The rules marketing teams have been bracing for since spring became enforceable on 2 August 2026. Article 50 of the AI Act now requires organisations to tell people when they are dealing with an AI system rather than a person, to disclose deepfakes, and to mark AI-generated content so it can be detected automatically. The European Commission’s guidelines, adopted on 20 July 2026, then narrow the part that worried in-house teams most. The duty to label AI-written text applies only to material published to inform the public on matters of public interest.

That distinction matters because generative AI reached campaign production faster than anyone settled who carries the legal duty for it. Two assumptions took hold over the past year, and Article 50 supports neither. The first was that transparency is a problem for OpenAI, Adobe and the platform vendors. The second was that every AI-touched asset would need a visible disclosure. The article instead splits duties between the organisation that builds an AI system and the organisation that uses one under its own authority. It targets specific content types, not the use of AI itself.

Which AI-generated marketing content actually needs a label?

The Commission’s guidelines confine the text-labelling duty to material published to inform the public on matters of public interest. That leaves most commercial copy outside it. Reviewing the guidance on 31 July, the law firm Addleshaw Goddard concluded that ordinary advertising, product descriptions and most marketing copy will generally fall outside scope. The exception is narrow but real. Content carrying claims about health, consumer safety or sustainability can qualify as public-interest text, and a sustainability claim drafted by a model and published without substantive human review may trigger disclosure. Where a named person or company takes editorial responsibility for the published text, the obligation does not apply.

Images run on a separate test. Routine editing does not create a deepfake. The guidelines cite cropping, colour correction, compression, background replacement, dust-spot removal and red-eye correction as examples that sit outside the disclosure duty. Material alteration is treated differently. Inserting or removing objects or people, swapping or substantially modifying a face, or editing a product so that it looks better than it is in reality all produce content the Commission treats as a deepfake requiring disclosure.

The lighter regime for artistic, creative, satirical and fictional works rarely reaches advertising. It allows disclosure to sit in credits or a description panel rather than on the asset itself. Addleshaw Goddard reads the guidelines as keeping content that combines artistic and promotional purposes under the standard obligation. The lighter route is also closed where AI-generated depictions of real people appear in promotional material to suggest endorsement or association.

Who counts as the deployer when an agency makes the work?

Deployer status turns on control over the decision to use AI, not on who owns the campaign. The Commission’s guidelines state that engaging an advertising agency to produce content does not by itself make the brand a deployer. Where the brand decides that AI will be used, determines how it is used, or exercises control over the output, it is likely to qualify. The Article 50(4) disclosure duty on any resulting deepfake or public-interest text then sits with the brand.

Contracts cannot settle the question. They can allocate day-to-day compliance work between a brand and its agency. They cannot determine which party is the provider or the deployer under the AI Act. For marketing leaders who pushed AI creative production out to agencies and freelancers on the assumption that the risk travelled with the work, that is the line to read twice.

The guidelines are the Commission’s interpretation rather than binding law. Their weight comes from the expectation that market surveillance authorities will use them as the benchmark when judging whether an organisation has complied.

What does compliance look like in practice?

The AI Office has issued three official EU labelling icons, free to use and requiring no attribution. There is a basic AI mark, a “Fully AI-Generated” mark and a “Partially AI-Modified” mark, each in four colour variations and available in SVG and PNG. User testing behind the design found that recognition improved across every measure when the icon was paired with a short text label such as “modified”. Placement matters as much as the mark itself. An icon should be perceivable at the point of first exposure, sit clear of any overlay, and be embedded so that it survives resharing or downloading. That last requirement is the one most likely to catch social-first campaign assets.

The icons are optional. The labelling duty is not. Both sit alongside the Code of Practice on Transparency of AI-generated Content, published on 10 June 2026 and drawn up by independent experts convened by the AI Office. Signing is voluntary, and adherence is not conclusive proof of compliance. Organisations that take an alternative route must be ready to justify their marking methods, labelling formats and approval processes to a national regulator.

Enforcement sits with national market surveillance authorities, with the AI Office covering systems under its own supervision and the European Data Protection Supervisor covering EU institutions. Fines reach 15 million euros or 3% of total worldwide annual turnover, whichever is higher. The lower figure applies to SMEs and start-ups, and proportionality is taken into account for smaller firms. The reach extends beyond the bloc. The obligations bind organisations placing AI systems on the EU market or whose AI outputs are used within it, which puts UK marketing teams selling into Europe squarely in scope.

One deadline is still ahead. Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking obligation under Article 50(2). The provenance data marketing teams will lean on will not be complete across their tool stack until then.