What Are the EU AI Act Rules for Deepfakes? Article 50 Explained

What does EU AI Act Article 50 say about synthetic content?

Article 50 of Regulation (EU) 2024/1689 contains four transparency duties. Two concern synthetic media. Article 50(2) says providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution has to be effective, interoperable and reliable as far as technically feasible, taking into account the type of content, the cost and the state of the art. The duty does not apply where the system only performs an assistive function for standard editing or does not substantially alter the input.

Article 50(4) applies to deployers. A deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. Article 3(60) defines a deep fake as AI-generated or manipulated content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The same paragraph covers AI-generated text published to inform the public on matters of public interest, unless it went through human review or editorial control and someone holds editorial responsibility.

Article 50(5) sets the form: the information must be given clearly and distinguishably, at the latest at the first interaction or exposure, and must meet accessibility requirements. Recital 133 lists the kinds of marking techniques the legislator had in mind: watermarks, metadata identifications, cryptographic methods for proving provenance, logging methods and fingerprints.

Which companies must comply with the EU AI Act's deepfake requirements?

Any organisation that acts as a provider or deployer of a covered system in the EU market, wherever it is based. The AI Act applies to providers placing systems on the EU market and to deployers established in the EU, and also to providers and deployers outside the EU when the output of the system is used in the Union. A US image generator offered to EU users is a provider under Article 50(2). A European bank that uses a generative tool to produce a synthetic spokesperson video for customers is a deployer under Article 50(4).

Roles attach to systems, not companies, so one business can hold several. A software vendor that builds a generative feature into its product is a provider of that feature; its customers who publish the outputs are deployers. A marketing agency that creates deepfake ads for a client may be the deployer, depending on who uses the system under its authority. The first compliance step is an inventory that records, for each system and each distribution path, the legal entity, its role, the output type and the date the system was placed on the market.

What should enterprises know about EU deepfake obligations?

Most enterprises are deployers, and their duty is about labelling what they publish. If your marketing, training or customer communication uses AI to create or alter realistic images, voices or video of real people, places or events, the audience must be told, clearly and at first exposure. The European Commission has published a set of EU icons that deployers may use for that label. Internal use that never reaches an audience raises fewer Article 50 questions, though other rules such as the GDPR may still apply.

Enterprises that build generative features into products are providers for those features and carry the marking duty. The Commission's Code of Practice on Transparency of AI-generated Content, drawn up by independent experts and finalised on 10 June 2026, has a provider section on marking and detection and a deployer section on labelling deepfakes and AI text. Signing it is voluntary; the Commission and the AI Board have confirmed it is an adequate tool to demonstrate compliance. Draft guidelines on the scope of Article 50 followed on 8 May 2026 for consultation.

Article 50 also sits alongside other law. Article 50(6) states it is without prejudice to other transparency obligations in Union or national law, and the Digital Services Act, consumer protection law and data protection law continue to apply to the same content.

What changed with the July 2026 Digital Omnibus amendment?

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. For Article 50, its key change is in the transitional provisions: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must take the steps needed to comply with Article 50(2) by 2 December 2026. Recital 38 describes this as a four-month transitional period.

The transition is narrow. It covers provider marking for systems already on the market, not deployer disclosure under Article 50(4) and not new systems launched after 2 August 2026. The same amendment replaced Article 50(7), so codes of practice no longer need approval by implementing act, and it moved the high-risk obligations for Annex III systems to 2 December 2027. Anyone relying on the extension should record the system, version and market-placement date that qualify it.

Does the EU AI Act require deepfake detection?

Not for organisations that receive content. Article 50 puts the burden on the creation side: providers make their outputs detectable, and deployers label what they publish. A bank, insurer or platform is not required by Article 50 to scan inbound media for deepfakes. Detection still matters for three practical reasons. Marks are often missing, because open-source generators and non-compliant providers will not add them and ordinary processing strips metadata. Fraud and impersonation carried out with unmarked synthetic media remain your risk under AML, consumer protection and platform law. And providers have to show that their own marks are detectable, which needs testing.

The Act's own text shows where identity checks sit. Annex III lists remote biometric identification as high-risk but excludes biometric verification whose sole purpose is to confirm that a person is who they claim to be, which covers most selfie-to-ID matching in onboarding. A deepfake detector used inside that flow is a security control, and the Act does not define it as a high-risk system on that basis alone; confirm the classification for your own use with counsel.

How can NeuroDetect and NeuroVerify support Article 50 work?

For deployers and platforms, the hard case is content that should have been labelled and was not. NeuroDetect, Neural Defend's forensic media workspace, lets a reviewer upload authorized images, audio, video or documents into a case and see which regions, frames or audio segments indicate generation or manipulation, with model and version context and a downloadable report covering observations, uncertainty, provenance and analyst notes. That record supports a labelling or takedown decision without pretending the score itself settles a legal question.

For high-volume checks, NeuroVerify returns a unified risk score with signal-level evidence from six signals, including AI Generative Model Analysis and AI Pixel-Level Manipulation, in under 200 ms at p95 for eligible image requests under defined test conditions. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876. Neural Defend holds ISO/IEC 42001 certification for its AI management system, alongside ISO/IEC 27001, ISO/IEC 27701 and SOC 2 Type II, which helps buyers document their own AI supply chain. None of this makes an organisation Article 50 compliant; it supplies evidence for the decisions Article 50 requires.