EU Deepfake Labels Already Apply. What Changes Dec. 2

In the EU, labeling deepfakes is already mandatory. It has been since August 2, 2026. Article 50 of the EU AI Act (Regulation (EU) 2024/1689) requires those who use AI to create deepfakes (deployers) to disclose that the content was generated or manipulated by AI. Chatbot providers must design their systems so users can tell they're talking to an AI. On the European Commission's AI Act Service Desk timeline, the August 2 entry reads: "Transparency rules (Article 50) start to apply." The amending Regulation (EU) 2026/1744, published in the EU's Official Journal on July 24, gave just one piece of that until December 2.

Two things happen on December 2. First, a grace period ends: providers of generative AI that reached the EU market before August 2 have until that day to put machine-readable marking in place. Second, a new ban applies. "AI Omnibus" is the nickname for 2026/1744. In its July 31 press release IP/26/1714, the Commission said: "The AI Omnibus introduces new prohibitions on AI systems that generate non-consensual sexually explicit content and child sexual abuse material. These rules will apply from 2 December 2026." The ban does come with conditions, though.

What changes on December 2, and what already has

Article 50(1) through (4) cover, in order, disclosure for AI that interacts with people, machine-readable marking, emotion recognition and biometric categorization notice, and disclosure of deepfakes and of AI text on matters of public interest. Of those four, only Article 50(2) still has time left until December 2. Even that applies only to providers of generative AI systems placed on the EU market before August 2. A provider is the party that develops an AI system, or has one developed, and releases it under its own name or trademark. A deployer is the party that uses an AI system under its authority, excluding personal, non-professional use. Companies outside the EU are covered too if they place an AI system on the EU market or if its output is used in the EU. To check whether your AI system qualifies for this grace period, see the three questions in the PRISM Insight at the end of this article.

Status	When	What	Basis
Already applies	From August 2, 2026	Disclosure for AI that interacts with people (Art. 50(1)); machine-readable marking of synthetic content (Art. 50(2), for systems placed on the EU market on or after Aug. 2); emotion recognition and biometric categorization notice (Art. 50(3)); disclosure of deepfakes and of AI text on matters of public interest (Art. 50(4))	Commission timeline; 2024/1689, Art. 50
From December 2	December 2, 2026	(1) End of the Art. 50(2) grace period for providers of generative AI placed on the EU market before Aug. 2 (Art. 111(4)); (2) ban on AI that generates non-consensual sexual deepfakes or child sexual abuse material (Art. 5(1)(ba), (bb))	2026/1744
Postponed	December 2, 2027 / August 2, 2028	High-risk AI rules (Annex III / Annex I)	Art. 113 (as amended by 2026/1744); Commission timeline

Machine-readable marking (Article 50(2)) is the provider's job. Providers must ensure their AI outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated." Put simply, it's a mark that software can read to tell whether content is AI-generated. There are exceptions where the AI performs an assistive function for standard editing or doesn't substantially alter the input data.

Article 3(60) defines a deepfake as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful." The Commission's Article 50 guidelines (C(2026) 5054), issued July 20, say that using AI to generate or manipulate "essential elements that impact audience perception" is likely to make content pass as authentic. Examples include fully AI-generated actors, digital replicas of real or deceased actors, and de-aging. Background scenes and special effects in standard movie production are unlikely to do so.

If a deepfake is evidently part of an artistic, creative, satirical or fictional work, the deployer only has to disclose that generated or manipulated content exists, in an appropriate way that doesn't hamper the display or enjoyment of the work (Article 50(4)). AI-generated text published to inform the public on matters of public interest also falls under Article 50(4)'s disclosure duty. That text disclosure isn't required, however, if the content has gone through human review or editorial control and someone holds editorial responsibility for publishing it.

The grace period needs all four conditions

The December 2 grace period rests on Article 111(4), a new paragraph inserted by 2026/1744: "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026." General-purpose AI is AI that can serve a wide range of uses.

