A compliance guide for brands and agencies running AI-generated ad creative in European markets.

Say you are a skincare brand running Meta ads across Europe with AI-generated video testimonials. Since August 2, 2026, those ads have needed a visible disclosure telling viewers the content is AI-generated, plus machine-readable metadata embedded in the file. You, as the brand, are legally responsible for the disclosure. Your AI tool provider is responsible for the metadata. If either of you fails to comply, the penalty can reach 3% of your global annual turnover, or €15 million, whichever is higher.

That is the EU AI Act. Unlike the patchwork of state-level rules in the US, this is a single regulation across all 27 EU member states, with extraterritorial reach to any brand whose AI-generated content touches EU audiences. This post breaks down what it requires now that Article 50 applies, what changed with the final Code of Practice and Commission guidelines, what the penalties look like, and what you need to have in place.

Implementation timeline

The EU AI Act does not land all at once. It has been rolling out in phases since it entered into force on August 1, 2024, with the final provisions applying by August 2028. For advertisers, here is what matters at each stage:

If you have already read through the US AI regulation landscape or the global AI advertising laws, the key difference is structural. The US has five separate jurisdictions with different rules, different enforcement bodies, and different timelines. The EU has one regulation with one penalty framework, though enforcement is split rather than centrally coordinated. The AI Office in Brussels only oversees general-purpose AI model providers (including systemic-risk models), AI systems built by those same providers, and AI systems embedded in very large online platforms under the DSA. Article 50 transparency obligations (ones that actually cover ad creative) are enforced by each of the 27 member states’ own national authority, independently. The rules are the same whether your ads run in France, Germany, or Poland.

This isn’t just a brand-and-agency rule. If a creator posts AI-generated content on their own account and it’s part of an activity they’re paid for regularly (sponsored posts, affiliate content, a monetized page) the Commission’s own guidance treats them as a deployer in their own right, personally on the hook for Article 50 disclosure. Purely personal, non-monetized posting stays outside the Act’s scope.

Article 50: the disclosure rule (in force since August 2, 2026)

Article 50 is the provision that most directly affects brands and agencies producing ad creative. It establishes transparency obligations for anyone deploying AI systems that generate or manipulate content, interact with people, or categorize them biometrically.

It has applied since August 2, 2026. The Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) pushed back the high-risk rules but left Article 50’s date unchanged. The only delay is for AI tool providers’ marking duty, covered below.

What the law covers

The transparency obligations fall into four categories, but two matter most for advertising:

Provider obligation (Article 50(2)): Providers of AI systems that generate synthetic audio, image, video, or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. This means the AI tool itself (Runway, Midjourney, ElevenLabs, Arcads, Creatify, HeyGen, or any similar platform) must embed metadata into every piece of content it produces. The provider is responsible for making this marking effective, interoperable, and robust.

Deployer obligation (Article 50(4)): Deployers of an AI system that generates or manipulates image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. In advertising terms, the “deployer” is typically the brand or agency that commissions and publishes the ad. If you use an AI tool to generate a video spokesperson, alter a creator’s appearance, or produce a synthetic voiceover, you are the deployer, and the disclosure obligation sits with you.

What counts as a “deepfake” under the Act

The definition is broad. A deepfake under the EU AI Act is “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.” Three conditions must be met: the content must be generated or manipulated using AI, it must resemble real people, places, or events, and it would falsely appear authentic to a reasonable viewer.

For advertisers, this definition likely catches AI-generated video spokespeople, AI avatars presenting product testimonials, synthetic voiceovers designed to sound like real human speech, and AI-altered footage where a creator’s appearance or voice has been significantly modified. It is broad enough to cover the outputs of most AI UGC tools that produce realistic-looking human presenters in video ads.

What it does not cover: AI used for standard editing tasks that do not substantially alter the input. Colour grading, noise removal, auto-captioning, background blur, and similar post-production tools fall outside the scope because they “perform an assistive function for standard editing” and “do not substantially alter the input data.”

