The EU AI Act deepfake labelling requirements explained in one sentence are these: providers must make synthetic outputs machine-readable, while deployers must clearly tell people when image, audio or video content has been artificially generated or manipulated. The main transparency duties under Article 50 apply from 2 August 2026, so organisations still have time to prepare, but not much room for vague policies.
That distinction matters. A company creating an AI avatar, a marketing agency editing a politician’s voice and a platform hosting the resulting clip may carry different responsibilities. The rules are not a blanket instruction to place a large “deepfake” warning on every piece of edited media.
What the EU AI Act actually says about deepfakes
Article 50 of the EU AI Act deals with transparency. It separates the duties of providers from those of deployers, which is the first point many compliance teams miss.
- Providers of AI systems that generate synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, where technically feasible and proportionate.
- Deployers using an AI system to generate or manipulate image, audio or video content that constitutes a deepfake must disclose that the content has been artificially generated or manipulated.
- The disclosure must be clear, distinguishable and presented no later than the first exposure to the content.
- Providers and deployers must consider the rights and interests of affected people, including privacy and data protection obligations.
A deepfake is not limited to a wholly invented video. The definition covers content that appears authentic or truthful but has been generated or manipulated by AI. A real interview with a synthetic voiceover could therefore fall within the rule if the result gives viewers a misleading impression.
The Act also covers synthetic text published to inform the public about matters of public interest. That duty does not apply in the same way when the text has gone through human review or editorial control and a person or organisation holds editorial responsibility. The exemption is narrow in practice. A quick click-through by an employee is unlikely to be enough if nobody checks the substance.
Who must label AI-generated or manipulated content?
The answer depends on your role in the chain. The table below gives a practical reading of the Article 50 duties rather than a substitute for legal advice.
| Organisation or role | Likely duty | Practical control |
|---|---|---|
| AI model or tool provider | Make synthetic outputs detectable and machine-readable | Metadata, watermarking, provenance records and technical documentation |
| Brand, employer or agency using an AI tool | Disclose qualifying deepfake content clearly to viewers | On-screen label, caption, voice disclosure or accompanying notice |
| Publisher or media organisation | Apply transparency and retain editorial accountability | Human review, content records and a documented approval process |
| Online platform | Support transparency and manage wider platform obligations | Upload rules, reporting routes, moderation and provenance handling |
There is an important practical point here. Buying a subscription to an AI video tool does not automatically make your organisation a provider of an AI system. In many cases, you will be the deployer. You still need to assess what the tool produces, how the public will encounter it and whether the label survives cropping, reposting or platform compression.
For teams worried about impersonation rather than marketing, read our guide to how deepfake scams work and how to avoid them before setting your controls. Fraud prevention and Article 50 compliance overlap, but they are not the same exercise.
What counts as a clear deepfake label?
The EU AI Act does not prescribe one universal phrase, font or icon. The disclosure must be clear, distinguishable and understandable to the people who see or hear the content.
For a video, a visible label such as “AI-generated video” or “This voice and image have been digitally manipulated” is more defensible than a barely readable note hidden in a description. For audio, the disclosure should be heard before or at the start of playback, with a written equivalent where the content is also presented visually.
Labels should survive normal distribution. If your only disclosure sits in metadata, it may disappear when somebody downloads and uploads the file to another service. Metadata still matters, but it should sit alongside a human-readable notice for public-facing content.
Provenance standards can help. The C2PA content provenance standard provides a technical way to record how media was created and edited. It does not remove the need for a visible disclosure, and it cannot prove that every claim in a video is true.
When artistic and satirical content is treated differently
The Act recognises artistic, satirical and fictional work. The disclosure still applies, but it must be presented in a way that does not undermine the work or prevent people from enjoying it. A label in opening credits, a clear programme note or a platform notice may be suitable, depending on the format.
That is not a free pass for political deception. Calling a fabricated election video satire after it has been presented as a genuine statement would be a poor compliance position and an even worse public-relations defence.
Deadlines and the position of UK organisations
The EU AI Act entered into force on 1 August 2024. Most Article 50 transparency obligations apply from 2 August 2026. Some other provisions, including bans on certain unacceptable-risk practices and AI literacy duties, apply earlier, while the wider high-risk system timetable extends beyond 2026.
A UK organisation does not escape the Act simply because it is incorporated in Britain. The Act can apply where an AI system is placed on the EU market, where its output is used in the EU, or where an organisation operating in the EU is affected by the system. The precise territorial test depends on the activity and the role involved.
The UK has not copied Article 50 into a single general deepfake labelling law. UK organisations must instead consider a combination of the Online Safety Act 2023, the UK GDPR, the Data Protection Act 2018, consumer protection law, defamation risk and sector-specific duties.
Ofcom is the regulator responsible for many Online Safety Act duties for in-scope services. Its online safety guidance and regulatory work is particularly relevant to platforms dealing with manipulated media, user reports and illegal content. The Act does not turn every UK business into an Ofcom-regulated platform, though.
The ICO’s consultation series on generative AI and data protection, published from 2023 onwards, is also relevant where a deepfake uses a person’s face, voice or other identifiable information. Under UK GDPR terminology, an organisation may be a controller or processor, and a face or voice can amount to personal data. Biometric data receives additional protection when it is processed for uniquely identifying a person.
