What the AI Act actually asks of ad agencies, and what it doesn't

The confusion is real

Ad agencies are getting asked about the AI Act more often than they know how to answer. Some assume all AI-generated work must be labelled, others believe creative campaigns are exempt, and plenty aren't sure where political advertising fits.

The truth is more specific than either extreme. Article 50 splits the duties: tool providers handle the technical marking, and agencies deal with certain disclosures. Political campaigns add a separate layer.

Think of it like a food label. The factory prints "contains nuts" on the wrapper (that's the provider's job), but if you're catering an event and serve it to someone who asked about allergens, you're the one who tells them (that's the deployer's job). The AI Act works the same way: one party marks, another discloses, depending on what's being made and where it ends up.

The provider marks, you disclose

Article 50(2) requires providers of AI systems that generate content to ensure outputs are marked in a machine-readable format and detectable as artificially generated ^[1]. If your agency builds its own generative AI tool, that's you. If you use someone else's—Midjourney, ChatGPT, Runway—the marking is their responsibility, not yours.

The standard for that marking isn't final yet, but it will likely involve metadata or watermarks that platforms and fact-checkers can read.

What agencies must do, under Article 50(4), is disclose deepfakes: image, audio or video content that resembles real people, objects, places or events and would wrongly appear authentic ^[2]. A deepfake under Article 3(60) is content that someone would mistake for the real thing ^[4].

So if you generate an ad showing a made-up spokesperson who looks like a real person, you disclose it. If you create obviously stylised animation or an abstract visual, you probably don't.

Creative work gets a lighter rule

Here's the useful bit. If the deepfake is part of an "evidently artistic, creative, satirical, fictional or analogous work", you don't need to spell out every detail ^[2]. Instead, you disclose the existence of such content "in an appropriate manner that does not hamper the display or enjoyment of the work".

That means a short line in the end credits, a note in the campaign materials or a disclaimer on the landing page. It doesn't mean a pop-up on every frame.

The line between "evidently creative" and "could be mistaken for real" will be drawn case by case, but a good test is whether a reasonable viewer would know it's not documentary footage. A sci-fi ad with a talking dog is evidently creative. A fake news presenter reading a script is a deepfake that needs a clear disclosure.

AI-generated text to the public

If your agency publishes AI-generated text "with the purpose of informing the public on matters of public interest", you must disclose that it was generated by AI, unless a natural person has reviewed it and has editorial responsibility ^[2].

Most campaign copy doesn't fall under this. A product description, a landing page or a social media caption isn't "informing the public on matters of public interest". A sponsored article about climate policy or an op-ed ghostwritten by AI would be.

In practice, if someone at the agency reads the text, signs off on it and takes responsibility, the disclosure isn't required. That's already standard workflow.

Political advertising is stricter

Campaigns for elections, referendums or political causes fall under Regulation (EU) 2024/900 on political advertising, which has applied since 10 October 2025 ^[3].

Political ads must be labelled as such and carry a transparency notice naming the sponsor, the election or referendum, the amount spent and whether targeting was used ^[3]. If you run targeted ads online using personal data, you need explicit consent for political advertising and you can't use profiling with sensitive data ^[3].

Agencies providing political advertising services—that includes planning, placing and consulting—must ask the sponsor whether the service concerns political advertising and keep prescribed records for seven years ^[3].

Seven years is a long time. If a campaign runs in early 2026, you'll need the records until 2033.

What you'll want to show later

Regulations aside, the practical question is whether you could show what happened if someone disputes it.

Say a client claims they never approved the AI-generated version that ran in March, or a platform asks you to prove a deepfake disclosure was in place from day one, or an authority wants to see the transparency notice for a political ad you placed two years ago.

The things worth keeping are:

• the brief,
• a record of each AI generation (which tool, model version and settings),
• licences for any third-party material,
• the client's approval,
• the final versions as they ran,
• for political ads, the transparency notice and targeting records.

Most agencies already keep some of this. The question is whether you can show the records haven't been edited since.

A digital witness for campaign records

This is where a digital witness fits.

Say your agency runs a campaign that uses AI to generate a spokesperson video. You record the brief, the generation settings (tool name, model version, prompt), the client's approval email and the final cut with its deepfake disclosure.

You seal a fingerprint of each record as it happens—brief when it's written, generation when it's made, approval when it's sent, final cut when it's published—using WitniumChain through the REST API, the SDK or the MCP server. The content stays in your systems; only the fingerprint goes out.

If the campaign is questioned six months later, you share the records and the verification links. Anyone can check that the fingerprint of the file they're looking at matches the one sealed on that date. Change a single pixel in the video or a word in the brief and it won't match.

What it shows is that those records existed and were approved at the times you say, unchanged since. What it doesn't show is that the campaign was lawful, that the disclosure was adequate or that a licence was valid. Those are separate questions.

The first 2,000 witnesses a month are free. After that, it's straightforward usage pricing.

How it would work

1. Seal the brief when you agree it with the client.
2. Seal a generation record (tool, settings, timestamp) each time you generate a version.
3. Seal the client's approval and the final cut when the campaign goes live.

If it's disputed later, you hand over the files and the verification links. The other party checks the fingerprints and sees they match.

A worked example

Say an agency creates a video ad for a fictional mayoral election. The ad features a generated spokesperson who looks like a real person and talks about housing policy. The agency uses Runway to generate the video, and a copywriter reviews the script.

Under Article 50(4), the agency must disclose the deepfake. Because it's a political ad, it also needs a transparency notice under the political advertising regulation.

The agency adds a line at the end of the video: "This spokesperson is AI-generated." It prepares a transparency notice naming the candidate, the election date, the budget and the fact that no targeting was used. It keeps copies of the brief, the Runway generation log, the client's approval and the final video with both disclosures.

Six months after the election, a complaint is filed claiming the ad ran without a deepfake disclosure. The agency shares the final video file and its verification link. The fingerprint matches, showing that the version with the disclosure is the one that was sealed on the day the campaign launched. The complaint doesn't hold.

That's a clear example. Real disputes are messier, but the principle is the same: keep the records, seal them as you go, and you'll have something to show when the question comes.

What this means for you

If you run an ad agency, here are the questions worth asking this week:

• Do we know which of our tools are covered by Article 50(2), and have we checked that their outputs are being marked by the provider?
• Can we tell a deepfake from evidently creative work, and do we have a process for deciding when a disclosure is needed?
• If we work on political campaigns, do we have a system for keeping transparency notices and targeting records for seven years?
• Could we show a client, a platform or a regulator which version of a campaign ran, and when it was approved?

Article 50 has been in force since 2 August 2026 ^[1]. The political advertising regulation has applied since 10 October 2025 ^[3]. If you haven't looked at either, now's a decent time.

What to watch

The Commission is working on the technical standard for machine-readable marking under Article 50(2). When that's published, tool providers will have a deadline to implement it, and agencies will want to check that the tools they use comply.

For political advertising, member states are setting their own penalties. In some countries, fines can reach 6 per cent of annual income or global turnover ^[3]. Worth knowing before the next election cycle.