AI Disclosure Laws 2026: EU AI Act Article 50 + US State Guide

Intelligence // Verified 11 August 2026

Nine days ago, on 2 August 2026, the EU’s AI content disclosure rules switched on. A lot of marketing teams missed it, because they were told the deadline had moved.

Most of it did move. Article 50 did not. If you publish AI-generated content that reaches anyone in the European Union, you now have disclosure duties enforced by national regulators and backed by fines of up to €15 million or 3% of worldwide annual turnover.

On the same day, California’s AI Transparency Act became operative. Two of the world’s largest regulatory blocs turned on AI content rules within hours of each other, built on opposite philosophies. The EU regulates the method. The US regulates the effect.

This is the reference guide. What has to be labelled, who is legally responsible, exactly how labelling is done at a technical level, which channels are in scope, and what happens if you get it wrong. Every claim is linked to a primary source, and where a claim rests only on secondary reporting, I say so.

One position underpins the whole piece, and it is the same one I set out in The Agentic Marketing Manifesto: the work you can prove is the only work that counts. Disclosure law has now made that a legal standard rather than a preference.

Key facts at a glance

Part 1. The European Union

The one distinction that decides everything

Almost every misunderstanding about the AI Act comes from skipping this. The Act splits duties between two roles, and marketers and creators are almost always in the second one.

A provider develops an AI system, or has it developed, and places it on the EU market under its own name or trademark. OpenAI, Google, Anthropic, Midjourney, ElevenLabs, Synthesia.

A deployer uses an AI system under its own authority in a professional context. Your agency. Your in-house content team. You, as a creator, when you are operating commercially.

Two clarifications from the Commission’s FAQ that matter operationally. Individual employees acting under a company’s instructions are not separate deployers, the company is. And a company remains the deployer even where contractors or freelancers operate the system on its behalf and under its control. You cannot push the obligation down to a freelancer by hiring one.

The five transparency duties in Article 50

Article 50 creates four substantive obligations plus a fifth governing how they are delivered. Only two normally touch content marketing, but agencies increasingly deploy all of these systems.

Article 50(1). Chatbot disclosure (provider duty). People must be told they are interacting with an AI system from the start of the first interaction, in a clear and distinguishable manner, unless it is obvious to a reasonably well-informed, circumspect and observant person. The Commission says this exception should be read restrictively. This covers your website assistant, your AI SDR, your support bot, your conversational booking widget. If you are unsure whether what you have deployed even counts as an AI system for this purpose, the definitional boundaries are worked through in What Is an AI Agent? Anthropic, OpenAI, and LangChain, Compared.

Article 50(2). Machine-readable marking of synthetic output (provider duty). Providers of generative systems must mark synthetic audio, image, video and text so it is machine-detectable. Solutions must be effective, interoperable, robust and reliable as far as technically feasible.

Article 50(3). Emotion recognition and biometric categorisation (deployer duty). If you run emotion detection on webcam footage in a research study, or biometric categorisation in a retail environment, you must inform the people exposed to it, whether the system runs in real time or after the fact. Rare in content marketing, common in adtech and CX research.

Article 50(4). Deepfakes and public-interest text (deployer duty). This is the one that changes how content teams work. Two triggers: you must disclose deepfakes at the latest at the point of first exposure, and you must disclose AI-generated or AI-manipulated text published to inform the public on matters of public interest, unless the text went through human review or editorial control with someone taking editorial responsibility.

Article 50(5). The information under the preceding paragraphs must be provided clearly and distinguishably, at the latest at first exposure, and in line with accessibility requirements. The Code of Practice covers 50(2), (4) and (5) together.

What actually counts as a deepfake

The Commission’s guidance sets three cumulative criteria. All three must be met.

1. Resemblance. A high level of similarity between the content and the person, object, place, entity or event it depicts.
2. Existence. What it resembles exists, can plausibly exist, or could plausibly have existed.
3. False appearance of authenticity. It would falsely appear to a person to be authentic or truthful.

