EU AI Act Deepfake and AI-Generated Content Compliance

Under Article 50 of the EU AI Act, organizations that use AI to generate or manipulate image, audio, or video content that constitutes a deepfake must disclose that the content is artificially generated or manipulated. These transparency obligations have been enforceable since 2 August 2026. They sit alongside GDPR rather than replacing it, because deepfakes involving real people also process personal data. Engage Compliance helps Seed to Series C companies map their AI features against Article 50, set up disclosure and labeling, and align the work with their existing GDPR program.

By Julian Gage Last reviewed: 9 October 2026

Key takeaways

Under Article 50(4), deployers using AI to create deepfake image, audio, or video must disclose that the content is artificially generated, clearly and at the point a person encounters it.
Article 50 applies from 2 August 2026 (deployer disclosure, chatbot transparency, and provider machine-readable marking); under the Digital Omnibus, now formally adopted, generative AI systems already on the market before 2 August 2026 get a grace period to 2 December 2026 for the marking obligation.
The Act does not ban AI-generated or deepfake content in general (apart from the ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material, from 2 December 2026); it requires transparency, with a lighter regime for evidently artistic, creative, satirical, or fictional work.
A deepfake of a real person almost always processes personal data, often biometric, so GDPR applies in parallel, requiring a lawful basis, transparency, and frequently a DPIA.
We run an AI feature inventory, classify each feature against Article 50, design disclosure and labeling, and fold it into your GDPR program (From €600 per month Privacy Advisory, From €1,000 per month named DPO).
Engage Compliance advises on Article 50 marking for generative systems alongside the GDPR work on the same product.

What Article 50 requires for deepfakes

Article 50(4) places the disclosure duty on deployers: anyone using an AI system to create or manipulate deepfake image, audio, or video must disclose that it is artificially generated, clearly and at the point a person encounters it. A separate duty under Article 50(2) covers providers of generative AI systems, who must mark outputs in a machine-readable format so they are detectable as AI-generated; this marking obligation applies from 2 August 2026, with a grace period to 2 December 2026 for generative AI systems already on the market before then (under the Digital Omnibus, now formally adopted). Chatbots must also tell users they are interacting with AI, enforceable from 2 August 2026.

There are limited carve-outs. Content that is part of an evidently artistic, creative, satirical, or fictional work gets a lighter regime, where a minimal, non-intrusive disclosure is enough. Use authorized by law for detecting or investigating crime is exempt. A voluntary Code of Practice on Transparency of AI-generated Content was finalized in 2026, and the EU has published a set of icons deployers may use to label AI-generated content.

Who has to comply

The rules reach far beyond AI labs. If your product or marketing generates or alters realistic media, you likely have obligations. Common cases: SaaS products with generative image, voice, or video features; marketing and content tools that produce synthetic media; HR tech that uses AI to generate or alter candidate-facing content; ecommerce using AI-generated product imagery or virtual try-on; and any team publishing AI-altered media that depicts real people.

A deepfake that resembles a real person almost always processes personal data, and where it uses facial or voice characteristics it can involve special category data. You still need a lawful basis, clear transparency to the person depicted, and in many cases a Data Protection Impact Assessment. This is why AI Act readiness should sit with whoever owns privacy, so the disclosure, lawful basis, and risk assessment are joined up rather than handled as a separate legal exercise.

Key deadlines and what to do now

Article 50 applies from 2 August 2026: deployer deepfake disclosure (Art 50(4)), chatbot transparency (Art 50(1)), and provider machine-readable marking for generative AI outputs (Art 50(2)). The Digital Omnibus (now formally adopted) adds a grace period to 2 December 2026 for the marking obligation, but only for generative AI systems already on the market before 2 August 2026.

Inventory every AI feature in your product and marketing that generates or alters media. Classify each against the Article 50 categories: chatbot, generative output, deepfake, emotion, or biometric. Disclosure and labeling at first exposure is required now, so close any gap as a priority if it is not yet in place. Generative AI providers need machine-readable marking on outputs, and systems already on the market before 2 August 2026 have a grace period to 2 December 2026 under the Digital Omnibus, now formally adopted. Run a DPIA where real people are depicted and document your lawful basis. Check your approach against the Code of Practice and the EU icons.

How we help with AI Act readiness

We run an AI feature inventory, classify each feature against Article 50, design the disclosure and labeling approach, complete the DPIA where personal data is involved, and fold it all into your GDPR program, so you have one coherent privacy and AI governance setup rather than two disconnected ones. From €600 per month (Privacy Advisory). From €1,000 per month (named DPO).

This page is general information about the EU AI Act and is not legal advice. We provide framework readiness and program support, working with your legal counsel where formal legal opinions are required.

EU AI Act deepfake FAQ

What does the EU AI Act require for deepfakes?

