Deepfakes face strict disclosure rules. AI-generated or manipulated content that resembles real people must be labelled. Failure to label is directly punishable. Synthetic content at scale also triggers GPAI transparency obligations.
The EU AI Act reaches any company whose AI output is used in the European Union — regardless of where the company is based. If your product has EU users or clients, the rules apply to you. The first question is always the same: which risk tier does your system fall into, and what duties come with that tier?
The Act sorts AI into four tiers: prohibited (banned outright), high-risk (heavy duties), limited-risk (transparency only), and minimal-risk (no mandatory duties). Most software starts in limited or minimal risk. The expensive surprises live in high-risk and prohibited — which is exactly why scanning early matters.
Article 50 applies in full: AI output that is generated or manipulated to resemble real people or events but looks authentic must be machine-readable marked and disclosed to affected people and, when published to inform the public, clearly labelled. This is not a future obligation — it has been enforced since August 2026. A deepfake generator that ships without marking its own output is the easiest fine for a regulator to issue.
If you develop the synthesis or clone tool, you are the provider and must design machine-readable marking into the output. If you only run the tool to make content, you are the deployer and own the human-facing disclosure. Both sides can be fined — which is why scan reports on both the generation pipeline and the serving/watermarking layer matter.
The Digital Omnibus (Regulation (EU) 2026/1744) adds two banned practices from December 2026: generating realistic non-consensual intimate imagery and synthetic sexual-abuse material. Running or distributing tools that do this moves you from a transparency violation to a Tier-1 prohibited-practice violation — the €35M/7% fine tier — and removes the product from the EU market entirely.
See your score in 2 minutes. No signup, no code stored.
Scan Your Codebase NowOnly output that resembles real people or events and could be mistaken for authentic. Anime-style art or obviously synthetic graphics normally does not require disclosure.
No. You need machine-readable marking, human-facing disclosure, and a deployment record. The watermark must survive resizing, screenshots and re-uploads — a basic corner logo usually fails an audit.
Then you are the deployer. You still owe human-facing disclosure when the synthetic content is published, even if you did not build the generator.