The third criterion is contextual, and this is where the guidance is more forgiving than most summaries suggest. The Commission says you may take into account the level of resemblance, the substantive message, the intended and foreseeable deployment context, and the composition and expectations of the intended audience. If the audience in that context does not expect the content to be authentic, it may not falsely appear to be so.

The working rule I give teams: if a reasonable viewer in that specific placement could mistake it for a photograph or recording of something that happened, label it.

What counts as public-interest text

Three cumulative criteria again. The text must be published, must inform the public, and must concern a matter of public interest. The Commission’s list is broad: politics and democratic processes, public administration and services, justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific or cultural developments that may be a relevant subject of public debate.

That last cluster is where content marketers get caught. A B2B article on AI adoption in healthcare, an ESG explainer, a data privacy piece, a market outlook report. Those are arguably economic, scientific or public-health matters.

Here is the exemption that saves most content operations. Published text that has undergone human review or editorial control does not need to be labelled. The Commission defines all three terms tightly:

• Human review means deliberate examination of the substance by one or more natural persons with relevant knowledge and professional judgement on the subject matter.
• Editorial control means authority exercised in practice by a responsible editorial entity to approve, alter or reject the substance on substantive grounds, including fact-checking and assessing source trustworthiness.
• Editorial responsibility means a person holds ultimate legal responsibility over the publication.
• Superficial, purely formal or procedural checks such as spell-checking or grammar correction are explicitly not enough.

So a draft that a named subject-matter editor read, fact-checked, changed and signed off is exempt. A draft that someone skimmed and pushed live is not. If you cannot produce evidence of the review, you do not have the exemption. That evidence requirement is why I now treat editorial logging as a compliance control rather than a nice-to-have, and it is why the systems argument in Agentic Content Strategy: Building Systems, Not Just Assets now has a legal edge to it.

There is a second implication worth naming. The Commission’s definition of human review draws the line at substantive examination by someone with relevant subject-matter judgement, which is exactly the difference between using a model as a collaborator and using it as a typist. I argued that distinction on craft grounds in Using LLMs as Creative Collaborators, Not Just Typists. It now also determines whether you owe a label.

How disclosure is actually done: the two-layer model

This is the part almost every article skips, so here it is in full.

The Code of Practice on Transparency of AI-generated Content, published on 10 June 2026, is the Commission’s officially blessed route to compliance. It has been assessed as adequate by both the Commission and the AI Board. Roughly 190 organisations had signed by the end of July 2026, ahead of the initial-signatory deadline of 27 July.

Layer 1. Machine-readable marking, the provider’s job

The Code proceeds from the premise that no single marking technique can meet all four Article 50(2) requirements at once, so it requires a multi-layered approach with at least two layers in most cases.

Three specifics worth knowing:

• Providers must make a detection solution available free of charge, with downloadable signed results. Providers with fewer than one million monthly users may charge a limited fee in high-cost cases, and for text watermarks detection may be restricted to verified expert users.
• Providers must implement a watermark-detection interoperability solution by 2 February 2027. The options are a standardised API that routes detection queries, a publicly readable signpost embedded in the content, or participation in a shared consortium solution.
• Signatories must preserve existing markings and must not offer circumvention tools. Apply the same rule inside your own production workflow.

Why C2PA keeps winning. A C2PA manifest is a container of signed assertions covering when content was created, what tool made it, what edits were applied, and whether generative AI contributed. Assertions are hashed and signed with X.509 credentials, so tampering breaks verification. Because most social platforms strip metadata on upload, C2PA also defines soft bindings, meaning invisible watermarks or perceptual fingerprints that let a stripped file be matched back to its cloud-stored credential. That combination is what the spec calls Durable Content Credentials, and it maps closely onto what the Code asks for.

Layer 2. The visible label, your job

Machine-readable marking is invisible. It does nothing for a human scrolling a feed. That is why Article 50(4) requires deployers to apply a label people can actually perceive, understandable without any specific technical tools or dedicated actions.

The Commission published a free set of EU icons on 10 June 2026, in SVG and PNG, in four variants each: black, white, black at 50% transparency and white at 50% transparency. No attribution is required.