There are four conditions: (1) placed on the EU market before August 2; (2) an AI system that generates synthetic content; (3) you're that system's provider; (4) the obligation is Article 50(2) machine-readable marking. All four must hold for the grace period to apply. Recital 38 of the amending regulation (recitals are the preamble explaining a law's purpose) calls it "a transitional period of four months."

Article 3(9) defines "placing on the market" as "the first making available of an AI system or a general-purpose AI model on the Union market." Generative AI systems first placed on the EU market on or after August 2 get no grace period. They have to comply with Article 50(2) from launch day. Article 111(4), Recital 38 and the guidelines' explanation of the transitional period contain no language covering a service that was placed on the EU market before August 2 and later gained a generative feature. Under the guidelines, a company that takes another provider's generative AI system, "modifies that system (e.g. with new training data)" and then puts it into service under its own name "becomes a provider of the new system." The source texts PRISM checked aren't enough, on their own, to say whether the grace period carries over when a provider adds features to its own system.

The same guidelines single out hybrid services: "Systems that are partly interactive and partly generative may benefit from this transitional period only with regard to the marking obligation under Article 50(2) AI Act, while compliance with the disclosure obligation for AI systems directly interacting with natural persons must be ensured as of 2 August 2026." So a chatbot that also generates images has owed its interactive-AI disclosure since August.

There's no duty to label pre-August 2 deepfakes retroactively. The Commission's Quick facts page says: "Deepfakes generated before 2 August 2026: no mandatory retroactive labelling but encouraged." Public-interest text is a different story. According to the guidelines, public-interest text generated or manipulated before August 2 still needs a label if it's published on or after that date.

Who's covered: providers and deployers

Article 50 splits its obligations between two parties: the provider, which builds an AI system and brings it to market, and the deployer, which takes an AI system and puts it to use.

	Provider	Deployer
Who (Art. 3(3), (4))	A natural or legal person, public authority, agency or other body that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark (paid or free)	A natural or legal person, public authority, agency or other body using an AI system under its authority (personal, non-professional use excluded)
Article 50 duties	Interactive-AI disclosure (Art. 50(1)), machine-readable marking (Art. 50(2))	Emotion recognition and biometric categorization notice (Art. 50(3)), deepfake disclosure and notice for AI text on matters of public interest (Art. 50(4))
December 2 grace period	Art. 50(2) only, for systems placed on the EU market before Aug. 2	None
Companies outside the EU	Covered when placing on the EU market, wherever they're based (Art. 2(1)(a)); covered if output is used in the EU ((c))	Covered if output is used in the EU ((c))
Example (hypothetical)	An Asian app that offers its own image-generation feature to EU users	A gaming or webtoon (vertical-scroll digital comic) service that shows EU users a deepfake video made with someone else's generative model API

Article 2(1)(a) covers providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country." Point (c) brings in providers and deployers outside the EU whenever their AI output is used in the EU. The AI Act's provisions requiring non-EU providers to appoint an EU authorized representative sit in the rules for high-risk AI (Article 22) and general-purpose AI models (Article 54). Article 50 has no such provision.

Under the guidelines, a deployer outside the EU takes on these obligations when it foresees its output being distributed and used in the EU. That covers directing or authorizing distribution within the EU, "including by posting deep fakes on the globally accessible internet." In other words, simply posting a deepfake on the open web, where anyone can see it, is enough for the deployer to be treated as having foreseen its distribution and use in the EU. If content reaches the EU through "channels that are unforeseeable and outside their control," the deployer isn't bound. The guidelines also give an example involving a company outside the EU: "a company established in a third country that uses an AI system to generate a deep fake of a celebrity featured in an advertisement displayed in the Union is also a deployer falling within the scope of the AI Act."

