8/12/2026

EU AI Act since August 2026: what companies must actually label as AI content

Editorka kontroluje obrazový, video a textový obsah v AI pipeline s vrstvou pro dohledatelnost původu

Since 2 August 2026, the EU AI Act does not require a label on every text, photo or video that AI merely touched. It splits responsibility by role and use: providers must technically mark certain synthetic outputs, professional deployers must visibly disclose selected content, and standard assistive editing or genuinely reviewed text may qualify for an exemption.

The practical task is not “put an AI badge on everything.” A company needs to know what AI changed, who reviewed the output, who holds editorial responsibility, and whether the result could falsely appear authentic.

Separate the provider from the deployer first

Article 50 assigns different duties to two roles:

  • An AI system provider develops a system or places it on the market under its own name. Providers must, among other things, add machine-readable marking to generated or manipulated synthetic content and make it detectable. Interactive systems must inform people from the beginning that they are interacting with AI, unless this is obvious.
  • A deployer uses AI professionally under its authority. This is commonly a company, agency or freelancer. Deployers must provide a human-visible disclosure for selected outputs, particularly deepfakes and certain public-interest text.

An agency employee is normally not a separate deployer when acting under the company's control. The legal entity remains responsible. Personal, non-professional activity is excluded, while regular income-generating activity may no longer qualify as personal use.

What actually needs disclosure

Scenario Practical conclusion
A customer talks to a chatbot, voicebot or AI avatar They must know from the start that they are interacting with AI, unless it is obvious. Hiding this in terms and conditions is not enough.
A model generates final text, image, audio or video The system provider handles machine-readable marking. The company should verify that exports, edits, CDNs and reposting do not strip the provenance signal.
AI performs denoising, colour correction, cropping or another standard assistive edit Technical assistance alone does not automatically trigger marking. The exemption covers standard editing that does not substantially alter the input or its meaning.
An ad uses a convincing fabricated statement by a real person or depicts an event that never happened This is typically a deepfake. A professional deployer must disclose it clearly and perceptibly by the first exposure.
AI publishes unchecked text about public health, politics, finance or another matter of public interest The text must be clearly labelled. A spelling or grammar check does not count as substantive review.
AI prepares a draft that a qualified human substantively verifies and edits, with an editor assuming responsibility The public-interest text may qualify for the human-review exemption. The review and editorial responsibility should be documented.
The output stays in a machine-to-machine process, a closed development environment, or is source code Commission guidance lists these among outputs outside Article 50(2) marking when they are not exposed to people as final content.

The key question is not simply whether AI was involved. The content type, purpose, degree of semantic change, audience expectations and real human control all matter.

An algorithmically enhanced photo is not automatically a deepfake

A modern phone combines exposures, reduces noise, sharpens details and adjusts colour. Lightroom or a corporate DAM may do similar work automatically. That does not normally create content that falsely appears to show an authentic person, object, place or event.

The line moves when the system changes meaning: adding a person who was not present, changing a speaker's words, fabricating a plausible event or replacing a product. Deepfake assessment considers resemblance to an existing or plausibly existing subject, the false impression of authenticity, and the context and audience.

Instead of a crude “exported from an AI tool” rule, record the type of intervention: standard editing, partial semantic manipulation, or fully synthetic content.

Human review must be substantive

For public-interest text, Article 50 provides an important exception for human review and editorial responsibility. The Commission's interpretation goes well beyond clicking Approve.

A defensible review should include:

  • a person with relevant subject knowledge and authority to change or reject the text,
  • fact-checking against trustworthy sources,
  • review of meaning, not only style and grammar,
  • a record of who approved the output and when,
  • clear legal or editorial responsibility for publication.

In a content pipeline, this is similar to validating an agent workflow. A step named Human review proves little by itself. You need evidence of what the reviewer checked and whether they could stop publication.

Implementing this in n8n, Make or an internal CMS

Add a simple decision gate before publication:

  1. Store provenance. Model and version, timestamp, source assets, type of generation or edit, and the final asset. For sensitive prompts, a hash or controlled audit record may be preferable to storing the full prompt.
  2. Classify the intervention. Standard editing, partially modified, fully generated, or no AI.
  3. Evaluate the context. Deepfake risk, public-interest text, direct human interaction, emotion recognition or biometric categorisation.
  4. Route exemptions to substantive review. Give reviewers the sources, prior version and power to reject. Store the outcome as a structured decision.
  5. Apply disclosure in the right channel. A visible label on content, an opening notice in a chatbot, and machine-readable provenance supplied by the provider. Verify that editing and distribution preserve it.
  6. Test first exposure. The disclosure must be understandable and perceivable no later than a person's first exposure. A policy page two clicks away is not enough.

An n8n or Make decision object could contain ai_involvement, semantic_change, public_interest, deepfake_risk, human_review_id, editorial_owner and disclosure_variant. The CMS can then block risky publication when required fields are missing.

EU icons are optional; disclosure obligations are not

The Commission provides three icon variants: a basic AI involvement icon, fully AI-generated, and partially AI-modified. They are free and optional. Using an icon does not, by itself, establish compliance.

A visible disclosure should be clear on first exposure, unobstructed, survive sharing or downloading where required, and remain accessible. The Commission notes that user understanding improves when an icon is paired with plain text. “This video contains an AI-generated voice” is usually more useful than an unexplained symbol.

Deadlines and penalties

Article 50 applies from 2 August 2026. Under current Commission material, the limited grace period until 2 December 2026 applies only to provider-side machine-readable marking for systems placed on the market before 2 August. It is not a general delay of all transparency duties. Content generated before 2 August does not require retroactive labelling, although the Commission encourages it where feasible.

Fines can reach €15 million or 3% of worldwide annual turnover, with proportionality for SMEs and small mid-caps. The sensible response is not blanket labelling. It is a documented role model, provenance records, real review and enforceable publishing rules.

This is a practical technical and process overview, not legal advice. For media, public-sector, healthcare, political campaigns or disputed deepfake cases, confirm the interpretation with counsel.

Sources