It requires deployers who use AI to create deepfake image, audio, or video to disclose that the content is artificially generated or manipulated, clearly and at the point people see it. Providers of generative AI must also mark outputs so they are machine-detectable.

When do EU AI Act deepfake rules take effect?

All Article 50 transparency obligations apply from 2 August 2026: deployer deepfake disclosure (Article 50(4)), chatbot transparency (Article 50(1)), and provider machine-readable marking of generative AI outputs (Article 50(2)). Under the Digital Omnibus (formally adopted, with the Council’s final green light on 29 June 2026), providers of generative AI systems already on the market before 2 August 2026 get a grace period to 2 December 2026 for the marking obligation; systems placed on the market from 2 August 2026 must comply from that date.

Is AI-generated content allowed under the EU AI Act if it is disclosed?

Yes. The Act does not ban AI-generated or deepfake content in general (from 2 December 2026 it does ban AI systems that generate non-consensual intimate imagery or child sexual abuse material); it requires transparency. As long as you disclose and, for generative outputs, mark the content as AI-generated, you can use it, with a lighter regime for clearly artistic or satirical work.

Do deepfake rules apply if we only use AI images in marketing?

If those images realistically depict real people or events in a way that could appear authentic, the disclosure duty can apply. Purely synthetic, obviously unreal imagery carries less risk, but it is worth classifying each use to be sure.

How do GDPR and the EU AI Act overlap on deepfakes?

A deepfake of a real person also processes personal data, often biometric, so GDPR applies in parallel: you need a lawful basis, transparency, and frequently a DPIA, on top of the AI Act disclosure. Handling both together is far simpler than treating them separately.

Sources and references

Regulation (EU) 2024/1689 (EU AI Act), official text, EUR-Lex
Regulation (EU) 2026/1744 (Digital Omnibus on AI), official text, EUR-Lex
Code of Practice on Transparency of AI-generated Content, European Commission
AI Act: regulatory framework for AI, European Commission
AI Act Service Desk, European Commission

Get your DPO plan and price Book a free intro call

FAQ

Frequently asked questions

What does the EU AI Act require for deepfakes?

When do EU AI Act deepfake rules take effect?

All Article 50 transparency obligations apply from 2 August 2026: deployer deepfake disclosure (Article 50(4)), chatbot transparency (Article 50(1)), and provider machine-readable marking of generative AI outputs (Article 50(2)). Under the Digital Omnibus (formally adopted, with the Council's final green light on 29 June 2026), providers of generative AI systems already on the market before 2 August 2026 get a grace period to 2 December 2026 for the marking obligation; systems placed on the market from 2 August 2026 must comply from that date.

Is AI-generated content allowed under the EU AI Act if it is disclosed?

Do deepfake rules apply if we only use AI images in marketing?

How do GDPR and the EU AI Act overlap on deepfakes?

Who has to comply with the Article 50 deepfake rules?

Far more companies than AI labs. Typical cases are SaaS products with generative image, voice or video features, marketing and content tools that produce synthetic media, HR tech that generates or alters candidate-facing content, ecommerce using AI product imagery or virtual try-on, and any team publishing AI-altered media of real people.

What is the difference between the deployer duty and the provider duty?

The deployer, meaning whoever uses an AI system to create or manipulate deepfake content, has to disclose it under Article 50(4). The provider of a generative AI system has a separate duty under Article 50(2) to mark outputs in a machine-readable format so they can be detected as AI-generated. A company that builds and also publishes can carry both.

Are artistic, satirical or fictional deepfakes exempt?

Not fully. Content that is part of an evidently artistic, creative, satirical or fictional work gets a lighter regime, where a minimal, non-intrusive disclosure is enough. The separate exemption is for use authorized by law to detect or investigate crime.

Do chatbots have to tell users they are talking to AI?

Yes. Under Article 50(1), chatbots must tell users they are interacting with AI, and that has applied since 2 August 2026, the same date as the deployer deepfake disclosure.

Is there an official label or icon for AI-generated content?

The EU has published a set of icons deployers may use to label AI-generated content, and a voluntary Code of Practice on Transparency of AI-generated Content was finalized in 2026. Check your labeling approach against both.

What should we do first to comply with Article 50?

Inventory every AI feature in your product and marketing that generates or alters media, then classify each one against the Article 50 categories (chatbot, generative output, deepfake, emotion or biometric). Close any disclosure gap first, since it is required now, then run a DPIA where real people are depicted and document your lawful basis.

Can Engage help us get Article 50 ready?

Yes. We run the AI feature inventory, classify each feature against Article 50, design the disclosure and labeling approach, complete the DPIA where personal data is involved, and fold it into your GDPR program. We work with your legal counsel where a formal legal opinion is needed. See our EU AI Act compliance services.