Who has to label AI content, and when.

Who is not a deployer. This list matters, because organisations routinely assume they are caught when they are not.

The reach extends beyond the Union. Providers established outside the EU are caught where the output of their system is used in the Union. Third-country deployers are caught where they foresee dissemination and use of the output in the Union — expressly including by posting deep fakes to the open internet — but not where content arrives through channels that are unforeseeable and outside their control.

Where you sit on the provider–deployer line, and how ordinary configuration decisions can move you across it, is the subject of its own guide: deployer or provider?

One further line, on research. AI systems developed and put into service for the sole purpose of scientific research fall outside the Act altogether, as does pre-market research, testing and development — except testing in real-world conditions, which remains in scope.

You do not need to have meant to mislead anyone. The assessment is objective and does not require any intention on the deployer’s part to deceive. A cheerful corporate video made in complete good faith is a deep fake if the four criteria are met.

Photorealism alone does not decide it, and neither does the absence of a real person. A wholly synthetic influencer who never existed is still a deep fake where they resemble someone who plausibly could. A real car in front of an AI-generated landscape is not.

“Permitted” carries two different meanings here, and conflating them is the most common error in the room.

Three points on the transition, because they are widely misstated. The window sits in Article 111(4), as inserted by Regulation (EU) 2026/1744 — not in Article 50 — and it runs for four months, not three. It covers the marking duty under Article 50(2) and nothing else: a system that is partly interactive and partly generative benefits from it only as regards marking, and the Article 50(1) interaction disclosure was due on 02-08-2026. Most commercial chat products are exactly that shape, so the window is not a general reprieve. And the new Article 5 prohibitions falling on the same day are a separate matter entirely.

The obligations are not retroactive. They attach to content generated or systems placed on the market from the applicable date, not to an archive.

Consequences. Breaches of Article 50 sit in the middle tier of the Act’s penalty regime: up to 3% of total worldwide annual turnover. Each ceiling has two limbs — a share of turnover and a fixed sum — and the higher of the two applies; for SMEs and start-ups it is the lower that applies instead. Beyond penalties, any person may lodge a complaint with the national market surveillance authority, and the label does nothing to cure illegality under other frameworks. The evidence that these regimes are in fact enforced is set out in hiding your AI system isn’t hiding the risk.

The voluntary Code. The Code of Practice on Transparency of AI-generated Content was published on 10-06-2026, received a Commission adequacy opinion on 08-07-2026 and was endorsed by the AI Board on 09-07-2026. Signing is not required, and not signing is not a breach — but adherence is the most direct way to demonstrate compliance to a supervisory authority. As at 31-07-2026 it had roughly 190 signatories.

One honest note, on what the Guidelines are worth. The Commission’s Guidelines of 20-07-2026 are formally non-binding, and they say so themselves. In practice they carry more weight than that label suggests. By publishing how it reads Article 50, the Commission limits its own discretion: under settled case law of the Court of Justice, an institution that adopts and announces rules for its own administrative practice cannot then depart from them in an individual case without breaching the general principles of equal treatment and the protection of legitimate expectations. In that sense the Guidelines bind their author. They do not bind national authorities or national courts — but most supervisory authorities can be expected to align their enforcement practice with the Commission’s stated position, and a national court must take that position into consideration. Authoritative interpretation of the Regulation itself remains with the Court of Justice.

Going to the sources. The Commission maintains a short public summary of these rules — Quick facts: transparency rules for AI systems — alongside the Guidelines and the Code of Practice themselves.