Do not confuse this with a general right to create a person’s likeness. Consent, transparency, lawful basis, purpose limitation and security still matter. Our guide on whether it is illegal to make deepfakes without consent covers the UK position in more detail.
How UK businesses should prepare
Start with an inventory, not a slogan. List every system that can generate or alter a person’s image, voice or video, including marketing tools, video conferencing features, translation software and internal experiments.
- Record the provider, model, version, intended use and output types.
- Classify whether your organisation is acting as provider, deployer, distributor, publisher or more than one of these.
- Set a written rule for when a visible and audible disclosure is required.
- Keep the original file, prompts, source footage, approvals and edits for high-risk campaigns.
- Test whether labels remain visible after resizing, compression, cropping and reposting.
- Give staff a route for escalating suspected impersonation, non-consensual content and urgent fraud.
Use an approval gate for content featuring senior leaders, public officials, customers or vulnerable people. A second person should check identity, consent, factual claims and the wording of the disclosure before publication.
For live meetings, labelling is only one control. Combine it with call-back procedures, payment verification and technical checks. Our guide to real-time deepfake detection for video calls explains where detection tools fit, and where they fail.
If your organisation needs help turning Article 50 into an internal process, you can speak to our team about a practical deepfake risk review.
Detection, provenance and consent are separate controls
Labelling tells the audience what happened to the media. It does not confirm that the person depicted agreed to the work, that the message is accurate or that the file has not been altered again.
Detection tools have a role in triage, particularly when staff receive suspicious executive voice notes or urgent payment instructions. They should not be treated as a final legal test. A detector can produce false positives, miss new generation methods or struggle with a low-quality copy.
Use layered evidence instead: source verification, a known contact route, file history, consent records and human review. The UK National Cyber Security Centre offers wider guidance on cyber security and social-engineering risks that should sit alongside your synthetic-media procedure.
There is also a privacy question. Do not collect face or voice samples for detection without a clear purpose, appropriate security and a defensible lawful basis. A system designed to protect employees can create a new biometric-data risk if it quietly stores recordings of every meeting.
What good compliance looks like in practice
A sensible policy is short enough for a marketing manager to use and specific enough for an auditor to test. It should state which content needs labelling, who approves it, what wording is acceptable, how provenance is retained and what happens when consent is withdrawn.
For public campaigns, publish the disclosure where the audience will actually see it. For internal training, keep the label visible in the original file and in the learning platform. For satire or fictional work, explain the use of AI without making the notice so intrusive that it obscures the creative purpose.
Keep an eye on EU guidance as Article 50 approaches. Technical standards and industry practice may develop before the deadline, but waiting for a perfect template is a mistake. The defensible position is to show that your organisation identified the risk, chose proportionate controls and reviewed them as tools changed.
Need a second opinion on a planned campaign, executive protection process or supplier contract? Contact us for a focused synthetic-media compliance discussion, rather than commissioning a broad policy that nobody uses.
Frequently asked questions
Does every AI-generated image need a deepfake label?
No. Article 50 is aimed at synthetic or manipulated content that may appear authentic, with specific duties for AI-generated or manipulated image, audio and video that constitutes a deepfake. A clearly fictional illustration may still need transparency under the relevant circumstances, so organisations should assess context, audience and likely interpretation.
Does the EU AI Act apply to a UK company?
It can. The Act may apply when a system or its output is placed on the EU market, used in the EU, or affects people in the EU, depending on the organisation’s role and the activity. A UK company selling AI video services to EU customers should obtain tailored advice rather than assume UK incorporation is decisive.
Is a watermark enough to comply?
Not necessarily. A machine-readable watermark or provenance record may support the provider’s technical obligation, but deployers also need a clear, distinguishable disclosure for qualifying deepfake content. A label that disappears when a video is downloaded or reposted is a weak control, even if the original file contained metadata.
Can satire be exempt from labelling?
Satirical, artistic and fictional content receives specific treatment, but it is not a blanket exemption from transparency. The disclosure should be adapted so it does not undermine the work or spoil the audience’s experience. Content presented as a genuine statement, especially during an election or crisis, is much harder to defend as satire.
Frequently asked questions
Does every AI-generated image need a deepfake label?
No. Article 50 is aimed at synthetic or manipulated content that may appear authentic, with specific duties for AI-generated or manipulated image, audio and video that constitutes a deepfake. A clearly fictional illustration may still need transparency under the relevant circumstances, so organisations should assess context, audience and likely interpretation.
Does the EU AI Act apply to a UK company?
It can. The Act may apply when a system or its output is placed on the EU market, used in the EU, or affects people in the EU, depending on the organisation’s role and the activity. A UK company selling AI video services to EU customers should obtain tailored advice rather than assume UK incorporation is decisive.
Is a watermark enough to comply?
Not necessarily. A machine-readable watermark or provenance record may support the provider’s technical obligation, but deployers also need a clear, distinguishable disclosure for qualifying deepfake content. A label that disappears when a video is downloaded or reposted is a weak control, even if the original file contained metadata.
Can satire be exempt from labelling?
Satirical, artistic and fictional content receives specific treatment, but it is not a blanket exemption from transparency. The disclosure should be adapted so it does not undermine the work or spoil the audience’s experience. Content presented as a genuine statement, especially during an election or crisis, is much harder to defend as satire.