The artistic and creative exception

Article 50(4) includes an exception for content that forms part of “an evidently artistic, creative, satirical, fictional or analogous work or programme.” However, this exception is narrower than it first appears. Advertising is commercial speech, not artistic expression, and the exception does not eliminate the disclosure requirement. For a standard product ad or UGC-style testimonial, you should assume the full disclosure obligation applies.

How to disclose (the Code of Practice)

The Act itself does not specify exact label formats, which is where the Code of Practice on Transparency of AI-Generated Content comes in. The European Commission published the final Code on 10 June 2026, and in July the Commission and the AI Board confirmed it as an adequate way to meet Article 50. Roughly 190 organisations have signed on, including Google, Meta, Microsoft, OpenAI and Synthesia. The Commission then published its final Article 50 guidelines on 20 July 2026.

The final Code comes with three ready-to-use EU icons: one for fully AI-generated content, one for AI-modified content, and a basic icon that can open a second layer with more detail. Using the EU icon is voluntary. You can use your own label instead, as long as it meets the Code’s design and placement rules: people must notice it without clicking anything, it must stay visible long enough, and they must see it no later than the moment they first see the content. For audio-only ads, such as a podcast spot, the label is a spoken disclaimer.

Providers must embed machine-readable metadata using open, interoperable standards. The C2PA (Coalition for Content Provenance and Authenticity) standard is the technical backbone being adopted, attaching cryptographically signed metadata to files that records what tools were used and whether AI was involved.

In practice, this means two layers of disclosure for AI-generated ad creative: a visible label that consumers can see, and invisible metadata that platforms and detection tools can read even if the visible label is removed.

What the final guidelines say about ads

The Commission’s final Article 50 guidelines settle several questions advertisers were asking:

• Ads rarely count as “evidently creative”. Every advertising example in the guidelines needs a standard label.
• Product imagery counts too. An AI image that makes your product look better than it really is counts as a deepfake. A real product shot on an AI-generated background doesn’t.
• One label at the start may not be enough. If people may not see your content from the beginning, the guidelines ask you to repeat the disclosure. For in-feed video that people scroll into partway through, a label that stays on screen is the safer choice.
• No retroactive labelling. AI images, video and audio generated before August 2, 2026 don’t need a label now, though labelling them is encouraged. Anything generated since does.

Penalties for transparency violations

• Prohibited AI practices: up to €35 million or 7% of global annual turnover, whichever is higher.
• Transparency and high-risk violations: up to €15 million or 3% of global annual turnover, whichever is higher.
• Lesser infringements (e.g., providing incorrect information to authorities): up to €7.5 million or 1% of global annual turnover, whichever is higher.

There’s a flip worth knowing if you’re an SME: Article 99(6) reverses the usual “whichever is higher” rule for small and medium-sized enterprises and startups – for them, it’s whichever is lower. A €10M-revenue brand facing the transparency-violation tier isn’t staring down €15M; its exposure is capped at 3% of turnover, or €300,000, because that’s the lower of the two figures.

So far, no regulator has issued a fine under the AI Act. Enforcement is national, and several member states are still setting up their authorities. Don’t read that as a free pass: fines are set per infringement, and how long a campaign ran and how many people it reached both count toward the amount.

What about your AI tool provider?

The EU AI Act also regulates the general-purpose AI models that power the tools brands use. OpenAI, Google, Midjourney, Runway, ElevenLabs, and similar providers fall under Chapter V obligations as providers of GPAI models. These obligations have applied since August 2, 2025, and the Commission’s powers to enforce them, including fines, have applied since August 2, 2026.

GPAI providers must maintain detailed technical documentation, publish summaries of training data, and comply with EU copyright law. Non-compliance can result in fines of up to €15 million or 3% of global revenue.

You are not directly liable for your AI provider’s GPAI compliance. But here is where it affects you: if your AI tool provider fails to embed proper metadata in generated content (as required under Article 50(2)), and you publish that content without disclosure, the deployer obligation still applies to you. This matters right now: tools that were already on the market before August 2, 2026 have until December 2, 2026 to add marking, so some AI outputs may carry no metadata yet. Your disclosure duty applies either way.