Placement rules by format

Three rules that catch people out:

1. The label must be perceivable without user interaction. A disclosure behind a “read more” toggle or buried in a footer does not comply.
2. The label must survive resharing and downloading. If your label is a platform-side overlay rather than burned into the asset, it disappears the moment someone saves and re-uploads.
3. Machine-readable marking does not substitute for the visible label. Separate obligations, separate parties.

Exemptions, in plain language

The EU compliance calendar

Penalties and who enforces

Breaching Article 50 exposes you to fines of up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher. The Act instructs authorities to apply proportionality for SMEs and small mid-caps, but the ceiling is real.

Penalties sit in Article 99. Article 50 breaches fall in the mid tier. For context, the top tier for prohibited practices under Article 5 is €35 million or 7%, and the bottom tier, for supplying incorrect or misleading information to authorities, is €7.5 million or 1%.

Enforcement sits mainly with national market surveillance authorities in each member state, not with the Commission. The AI Office has narrow competence, limited to AI systems built on general-purpose AI models where the same entity provides both, or where the system is integrated into a VLOP or VLOSE designated under the DSA. The European Data Protection Supervisor covers EU institutions.

Practical consequence: a pan-European campaign can be challenged by any one of 27 regulators, each with its own enforcement appetite.

Should you sign the Code of Practice?

Signing is voluntary but strategically loaded. Signatories may rely on the Code to demonstrate compliance with Article 50(2), (4) and (5), regardless of where they are established or which authority supervises them, and the Commission has said enforcement for signatories will focus on monitoring adherence to the Code. Non-signatories must demonstrate compliance through alternative adequate means and may face more requests for information.

Signature is open to any provider or deployer of a generative AI system regardless of establishment, which is why non-EU companies signed. The initial signatory list was published before 2 August 2026 and organisations can still join.

Beyond the AI Act: the other EU rules that bite

Political advertising. Regulation (EU) 2024/900 entered full application on 10 October 2025. Political ads must be clearly labelled and must disclose who paid, how much, and which targeting was used, online and offline. Stacked on Article 50, an AI-generated political ad carries two independent labelling duties.

Unfair commercial practices. There is no EU-wide law specifically on AI-retouched marketing imagery. But the Unfair Commercial Practices Directive catches misleading practices generally, and a synthetic image presented as a real product photo or a real customer is a misleading practice whether or not the AI Act applies.

Digital Services Act. Very large platforms carry systemic-risk duties around manipulated media, and the Code of Conduct on Disinformation operates as a DSA co-regulatory instrument. This shapes what platforms make you do, which is often stricter and faster-moving than the law.

National law. This is where it gets uneven, and where a lot of published coverage is wrong.

Part 2. The United States

There is no federal AI labelling law. That is the headline.

Nothing in US federal law says you must label AI-generated marketing content. The United States regulates the effect, meaning deception, rather than the method. Three federal instruments matter, plus a preemption fight that could reshape everything.

1. FTC Act Section 5, the general deception standard

The FTC’s position is that existing law already covers AI-driven deception. Its Operation AI Comply sweep, launched September 2024, targeted deceptive AI claims and AI-enabled schemes.

For marketers the operative principle is simple. If a synthetic asset creates a false material impression, that a real customer endorsed you, that a real person said something, that a photo depicts a real result, that is deception, label or no label.

2. The Consumer Reviews and Testimonials Rule (16 CFR Part 465)

Effective 21 October 2024. This is the most directly relevant federal rule for content and affiliate marketing. It bans fake and false consumer reviews, consumer testimonials and celebrity testimonials, including AI-generated ones.

The FTC’s own guidance is important for nuance. There is no blanket prohibition on AI-generated avatars in marketing and no general AI disclosure requirement. What is prohibited is misrepresentation, meaning an AI avatar deployed so that consumers reasonably believe a real person or celebrity endorsed the product. A clearly branded synthetic presenter is fine. A synthetic “verified customer” is not.

3. The TAKE IT DOWN Act

FTC enforcement of Section 3 began on 19 May 2026. Covered platforms must provide a clear, plain-language removal process and, on a valid request, remove non-consensual intimate imagery and make reasonable efforts to find and remove known identical copies within 48 hours. The Act expressly covers digital forgeries, meaning intimate images digitally created or altered using software, an app, or artificial intelligence.