Advertise with Us

[email protected]

Enforcement is split, too. The Commission's AI Office handles AI systems offered by the same provider as the underlying general-purpose AI model, along with systems integrated into very large online platforms and search engines designated under the Digital Services Act (DSA). Even for a system from the same provider as the underlying model, though, the AI Office oversees the deployer duties in Article 50(3) and (4) only when that provider is also the deployer (guidelines, footnote 47). National authorities handle all other AI systems, and the European Data Protection Supervisor (EDPS) covers AI systems used by EU institutions (IP/26/1714).

Breaching Article 50 can bring a fine of up to €15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(g)). Small and medium-sized enterprises (SMEs) and startups get whichever amount is lower under the existing Article 99(6). Small mid-cap companies (SMCs) get the same treatment under paragraph 6a, newly added by 2026/1744.

What the new December 2 ban blocks

Article 5 collects the AI practices the EU bans outright. The existing bans have applied since February 2, 2025. Regulation 2026/1744 added points (ba) and (bb) to Article 5(1), plus new paragraphs 1a and 1b. Article 113 sets December 2, 2026, as the date this part applies.

Point (ba) targets AI systems that generate or manipulate realistic images, video, audio or similar material showing an identifiable person's intimate parts, or showing that person engaged in sexually explicit activities. Placing on the market, putting into service or using an AI system that produces such content without the person's consent is banned. That consent has to be "freely-given, specific, informed, unambiguous and explicit." Point (bb) covers AI systems that generate or manipulate material under Article 2, points (c) and (e), of the EU's child sexual abuse directive (2011/93/EU). It carves out cases "where a 'without right' defence applies under national law."

The ban comes with conditions. Under paragraphs 1a and 1b, placing such a system on the market or putting it into service is banned in only two cases: when that generation or manipulation is "the intended purpose of the AI system," or when it's "a reasonably foreseeable and reproducible outcome" and the system lacks "reasonable and adequate technical safety measures." Use is banned only when a deployer "uses the system for the purpose of generating or manipulating such material."

Violating the new points counts as breaching an Article 5 ban, so Article 99(3) applies: fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Regulation 2026/1744 left that paragraph untouched. Under the existing Article 99(6), SMEs and startups get the lower of the two amounts even for violating a ban. The SMC carve-out (paragraph 6a) only covers fines under paragraphs 4 and 5.

No harmonized standard for labeling yet: the code and the guidelines

On October 19, the EU's Official Journal published EN 18286, the first harmonized standard under the AI Act. Harmonized standards are official EU standards. Following one means you're presumed to meet the requirements it covers. EN 18286 is a quality management system standard for high-risk AI providers (Article 17). It has nothing to do with Article 50's labeling duties (Commission notice).

The official tool for the labeling duties is the Code of Practice on Transparency of AI-generated Content. Signing is voluntary, and the code was published in June 2026. On July 8, the Commission concluded that the code "adequately covers the obligations provided for in Articles 50(2), (4) and (5) AI Act" (Commission opinion). Article 50(5) requires disclosures to be clear and distinguishable, at the latest at the first interaction or exposure. Article 50(1) (interactive-AI disclosure) and Article 50(3) (emotion recognition and biometric categorization notice) aren't part of that conclusion. The same opinion states: "Adherence to the code does not constitute conclusive evidence of compliance with these obligations." The recitals of amending Regulation 2026/1744 state that codes of practice "have limited legal effect, and in particular do not grant a presumption of conformity."

The code has two sections: Section 1 for providers and Section 2 for deployers. The Commission said about 190 organizations had signed by the end of July (Commission news).

On October 5, OpenAI said in a post on its approach to EU text provenance rules: "Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union."

