Deepfakes get a stricter rule than an AI-written blog post
Most teams reading Article 50's content-labeling duty picture the same case every time: an AI-written article, a generated product description, something a reader sees as text. That's a real obligation, and we've written about what it actually requires. It is not, however, the same duty as the one that applies to synthetic image, audio, and video, including what most people would just call a deepfake. That's a separate part of Article 50(4), it's written more narrowly, and its exemptions work differently.
What actually counts as a deepfake under the Act: AI-generated or manipulated image, audio, or video content that appreciably resembles a real person, object, place, entity, or event, and would falsely appear to a person to be authentic or truthful. That's a narrower test than “did a model produce this.” A synthetic product photo with no real person, place, or event in it doesn't trigger the deepfake duty at all, even though it's squarely covered by the ordinary AI-generated-content labeling obligation. The deepfake duty is specifically about synthetic media that could pass as a genuine record of something real.
Where the two duties really diverge is the exemptions. Ordinary text labeling has the editorial-review exemption we've written about separately: a human who took substantive editorial responsibility for AI-drafted text can put a byline on it instead of an AI-generated label. Deepfake content doesn't get that exemption, human review of a synthetic video doesn't make the disclosure duty go away. What it gets instead is narrower and more specific: content that is manifestly artistic, creative, satirical, fictional, or analogous, a deepfake used in a film, a game, satire, that kind of work, still has to be disclosed, but “in an appropriate manner that does not hamper the display or enjoyment of the work.” That's a real, lighter-touch standard the Act sets out on purpose, not an exemption from disclosure altogether, and it doesn't extend to a deepfake presented as a genuine recording.
There's a second, separate branch of Article 50(4) worth knowing about even though it isn't strictly about “deepfakes” in the everyday sense: AI-generated or manipulated text published to inform the public on a matter of public interest. Same paragraph, same visible-disclosure logic, different medium, an AI-written op-ed on a political topic sits under this branch rather than the image/audio/video one, and it keeps the editorial-review exemption the way ordinary text labeling does. Two different media, two different exemption regimes, one shared paragraph.
The practical gap we see most often isn't teams disagreeing with any of this, it's teams who've shipped an “AI-generated” badge on text content and assumed the same badge, or the same policy, covers whatever synthetic image or video their product also produces. It doesn't, on either axis: the test for whether the duty applies is different (resembles a real person, place, or event and could pass as authentic, not just “AI-made”), and so is what satisfies it once it does.
On the technical side, this is also where Disclarion's SDK is honestly further along for one medium than the others. track_content() produces a real watermark baked into an image's own pixel data when you pass it the raw bytes, a mark that travels with the file through a re-upload or re-host, not just markup sitting next to it on a page. Audio and video can be logged through the same call today, with the same audit trail underneath, but they don't get a baked-in mark yet, only images do. If deepfake video or audio is an actual part of your product's output rather than a hypothetical, that's worth knowing before you assume one integration covers every format the same way.
For the full breakdown of what Article 50 requires across all four of its obligations, see our Article 50 explainer. For the labeling side specifically, including how the machine-readable marking duty differs again from both of these, see our content-labeling guide.
More from the blog
Your internal AI tools owe the same disclosure duty the customer-facing one does
An HR bot or IT helpdesk assistant used only by your own staff still interacts with natural persons. Article 50 doesn't carve out an exception for "internal-only."
Does the EU AI Act apply if you're not based in the EU?
"We're a US company, we don't have an EU entity" isn't the exemption it sounds like. The actual test is about who's on the other end of the conversation, not your mailing address.
Why I built Disclarion as an SDK, not a dashboard
The easier product to build is a dashboard you configure after the fact. I built Disclarion to sit inside the AI call itself instead, and it's worth explaining why.
Your chatbot isn't the only thing that owes a disclosure under Article 50.
Article 50's disclosure duty doesn't stop at chatbots — emotion recognition and biometric categorization systems carry the same obligation, and they're the two system types teams miss most often.
You named it "AI Assistant." That's not the same thing as disclosing it.
A bot's name feels like disclosure. Article 50 cares whether a reasonable user actually understood they were talking to an AI — not whether a label existed somewhere on the page.
Your editor touched it. Article 50's label exemption still might not apply.
Article 50(4) waives the visible AI-content label when a human takes substantive editorial responsibility for a piece — but a quick skim doesn't qualify, and the exemption doesn't touch the audit-trail duty underneath it.
You labeled the article. That's not the same thing as marking it.
Article 50(2)'s machine-readable marking and Article 50(4)'s visible label are two different duties. Images already meet the first one by accident. Article text usually doesn't meet it at all.
Your AI answers the phone now. There's no modal for that.
Article 50's disclosure duty doesn't go away because there's no screen. What actually discloses an AI voice agent on a phone call, when a modal isn't an option.
An AI audit trail doesn't need to know what your users actually said.
Teams hear "audit trail" and picture a database of every conversation. Article 50's version is narrower: it has to prove disclosure and labeling happened, not repeat what was said.
Article 50 skips disclosure when it's "obvious from context." That word is doing more work than it looks like.
Disclosure isn't required when AI use is obvious from context, but Article 50 never defines obvious, and most of the cases teams assume qualify, don't.
Your chatbot needs to disclose it's an AI. Once, not every message.
Disclosing a chatbot is AI sounds simple until you build it: repeat it every message and people tune it out, show it once and later visitors never see it.
You have logs. That's not the same thing as an audit trail.
Under Article 50, an audit trail has to be insert-only, complete, and producible on demand, not a data-engineering project when a regulator actually asks.
Your AI-generated content needs a label. Here's what that actually means.
A disclaimer someone remembers to add isn't a labeling system. Under Article 50, AI-generated content needs to be identifiable as such, reliably, not as a manual step someone can forget.
EU AI Act Article 50, explained: who it affects and what it requires
Article 50 of the EU AI Act has been enforceable since August 2, 2026: who it applies to, its three obligations, and the penalties for getting it wrong.