Civil penalty exposure is $53,088 per violation. The FTC issued warning letters to major platforms ahead of the deadline.

Coverage is broad: websites, apps, social media, messaging, image and video sharing, and gaming services, plus anything that primarily provides a forum for user-generated content. Nonprofits are not excluded. Email and broadband providers are expressly exempted. This is a platform obligation rather than a marketer obligation, but if you operate a community, a UGC feature or a client portal that accepts uploads, you may be a covered platform.

4. The preemption fight, and the deadlines nobody met

On 11 December 2025 the President signed Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence. It directed the Attorney General to establish a DOJ AI Litigation Task Force within 30 days to challenge state AI laws, largely on Dormant Commerce Clause, preemption and First Amendment grounds. The Task Force was established on 9 January 2026. It also conditioned BEAD broadband funding, roughly $42 billion allocated, on states rolling back AI rules the administration deems onerous, and it directed the FCC to consider a federal AI reporting and disclosure standard that would preempt conflicting state law.

Two weeks after the EO, on 22 December 2025, the FTC reopened and set aside its own 2024 consent order against Rytr, an AI review-generation tool. The Commission concluded the complaint failed to satisfy the FTC Act and that the order unduly burdened AI innovation. Bureau of Consumer Protection Director Christopher Mufarrige framed the reasoning as a rejection of condemning a technology because of how it could potentially be misused.

Then the enforcement machine stalled and moved at the same time.

What this means for you. State AI laws remain enforceable today, with the notable exception of Colorado, where enforcement is stayed by court order. The US direction of travel is deregulatory and contested. The EU direction is prescriptive and settled. If you build one compliance system, build it to the EU standard. It is the higher bar and it is the one that is not about to be litigated away.

US state laws, in three tables

Table A. Election and political deepfake laws

Public Citizen’s tracking showed 31 states with enacted election deepfake laws as of July 2026. “Disclaimer” means the law requires a label. “Ban” means it prohibits the content outright.

Compiled from Public Citizen’s tracker, last updated 3 August 2026. The tracker is the live source of truth and moves faster than any article. Verify individual entries before relying on them for a specific campaign.

Three design details worth noting. Colorado and Washington require the disclosure in the content’s metadata, not only as a visible or audible disclaimer, a US requirement that mirrors the EU’s machine-readable layer. Minnesota and Texas prohibit distribution within a defined window before an election rather than merely requiring a label, and Maryland bans them year-round. And two laws have been struck down on First Amendment and Section 230 grounds: California’s AB 2839 was permanently enjoined in August 2025 and Hawaii’s Act 191 followed in January 2026. Broad prohibition models have fared worse in court than disclosure requirements.

Table B. Chatbot and conversational AI disclosure

Two design patterns to understand. The Utah model is the most business-friendly and other states are copying it: no proactive disclosure for ordinary consumer interactions, but you must answer honestly if someone asks whether they are talking to a human. Proactive disclosure kicks in only for high-risk interactions, meaning those collecting sensitive financial, health or biometric data and producing personalised recommendations someone might rely on for a significant decision. The Oregon model is the expensive one, because a private right of action with statutory damages turns a compliance gap into class-action exposure without any regulator needing to act.

Table C. Commercial content, advertising and provenance

This is the cluster that most directly governs marketing output.

New York’s synthetic performer law deserves special attention from anyone running video ads. The definition is broader than “AI”: a digital asset created, reproduced or modified by computer, using generative AI or a software algorithm, intended to give the impression of an audio, audiovisual or visual performance by a human performer who is not recognisable as any identifiable natural performer. Traditional VFX can qualify. The duty falls on whoever produces or creates the advertisement, which means advertisers and their agencies. The statute does not define “conspicuous,” so the safe read is on-screen, at the start, legible.

EU vs US: the structural difference

The extraterritoriality point is the one US-based readers underestimate. The Commission is explicit that providers established outside the EU are subject to the Act where the output of their AI system is used in the Union. A US agency running a campaign that reaches EU audiences is in scope.