Divided views

In the July 31 press release, Commission Executive Vice-President Henna Virkkunen put legal certainty up front: "With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI—one that gives innovators legal certainty while protecting the public interest." (IP/26/1714)

On May 7, the day European Parliament and Council negotiators agreed on the final text of the AI Omnibus, industry group CCIA Europe said in a same-day statement that companies wouldn't have enough time to get ready. It said "co-legislators failed to introduce a pragmatic 12-month grace period for the labelling and marking of generative AI outputs under Article 50(2) and (4) of the AI Act," and that AI developers and deployers "will have almost no time to comply by 2 August" (statement). CCIA's 12-month ask covered Article 50(2) and (4) in full. The four-month transition in the final text, adopted July 8, applies only to Article 50(2), and only for providers that launched before August 2.

Broadcasters and advertisers worried about how far labeling would reach. On June 17, the European Broadcasting Union (EBU) and seven private broadcasting and advertising sales groups sent a joint letter to Virkkunen about the draft guidelines the Commission had released in May. "The draft defines deepfakes so broadly that broadcasters could end up labelling large amounts of non-deceptive content," said Sophia Wistehube, senior legal counsel at the EBU. "If warning messages become ubiquitous, people will stop noticing them, and labels will lose their meaning exactly where it matters most." (EBU)

Civil society group AlgorithmWatch welcomed the new ban. In an April 30 post, before the final text was agreed, it wrote: "A ban on AI systems that allow the creation of non-consensual sexualized deepfakes is one of the few positive proposals that are negotiated within the Omnibus." It also set conditions: "Consent must be clearly defined, liability must be assigned unambiguously, and safeguards must be appropriate so that legitimate use and open-source development of AI systems are not hindered" (post). The final text of point (ba) spells out five consent requirements.

December 2 as seen from Seoul, Tokyo, Taipei and Beijing

South Korea and mainland China already enforce their own labeling rules, while in Japan and Taiwan the EU timeline has been relayed by local agencies and media. South Korea's AI Basic Act (formally the Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust, PRISM translation) took effect on January 22, 2026. Article 31(2) requires AI business operators that provide generative AI, or products and services that use it, to indicate that the output was generated by generative AI (National Law Information Center).

JETRO (Japan External Trade Organization), a Japanese government-affiliated trade promotion agency, relayed the Commission's publication of the code to Japanese businesses on June 17 (JETRO).

Taiwan's Central News Agency (CNA) reported on July 28 that the EU's new transparency rules apply from August 2, with a grace period for existing AI systems that requires companies to comply before December 2 at the latest (CNA). CNA described the grace period as covering existing AI systems in general. Under the regulation's text, it covers only providers' Article 50(2) marking (Article 111(4)).

Mainland China has enforced its Measures for Labeling AI-Generated Synthetic Content (人工智能生成合成内容标识办法, PRISM translation) since September 1, 2025. The rules distinguish explicit labels (显式) that users can clearly notice from implicit labels (隐式) that are embedded in file data through technical measures and aren't readily noticeable (more in Part 2).

The code's signatory list, updated September 24, shows 95 signatories for Section 1 and 192 for Section 2. Those are per-section counts. The roughly 190 mentioned earlier is the number of organizations the Commission said had signed by the end of July, so the two figures differ in both date and counting method. Among Japanese companies, NTT signed both sections and Dentsu signed Section 2. NTT and Lenovo each signed both sections, so adding the two section counts together won't give you the number of organizations. PRISM also looked for Samsung, LG, Naver and Kakao (South Korea) and ASUS, Acer, HTC and Foxconn (Taiwan); none of those names was on the list. Signing the code is voluntary, so a company's absence from the list doesn't change its Article 50 obligations.

PRISM Insight

"Reader Impact"

Can you wait until December 2? Three questions decide

(Starting point) This assumes you're within Article 50's reach because you've placed a system on the EU market or its output is used in the EU (Article 2(1)(a) and (c)).

1. Did you first place that generative AI system on the EU market before August 2? The test is Article 3(9)'s "first making available" on the Union market. The date you launched in your home market doesn't count here. If you placed a service on the EU market before August 2 and added a generative feature later, the source texts PRISM checked set no test for that case. 2. Are you the system's provider? Deployers' deepfake disclosure duty has no grace period. 3. Is the remaining task Article 50(2) machine-readable marking? Interactive-AI disclosure (Article 50(1)) and deepfake disclosure (Article 50(4)) have been mandatory since August 2.

