The EU's new *AI content labels*: what deployers must actually do

What the Code does

Article 50 of the AI Act says people must be told when they are talking to an AI, and that AI-generated content must be labelled ^[2]. The details were left to later guidance. On 15 January 2025, the European Commission published a Code of Practice on Transparency of AI-generated Content to fill that gap ^[1].

The Code is voluntary, but it follows what Article 50 requires and gives practical examples of how to comply. It also provides a set of EU icons for labelling, in 24 languages and in formats that fit different media ^[1].

Think of the icons as nutrition labels: there is one design, but each company decides where to put it and what additional information to include. The difference is that the AI Act makes the disclosure mandatory, while the icons themselves are a tool, not a legal requirement.

Who does what

Article 50 divides the work. Providers of generative AI must ensure that outputs are marked in a machine-readable format and detectable as artificially generated ^[2]. That is the technical layer, often invisible to the person viewing the content.

Deployers, meaning the people or organisations that use AI systems and publish the results, have a separate duty: to disclose when certain content is AI-generated or manipulated ^[2]. Section 2 of the Code is written for them.

A deployer might be an advertiser running a campaign with AI-generated images, a newsroom publishing AI-assisted articles, or a company posting AI-created videos on social media. The machine-readable marking is the provider's responsibility; the visible disclosure is the deployer's.

Deepfakes: when you must tell

A deepfake, under Article 3(60) of the AI Act, is content that resembles real persons, objects, places, entities or events and would falsely appear to be authentic ^[2]. When a deployer publishes such content, they must disclose that it is artificially generated or manipulated.

The disclosure must be clear, visible and timely. The Code suggests placing the information where it will be noticed: near the content, in a caption, or as an overlay ^[1]. For a still image, that might mean a corner label. For a video, it could be a notice at the start or a persistent icon.

If the deepfake is part of an artistic, creative, satirical or fictional work, the rules relax slightly. You still have to disclose, but it is enough to note somewhere appropriate that the work contains artificially generated content, as long as that does not interfere with the viewing or enjoyment ^[2]. A credit roll or an 'about this film' page would do.

AI-generated text: when it matters

Text is treated differently. Article 50(4) requires disclosure only when AI-generated text is published to inform the public on matters of public interest, and when no human has reviewed it and taken editorial responsibility ^[2].

That last part is important. If a person has read the text, checked it and is prepared to stand behind it, there is no disclosure duty, even if the first draft came from an AI. The rule is aimed at fully automated publishing, not at tools that help people write.

What counts as a matter of public interest is not defined in the regulation, but the Code suggests news, public affairs and information that could influence decisions people make as citizens or consumers ^[1]. An AI-generated product description probably does not count; an AI-written article about election policy probably does.

The icons

The Commission has designed a set of icons to make disclosure easier and more consistent ^[1]. They come in different styles: for 'AI-generated', 'AI-edited' and 'Contains AI-generated content'. Each is available in 24 EU languages, in vector and raster formats, and in versions that work on light or dark backgrounds.

Using the icons is not compulsory, but it is a sensible default. They are recognisable, free to use and meet the transparency requirement. Deployers can add their own text or branding alongside them.

The icons sit in the same folder as the Code itself, on the Commission's Digital Strategy site ^[1].

What this means for you

If you publish content created or edited with AI, ask these questions now:

• Does any of it look or sound like real people, places or events in a way that could be mistaken for genuine footage? If so, you need a deepfake disclosure.
• Are you publishing AI-generated text to inform the public, without a human checking and taking responsibility for it? If so, you need to say that too.
• Have you decided where the disclosure will go, and in what form? The EU icons are a ready answer, but the law does not prescribe them.
• Who in your organisation is responsible for making sure the disclosure happens? The obligation sits with the deployer, and that is usually you.

For advertising and campaign work, it is worth checking each asset. A single overlooked deepfake can mean a breach, and the penalty under Article 99(4) is up to €15 million or 3 per cent of global annual turnover, whichever is higher ^[2].

Sealing the record of what you published

The Code tells you what to disclose and when. It does not solve a related problem: proving later what you actually published, and when.

Say a complaint comes in six months after a campaign, claiming that a deepfake disclosure was missing or unclear. Your records show the final version with the label in place, but the complainant has a screenshot that looks different. Who keeps the definitive record, and how do you show it has not been edited since publication?

Here, the thing to seal is each version of the content as it is approved and published: the brief, a record of each AI generation (which tool, model version and settings), any third-party licences, the client's or editor's approval, and the final file as it went live. Sealing takes a fingerprint, not the content itself, so the material never leaves your systems.

Anyone you share the record with can check that the file you are showing them is exactly the one sealed at that time. Change a single pixel or word and the fingerprint will not match. The check does not rely on trusting whoever kept the files.

It does not show that the disclosure was adequate or that the campaign was lawful, but it does answer the narrow question of what existed when, unchanged. That is often the first question a regulator or a court will ask.

You can seal campaign records through WitniumChain, using the REST API, the SDK or the MCP server. The content stays with you; only the fingerprint is sealed. The first 2,000 witnesses a month are free, and the documentation walks through the steps.

How it would work

1. Seal the brief, each AI generation record, approvals and the final versions as each step happens.
2. When questioned, share the sealed records with anyone who needs to check them.
3. They calculate the fingerprint again. If it matches, nothing has changed since sealing.

What to watch

The Code is out, and Article 50 has applied since 2 August 2026 ^[2]. The next step is enforcement. National supervisors across the EU now have the power to investigate and fine deployers who do not comply.

The Commission has said it will review the Code after the first year and adjust it based on what works in practice ^[1]. In the meantime, anyone publishing AI-generated content should assume the rules are being watched.

For deployers, the question is not whether to disclose, but how to do it in a way that is clear, consistent and checkable later. The icons are a start. A sealed record of what you published is the rest.