Oskar Engman
Associate
Stockholm
Norway, Sweden, Denmark, UK
by Oskar Engman
Published:
Article 50 of the AI Act sets transparency rules for AI-generated content. Providers must mark synthetic content as artificial. Deployers must go further in two cases: disclosing deepfakes, and disclosing certain AI-generated text published on matters of public interest. This article covers the deployer side only, as the most common use case. However, neither Article 50(4) nor (5) prescribes how disclosure must be made. On 8 July 2026, the Commission issued its Opinion on a new Code of Practice closing that gap, finding that businesses can rely on it to demonstrate compliance.
Deployers generating or manipulating image, audio or video content constituting a deep fake shall disclose that it has been artificially generated or manipulated. However, where the content is part of an evidently artistic, creative, satirical or fictional work, this narrows to disclosing merely that such content exists, without hampering enjoyment of the work. Deployers generating AI text published to inform the public on matters of public interest must make an equivalent disclosure, unless it has undergone human review or editorial control with a named responsible person. Disclosure must be clear, distinguishable, given no later than first exposure, and accessible.
Article 50(7) lets the AI Office facilitate EU-level codes of practice, subject to Commission approval by implementing act. On this basis, a Code of Practice on Transparency of AI-generated content was published on 10 June 2026. Its Section 2 sets the deployer rules on labelling deepfakes and public-interest text, built around four commitments: Disclosure of Deep Fakes and Published Text, Internal Processes, Disclosure for Artistic, Creative and Similar Works, and Human Review and Editorial Control for Published Text.
On 8 July 2026, the Commission's Opinion assessed whether the Code adequately implements Article 50(4) and (5). It concluded that "the Code of Practice on Transparency of AI-generated content adequately covers the obligations provided for in Articles 50(2), (4) and (5) AI Act and facilitates their effective implementation," and that "providers and deployers [...] may rely on the Code as the EU-wide recognised instrument that is considered adequate to ensure compliance with their respective obligations," while noting that "adherence to the Code does not constitute conclusive evidence of compliance with these obligations." A business joins by signing up as a "Signatory" and following the commitments — no filing is required. However, signing up is not conclusive proof of compliance; regulators may still scrutinise actual practice. This Opinion is also only the adequacy assessment; formal approval by implementing act may still follow.
Whether Article 50(4) applies depends on the content, not on whether AI was used. The deepfake rule catches only content resembling a real, identifiable person, object, place or event that would look authentic — stylised or obviously AI-generated content is unlikely to qualify, while photorealistic product photos/video or a cloned voice/likeness sit closer to the line. The text rule is narrower, catching only AI content published to inform the public on matters of public interest, which ordinary marketing copy typically does not meet. However, the obligation applies regardless of audience size or privacy. For most businesses, the real question is not whether AI was used, but whether content is realistic enough to be a deepfake, or close enough to public-interest reporting to trigger the text obligation — and if it is, the Code of Practice is now a practical route to compliance.
Associate
Stockholm
Partner
Oslo
Partner
Oslo
Partner
Oslo
Partner
Oslo
Partner
Oslo
Partner
Oslo
Partner
Stavanger
Partner
Stavanger
Partner
Oslo
Associate
Stockholm
Managing Associate - Qualified as EEA lawyer
Oslo
Senior Lawyer
Oslo
Senior Associate
Oslo
Senior Associate
Stockholm
Associate
Oslo
Associate
Oslo