Only if all three answers are yes do you have until December 2 for Article 50(2) marking. If any answer is no, the grace period doesn't apply. Your obligations run from August 2, or from your EU launch date if that came later.

The ban that starts December 2 needs a separate check. If generating non-consensual sexual images is the system's intended purpose, or that outcome is reasonably foreseeable and reproducible and the system lacks reasonable and adequate technical safety measures, placing it on the EU market or putting it into service is banned from that day (Article 5(1a)).

Next (November 12): what Chinese and EU labels actually look like. Part 3 (November 19) covers penalties in Korea and Taiwan, and Part 4 (November 26) covers Japan plus a checklist.

As of: 2026-11-05 KST, Commission timeline and EUR-Lex texts

Sources

European Commission AI Act Service Desk, "Timeline for the implementation of the EU AI Act," accessed 2026-11-03, https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
EUR-Lex, Regulation (EU) 2026/1744 (AI Omnibus), adopted 2026-07-08, published in the Official Journal 2026-07-24, https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
EUR-Lex, Regulation (EU) 2024/1689 (AI Act), original published text, accessed 2026-11-03, https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
European Commission, press release IP/26/1714, 2026-07-31, https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_26_1714/IP_26_1714_EN.pdf
European Commission, guidelines on the Article 50 transparency obligations, C(2026) 5054, 2026-07-20, https://ai-act-service-desk.ec.europa.eu/sites/default/files/2026-07/guidelines_on_the_implementation_of_the_transparency_obligations_for_certain_ai_systems_under_article_50_of_the_ai_act_bzptwqhk0ikg1dtlddap41psfy_131215.pdf
European Commission, "Quick facts" on the transparency rules, accessed 2026-11-03, https://digital-strategy.ec.europa.eu/en/factpages/quick-facts-transparency-rules-ai-systems
European Commission, opinion assessing the adequacy of the transparency Code of Practice, published 2026-07-09, https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-code-practice-transparency-ai-generated-content
European Commission, Code of Practice signing announcement and signatory list, 2026-07-31 (list updated 2026-09-24), https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content
European Commission, notice on the first AI Act harmonized standard (EN 18286) published in the Official Journal, 2026-10-19, https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal
OpenAI, "Our approach to EU text provenance rules," 2026-10-05, https://openai.com/index/eu-text-provenance/
CCIA Europe, "AI Omnibus: EU Negotiators Miss Opportunities as They Seal Deal," 2026-05-07, https://ccianet.org/news/2026/05/ai-omnibus-eu-negotiators-miss-opportunities-as-they-seal-deal/
EBU, notice of the broadcasting and advertising groups' joint letter on the draft transparency guidelines (letter dated 2026-06-17), https://www.ebu.ch/news/2026/06/european-media-call-on-the-commission-to-refrain-from-unhelpful-labelling-obligations-in-the-ai-act-s-transparency-guidelines
AlgorithmWatch, post on banning sexual deepfakes, 2026-04-30, https://algorithmwatch.org/en/how-to-actually-protect-against-digital-sexualized-violence/
National Law Information Center (South Korea), Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (PRISM translation), accessed 2026-11-03, https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법
JETRO (Japan External Trade Organization), business brief on the EU Code of Practice publication, 2026-06-17, https://www.jetro.go.jp/biznews/2026/06/940e2fb2a91a0a73.html
Central News Agency (CNA), report on the new EU AI transparency rules, 2026-07-28, https://www.cna.com.tw/news/ait/202607280131.aspx
Cyberspace Administration of China (CAC), 人工智能生成合成内容标识办法 (Measures for Labeling AI-Generated Synthetic Content, PRISM translation; 国信办通字〔2025〕2号, effective 2025-09-01), https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm