AI content labelling: what does Article 50 of the AI Act require?

The marketing team has put together a campaign for customers in Sweden and Germany. The main image shows a house by a fjord that does not exist, created in an image generator. Next to it is a piece on electricity prices next winter, written by a language model and sent out in the newsletter. The example is invented. From 2 August 2026, anyone publishing content like this in the EU has to decide whether it must be labelled as AI-generated.

The question has become a live one. On 5 October 2026 OpenAI announced that it is adding invisible watermarks to text from ChatGPT and Codex for users in the EU, and that API customers can switch on the same feature. According to a report in BleepingComputer, the watermark is based on word choice and weakens when the text is edited or translated. We have not been able to check OpenAI’s own announcement directly.

What is AI content labelling under the AI Act?

AI content labelling refers to the transparency rules in AI Act Art. 50 that apply when artificial intelligence creates or alters content. The AI Act splits the obligations in two. The provider of the AI system must ensure technical, machine-readable marking. The business using the system, known as the deployer, must in certain cases give a visible disclosure to the people who see the content.

Under AI Act Art. 50(5), the information must be clear and distinguishable, be given at the latest at the time of the first interaction or exposure, and meet the applicable accessibility requirements.

Is the business a provider or a deployer?

Most marketing and communications departments are deployers. Under AI Act Art. 3(4), a deployer is anyone using an AI system under its own authority in a professional context. If you buy access to ChatGPT, Midjourney or Copilot, you are a deployer.

Product teams should look more closely. Under AI Act Art. 3(3), a provider is anyone who develops an AI system, or has one developed, and puts it into service under its own name or trade mark. A business that builds an image generator or a writing assistant on top of someone else’s language model and offers it to customers under its own brand may therefore become a provider, with a duty of machine-readable marking under paragraph 2. Where the line falls for thin integrations has not been settled in practice.

What must the provider of the AI tool do?

Under AI Act Art. 50(2), the provider must ensure that text, images, audio and video from the system are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solutions must be effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the type of content, the costs and the state of the art. The obligation does not apply to functions that only assist with standard editing or that do not substantially alter the content. Spell checking and copy editing therefore fall outside it.

Systems placed on the market before 2 August 2026 have until 2 December 2026 to introduce machine-readable marking. The transitional rule was introduced by Regulation (EU) 2026/1744, the so-called Digital Omnibus, and is described by the Norwegian Communications Authority (Nkom). We have not been able to check the wording of the omnibus directly on EUR-Lex.

Under AI Act Art. 50(1), the provider must also design chatbots and other systems that interact with people so that users are told they are dealing with an AI. If you have built the customer service bot on your website yourselves, this obligation is yours.

When must the business itself label AI-generated content?

The business must give a visible disclosure in two situations under AI Act Art. 50(4). The first is deepfakes. Under AI Act Art. 3(60), a deepfake is image, audio or video content generated or manipulated by AI that resembles existing persons, objects, places, entities or events and would falsely appear to be authentic or truthful. The definition reaches further than doctored videos of politicians. A photorealistic image of a product, a well-known building or an event that never happened may also be covered. Where the content is evidently artistic, satirical or fictional, it is enough to disclose the use of AI in a way that does not spoil the experience.

The second situation is text. If AI generates or manipulates text published to inform the public on matters of public interest, the business must disclose this. The obligation falls away when the text has undergone human review or editorial control and someone holds editorial responsibility for the publication. For most businesses, this exception matters more than anything else in the article. It requires a genuine review, not a quick glance, see checking AI-generated text.

The invisible marking is the provider’s responsibility. The visible label is the business’s.

If the business uses emotion recognition or biometric categorisation, for example in a campaign that analyses facial expressions, the persons affected must be informed under AI Act Art. 50(3). Data protection rules apply in addition.

What do the Commission’s code of practice and guidelines say?

On 10 June 2026 the Commission published a voluntary code of practice on transparency of AI-generated content. One part covers providers’ marking and detection, and another covers deployers’ visible labelling of deepfakes and text. The Commission and the AI Board have assessed the code as an adequate tool for demonstrating compliance, and around 190 organisations had signed it by the end of July. The Commission has also produced EU icons for visible labelling.

The Commission’s guidelines on the Article 50 obligations followed on 20 July 2026. They are not binding, but supervisory authorities will use them. A business that follows both the code and the guidelines is in a strong position.

Do the labelling requirements apply to Norwegian businesses?

Not as Norwegian law yet. The AI Act has not been incorporated into the EEA Agreement. On 4 August 2026 the Norwegian Government announced that the bill for a Norwegian AI Act would be sent out for a new consultation this autumn, with the aim of presenting it to the Norwegian Parliament in spring 2027. When we checked on 8 October, the new consultation had not been issued.

Norwegian businesses with customers in the EU may nevertheless be caught now. Under AI Act Art. 2(1)(c), the regulation applies to providers and deployers in third countries where the output produced by the AI system is used in the EU. A campaign featuring a deepfake aimed at Swedish consumers is output of that kind. Breaches of Article 50 can lead to fines of up to EUR 15 million or 3 per cent of global annual turnover under AI Act Art. 99(4). How EU supervisory authorities will enforce this against businesses with no establishment in the EU has not been tested.

In Norway, the Marketing Control Act (markedsføringsloven) already applies. Under Marketing Control Act § 2(3), advertising in which the shape, size or skin of a body has been altered by retouching or other manipulation must be labelled. On its wording, that also covers AI-manipulated images of people. An AI image that gives consumers a false impression of the product may in addition be misleading under Marketing Control Act § 7.

What should the contract with the AI provider say?

The contract should turn the provider’s obligation under Article 50 into a contractual obligation owed to you, with information you can actually use. The standard terms of the large providers say little about this. When negotiating or procuring, ask for the following.

1. Include a warranty that the service complies with AI Act Art. 50(1) and (2), including after the transitional deadline of 2 December 2026.
2. Require a description of the marking method (watermark, metadata or both), which content types it covers, and whether exporting or editing in the tool strips the marking.
3. Agree access to a tool for detecting the marking, or to the provider’s confirmation in a specific case. According to the reports, OpenAI makes its detector available only to approved researchers and professional organisations.
4. Require reasonable notice before changes to the marking, for example when watermarking is switched on for new account types or countries. Such a change can affect workflows and agreements with customers.
5. Agree that the provider will indemnify you against fines and claims resulting from breaches of the provider’s own obligations, and that this indemnity sits outside the liability cap. There is more on this in the article on limitation of liability in SaaS agreements.
6. Ask for logs or other traceability showing which content was generated, when and with which model.

If you are yourselves the provider of an AI product to customers, the same applies the other way round. Your customers will make these demands of you. See also the contracts topic page.

What should the marketing and communications team do now?

Start by mapping where AI produces images, video, audio and text that are published externally, and which markets the content reaches. Distinguish between content realistic enough to be a deepfake and content that is obviously illustration. Decide who holds editorial responsibility for texts on matters of public interest, and document that the review actually takes place. Employees who produce the content need training in the rules, which also follows from the requirement of AI literacy. More articles on the regulatory framework can be found on the artificial intelligence topic page.

Finally, add a separate AI labelling column to the publishing plan with three options. No label, a visible label with the EU icon, or an exception because the text has been edited by a named person.

Questions and answers

Next legal review: 1 November 2026