For brands working with real human creators, none of this applies. Content filmed by real people on camera does not constitute a deepfake under the Act. No disclosure is required, no metadata embedding is needed, and there is no chain of provider-deployer liability to manage. The compliance overhead simply does not exist when the content is authentic.

High-risk AI systems: the targeting rule for regulated categories (from December 2, 2027)

This section’s requirements were delayed from Aug 2, 2026 to Dec 2, 2027 by the Digital Omnibus, but the substance doesn’t change – worth planning for now regardless of the extra runway.

Most brands running standard paid social campaigns with AI-assisted creative tools will not fall into the high-risk category. But if your company uses AI systems for certain types of consumer profiling or automated decision-making, this section matters.

What counts as high-risk

Annex III of the EU AI Act lists eight categories of high-risk AI systems. The ones most relevant to marketing and advertising include AI systems used for recruitment and candidate screening (placing targeted job ads, filtering applications, evaluating candidates), credit scoring and creditworthiness assessment, insurance risk assessment and pricing, and any AI system that performs profiling of natural persons.

Profiling is defined broadly: automated processing of personal data to evaluate aspects of a person’s life such as economic situation, preferences, interests, reliability, behaviour, location, or movement. If your ad targeting system builds individual profiles that predict purchasing behaviour and those profiles influence credit, insurance, or employment-adjacent decisions, it may cross into high-risk territory.

What high-risk classification requires

Providers and deployers of high-risk AI systems face the heaviest compliance burden in the entire Act. Requirements include a documented risk management system, robust data governance procedures, detailed technical documentation, automatic event logging, human oversight mechanisms, and registration in the EU database for high-risk AI systems. Deployers must also conduct a fundamental rights impact assessment before putting a high-risk system into use.

Who this affects in advertising

For the majority of DTC brands and performance agencies, standard AI-powered ad targeting through Meta, Google, or TikTok’s own algorithms does not make you a high-risk deployer. The platforms themselves bear the provider obligations. Where brands cross the line is when they deploy their own proprietary AI systems for customer profiling, dynamic pricing, or targeting in regulated categories like financial services, health insurance, or employment.

If you are a DTC brand in beauty, apparel, food and beverage, or consumer electronics, and you use the standard ad targeting tools provided by Meta or Google, this section likely does not apply to you. Your primary compliance concern is Article 50 transparency.

Platform enforcement: how Meta, TikTok, and Google are responding

Major ad platforms didn’t wait for August 2026 to start enforcing AI content transparency. All three scan for AI-generated content and apply their own labels. These labels don’t replace yours, though. Under the Commission’s guidelines, a platform that only distributes your ad isn’t the deployer, so the disclosure duty stays with you.

Meta uses a dual-track system. Automated classifiers scan uploaded content for AI-generation signals, including C2PA metadata, IPTC digital source type metadata, and proprietary detection models. When AI content is detected, Meta discloses AI-generated content through an “AI Info” label on organic posts, with more detailed in-panel disclosure for ads.

Meta is also building AI generation into the default ad workflow. In October 2026 it made video generation from static images generally available in Advantage+ creative. If you use it and the result looks like real footage, you’re the deployer of that AI content, and the disclosure is yours.

TikTok scans all uploaded media for C2PA metadata. Major AI tools now embed C2PA provenance data in their outputs, so if TikTok detects those markers, it automatically applies an “AI-generated” label regardless of whether the creator disclosed it themselves. TikTok has labelled over 3 billion videos with AI provenance data, and joined the C2PA Steering Committee on 28 July 2026 – meaning it now helps govern the standard, not just implement it. Creators are also required to self-declare AI-generated content; failure to do so can result in content removal.

