence of Article 50(4) is the deepfake labelling rule: "Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated." Recital 134 describes the intended form as labelling the AI output and "disclosing its artificial origin", done "clearly and distinguishably".

Two exceptions follow in the same paragraph. The duty "shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence". And where the content "forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme", the duty is "limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work". Recital 134 adds that this limited form of disclosure should maintain "the utility and quality of the work".

A third sentence of Article 50(4) covers text rather than deep fakes: deployers of a system that generates or manipulates text "which is published with the purpose of informing the public on matters of public interest" disclose that the text was artificially generated or manipulated, unless the content "has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content", or the criminal law exception applies.

04When and how is the information given?

Article 50(5) sets the manner and the moment: the information under paragraphs 1 to 4 "shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and it "shall conform to the applicable accessibility requirements". Article 50(6) adds that paragraphs 1 to 4 do not affect the high-risk requirements of Chapter III and are "without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems".

Article 50(7) assigns the AI Office to "encourage and facilitate the drawing up of codes of practice at Union level" on "the detection and labelling of artificially generated or manipulated content", which the Commission may approve by implementing act, or replace with "common rules" if it finds a code inadequate. Article 96(1)(d) separately asks the Commission to issue guidelines on "the practical implementation of transparency obligations laid down in Article 50". The page records that these instruments are provided for; it does not record their content, because none was fetched for this page.

05What does Article 50 not cover?

Article 50 does not require anyone to run a detector, and it does not set an accuracy level that a marking or detection technique has to reach beyond the "technically feasible" standard in paragraph 2. It also says nothing about content made by a person without an AI system, and nothing about the criminal character of a deep fake itself; that question is handled by other laws, as the is a deepfake illegal page sets out by jurisdiction.

The regulation is also not a detection standard. The marking duty in Article 50(2) is a provenance measure, applied by the system that makes the content, while a detector works on content whose origin is unknown. The two approaches and their limits are compared on the provenance versus detection page listed below; the published detector figures that explain why the legislators wrote recital 133 around marking rather than detection are on the frame-level versus video-level AUC page and in the wider 25 paper reading list.

06Which dates and penalties does the text give?

Article 113 states that the regulation "shall apply from 2 August 2026", with earlier dates for Chapters I and II (2 February 2025) and for Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Article 78 (2 August 2025), and a later date for Article 6(1) (2 August 2027). Article 50 is the sole article of Chapter IV, which is not on either list, so it takes the general date of 2 August 2026. The regulation was signed at Brussels on 13 June 2024 and published in the Official Journal L series on 12 July 2024; the EUR-Lex record for the act gives 13 June 2024 as the document date and CELEX number 32024R1689 as the identifier.

Article 99(4) lists "transparency obligations for providers and deployers pursuant to Article 50" at point (g) among the infringements subject to "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". Article 99(6) caps fines on SMEs and start-ups at the lower of the two figures. Face recognition systems have their own provisions elsewhere in the regulation, outside this page; the MegaFace retirement page covers a different kind of constraint on face data, a benchmark withdrawn by its own authors.

A different regulatory model, the 2023 facial recognition provisions and the 2021 PIPL, is summarised on the China's facial recognition rules page.