Part 3. How you actually do this

Regulation is one thing. Operations are another. Here is the system.

If you already run agentic workflows in content production, most of this is a logging problem rather than a new build. The draft-never-publish and human-at-the-gate rules in Building Your First Marketing Agent produce exactly the audit trail Article 50(4) asks you to produce. That was a quality decision when I wrote it. It is now a compliance control.

Channel by channel: what to do where

One row in that table deserves more than a row. Synthesising a customer testimonial is the single highest-risk thing a marketing team can do with generative AI right now, because it is simultaneously an EU deepfake, an FTC Reviews Rule violation, a UCPD misleading practice, and in New York a synthetic performer disclosure failure. Four regimes, one asset. It is also the clearest case of the pattern I have been tracking under agent-washing: presenting machine output as something it is not, and assuming nobody checks.

Platform policies, which move faster than law

The critical gap: most platforms strip or ignore metadata on upload, which is exactly why the C2PA spec pairs hard bindings with soft bindings. Do not assume your provenance survives distribution. Assume it does not, and burn the visible label in.

Copy-paste label wording

Pair each of these with the EU icon where you can, and add alt text.

Who is responsible

Part 4. The honest caveats

I would rather you cite this article because it is accurate than because it is confident. Five things are genuinely unresolved.

1. “Human review” has no bright line. The Commission says substantive examination by a qualified person, not spell-checking. Between those poles sits most real editorial work. Until there is enforcement practice, over-document.
2. Detection does not reliably work. Watermark detectors produce false positives and false negatives, and consumer-facing detection tools have shown inconsistent results. The law assumes a level of technical reliability the field has not reached, which is why the Code itself concedes no single technique is sufficient.
3. Metadata gets destroyed routinely. Screenshots, re-encodes, platform uploads and format conversions strip C2PA manifests. Soft bindings help. They do not solve it.
4. The US may look very different in twelve months. The DOJ Task Force, the funding conditions and the FTC’s changed posture all point the same direction, and Colorado shows the mechanism works. State laws are enforceable now, and may not be later.
5. Some of the national-law picture is genuinely unsettled. Denmark and Spain are the clearest cases. I have flagged both rather than reporting expectations as law, and I would rather be corrected than confident.

The compliance checklist

Someone has to own this, and in most organisations nobody currently does. It sits between legal, brand and content ops, which means it falls through. That ownership question is part of a larger one I looked at in The Future of the CMO.

Governance

• Decide whether you are a provider, a deployer, or both, for each system you use
• Assign a named owner for AI disclosure
• Add AI disclosure clauses to agency, freelancer and contractor agreements

Inventory

• List every generative AI tool in the content workflow
• For each, confirm whether it applies C2PA credentials and a watermark, and whether it offers a detection tool
• Confirm whether each vendor signed the EU Code of Practice

Content classification

• Run every recurring asset type through the deepfake three-part test
• Identify which of your content is public-interest text
• Stand up an editorial review log recording reviewer, changes and sign-off

Labelling

• Download the EU icon set and add it to your brand asset library
• Write your standard label strings into the brand guidelines
• Update templates so labels are burned into assets, not added at the platform layer
• Check labels survive resharing and download

Channel

• Add a first-message AI disclosure to every chatbot
• Enable native AI-disclosure toggles on YouTube, TikTok and Meta
• Review paid creative for synthetic performers if you run in New York
• Check state-specific rules before any political or issue-advocacy work

Records

• Keep provenance and review records for the life of the campaign plus the limitation period
• Diary 2 December 2026 and 2 February 2027

FAQ

Sources

Related reading

• The Agentic Marketing Manifesto
• Agentic AI in Marketing: What’s Real, What’s Agent-Washing, and How to Stay in Control
• What Is an AI Agent? Anthropic, OpenAI, and LangChain, Compared
• Agentic Content Strategy: Building Systems, Not Just Assets
• Building Your First Marketing Agent
• Prompt Engineering for Strategic Marketers
• Marketing Automation vs. Agentic Marketing: The Critical Difference
• Using LLMs as Creative Collaborators, Not Just Typists
• The Future of the CMO: Orchestrating Human and Machine Intelligence