Google and YouTube are rolling out C2PA content-credential support – Google surfaces provenance data in Search results, and YouTube is beginning to surface it on uploads. Google has also been disclosing AI use in ads since July 2026. The “How this ad was made” panel shows whether an ad was created or edited with AI across Search, YouTube and Discover. Campaigns targeting the EU get a visible label when they use assets marked as AI-created or AI-edited. Google adds the disclosure automatically for its own generative AI tools; for AI used elsewhere, advertisers declare it themselves. YouTube also requires creators to disclose when realistic-looking content has been significantly altered or synthetically generated.

The convergence on C2PA as the technical standard is significant. It means the metadata requirements under the EU AI Act are not just a regulatory obligation. They are becoming the technical infrastructure that platforms use to detect and label AI content globally. If your AI tools strip or fail to embed C2PA metadata, platforms will still detect AI content through their own classifiers and apply labels you cannot control.

Extraterritorial scope: does this apply to non-EU brands?

Yes. The EU AI Act uses an output-based jurisdiction model. Under Article 2, the Act applies to providers and deployers outside the EU whenever an AI system is placed on the EU market or its output is used in the Union. It does not matter where your company is incorporated, where your servers are located, or where your team sits.

If your AI-generated ads reach consumers in any EU member state, the EU AI Act applies to you. A DTC brand in California running Meta ads with AI-generated testimonials that are served to users in Germany, France, or Spain is subject to the same transparency obligations as a brand headquartered in Berlin.

The final Article 50 guidelines add one more point: publishing AI content on the open internet can trigger the disclosure duty if it’s used in the EU, even if you didn’t target EU audiences. The guidelines mention geo-blocking the EU as one way to stay out of scope.

Non-EU providers of high-risk AI systems are also required to designate an authorized representative in the EU under Article 22. For brands that are solely deployers of AI-generated ad creative (not providers of AI systems), the representative requirement does not apply, but the transparency and disclosure obligations do.

This extraterritorial reach follows the GDPR model. If your company already complies with GDPR because you process EU consumer data, the jurisdictional logic is identical. If your ads reach EU audiences, the EU AI Act reaches you.

A note on the UK

The UK still has no standalone AI Act. The May 2026 King’s Speech confirmed the government won’t follow the EU’s horizontal-regulation model; AI-relevant provisions are instead scattered across a Cyber Security Bill, digital ID measures, and a “Regulating for Growth” bill, with binding rules on frontier AI developers and a ban on sexually explicit deepfakes still pledged but not yet legislated.

What to do next

The short version: audit your creative pipeline for AI-generated content, verify your AI tools embed C2PA-compliant metadata, set up a disclosure workflow now if you don’t have one, and update your creator briefs to require AI tool declarations. Here is a full compliance guide that walks through each of those steps in detail, including a decision framework, a human-vs-AI-vs-hybrid comparison table, and a step-by-step audit checklist for your campaigns.

But step back from the checklist for a moment and consider what the regulation is actually telling you. Every AI-generated ad that now requires a visible AI disclosure label is an ad where the brand has to publicly acknowledge the content is synthetic. Every human-creator ad that does not carry that label sends the opposite signal: this is real.

Meta labels AI-generated ads. TikTok labels AI-generated ads. YouTube labels AI-generated ads. When consumers scroll through a feed and see an AI disclosure label on one video and nothing on the next, that absence communicates something. It signals that a real person chose to show up, speak in their own voice, and put their face behind the product. No algorithm generated them. No regulation required them to be flagged.

The EU AI Act, combined with New York’s synthetic performer law, California’s metadata requirements and California’s new synthetic performer rule for ads (SB 1050, from January 1, 2027), is building a visible distinction between synthetic and authentic content across every platform where ads run. For brands that work with human creators, that is not just a lower compliance burden. It is a positioning advantage that grows more visible with every new disclosure mandate that takes effect. That advantage isn’t just theoretical. A 2026 Ipsos study on AI generated ads tested it directly and found human-made ads beating AI-generated ones on both short-term and long-term effectiveness scores.

If your creative pipeline already runs on authentic creator content, Article 50 does not require you to add labels, embed metadata, or rework your QA process. You are already on the right side of the line the regulators are drawing.

Explore authentic UGC creators at Billo

FAQs