Many U.S. businesses assume that the EU AI Act mainly regulates developers of AI models and providers of high-risk AI systems. The European Union’s transparency rules for deepfakes tell a different story. Beginning on August 2, 2026, as matters currently state, Article 50(4) of the EU AI Act will impose disclosure obligations that may apply to businesses using AI-generated content in marketing, communications, training, customer engagement, and other everyday business activities. Recent draft (“almost final”) Guidelines published by the European Commission confirm that these obligations have a broad scope.
What Article 50(4) AI Act Requires
Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. Text may be covered by other Article 50 transparency rules (e.g., chatbot disclosure under Article 50(1)). The rule is broader than many businesses expect. It is not limited to fraudulent impersonations, election interference, or malicious misinformation. Instead, it covers realistic AI-generated or AI-manipulated content that may appear authentic to the public.
Importantly, the obligation applies to the business deploying the AI system—not only to the provider of the underlying model or tool. As a result, businesses using third-party AI solutions may have independent compliance obligations when making content available in the EU.
The Commission’s Draft Guidelines: A Broad Interpretation
The Commission’s draft Guidelines leave little doubt that the transparency obligation should be interpreted broadly: disclosures should be clear, prominent, and presented to individuals at the time they encounter the content. Businesses should not assume that a disclaimer buried in website terms or a general AI notice elsewhere will be sufficient.
The Guidelines also emphasize that the analysis should focus on how the content is perceived. The key question is whether an average person could reasonably believe the content to be authentic. If so, a disclosure obligation is likely to arise.
The Commission further clarifies that the rules are not confined to controversial or deceptive content. Ordinary commercial uses of generative AI may also fall within the scope of Article 50(4). The draft Guidelines also encourage the use of technical measures, including machine-readable markings and metadata, where feasible.
Common Business Uses That May Trigger Disclosure Obligations
Many businesses are already using AI in ways that may fall within the deepfake rules, including:
- AI-generated marketing videos featuring realistic human presenters who do not exist;
- AI-generated corporate spokespersons or brand ambassadors;
- AI-generated voiceovers that sound like real individuals;
- AI-manipulated videos that alter a person's appearance, speech, or actions;
- AI-generated photographs depicting events or situations that never actually occurred (“sphinx over the Eiffel tower”);
- Digital avatars used in customer-facing communications.
Not every use of AI-generated content will necessarily trigger a disclosure obligation. Businesses should carefully assess how the content is created and the extent of human involvement in the final output. In some cases, meaningful human oversight, review, editing, or creative control may affect whether the content qualifies as a deepfake within the meaning of Article 50(4). The analysis is highly fact-specific and should be documented as part of an organization's AI governance process.
The AI Act also provides a more flexible approach for content that is "obviously artistic, creative, satirical, fictional or analogous" in nature. Examples:
- Satirical or parody content (e.g., a comedy clip or “fake news” style sketch clearly meant as humor or critique)
- Fictional storytelling (e.g., films, ads, or narrative videos using AI-generated actors or scenes in a clearly staged plot)
- AI-generated art or installations (e.g., creative visual works presented as artistic expression, not real-world depiction)
In those cases, operators must still disclose that the content has been generated or manipulated by AI. However, the disclosure may be presented in a manner that does not interfere with the presentation, viewing, or enjoyment of the work itself.
Enforcement Risks
Violations of the AI Act’s transparency obligations may result in administrative fines of up to EUR 15 million or 3% of the offender’s total worldwide annual turnover, whichever is higher. In addition, failure to comply with transparency obligations may create exposure under national laws. Competitors, consumer organizations, or other qualified entities may argue that non-compliance constitutes an unfair commercial practice or an infringement of unfair competition rules, potentially leading to injunctions, litigation, and reputational harm. As enforcement of the AI Act begins to take shape, businesses should expect private enforcement theories to develop alongside regulatory oversight.
What Businesses Should Do Now
A practical first step is to identify where AI-generated media is already being used across marketing, communications, training, customer engagement, and social media activities. Businesses should then assess whether existing approval processes, content governance frameworks, and disclosure practices are sufficient to meet the AI Act’s requirements.
Businesses should also review contracts with AI vendors, establish internal guidance for marketing and communications teams, and determine whether technical measures such as metadata-based disclosures can be incorporated into existing workflows.
While a growing number of U.S. states have enacted AI-related legislation, those laws generally focus on specific areas such as elections, employment, consumer protection, or rights of publicity. The EU AI Act takes a significantly broader approach by imposing transparency obligations across a wide range of AI-generated content. Businesses that interact with the EU market should therefore not assume that compliance with U.S. law alone will be sufficient and observe further guidance on how to mark AI.
