EU's AI Act transparency rules are now live — and they put deepfakes on notice

Article 50 of the EU AI Act just kicked in, and it’s drawing a hard line in the sand for how businesses deploy generative AI. If you’re running a chatbot, a deepfake generator, or even an emotion recognition system in Europe, the days of operating in the shadows are over. The core mandate is disarmingly straightforward: people have a right to know when they’re talking to a machine or looking at synthetic media. For providers, that means building systems with transparency baked in from the start. AI-generated audio, video, and images now need a machine-readable mark flagging them as artificial — a technical hurdle that the Act acknowledges is only required “as far as this is technically feasible,” weighing cost against the state of the art.

Deployers face their own disclosure duties that get granular fast. Emotion recognition and biometric categorization systems require explicit notice to anyone exposed to them, layered on top of existing GDPR obligations. Deepfakes get a dedicated rule: any artificially generated or manipulated image, audio, or video must carry a disclosure. The law does carve out breathing room for art, satire, and fiction, where the label just needs to flag the content’s existence without ruining the viewer’s experience. But the sharpest teeth are reserved for public interest text. If you publish AI-generated news without human editorial review and someone holding responsibility, you’re in violation. Standard newsroom editing clears the bar; raw, unedited AI output dumped into a story does not.

The compliance framework is a patchwork of three enforcement bodies — national market surveillance authorities, the AI Office, and the European Data Protection Supervisor — but Brussels is offering at least one shortcut. Signing on to the Code of Practice on Transparency of AI-generated Content is a recognized path for meeting the marking obligation. Skip the Code, and you’ll need to convince those surveillance authorities you’ve found another adequate path, though the Commission’s guidelines remain frustratingly vague on what that looks like in practice. For the other transparency duties — informing users they’re interacting with AI, disclosing deepfakes, flagging public interest text — there is no code. No shortcut. Providers and deployers are on their own to figure out adequate measures, with the guidelines acting as a reference point, not a checklist.

What makes this genuinely significant isn’t just the rules themselves, but the timing. Article 50 lands right as distinguishing AI-generated content from human creation has become a practical impossibility for the average person. The Commission explicitly links synthetic media to manipulation at scale, fraud, and consumer deception — and they’re not wrong. We’ve already seen deepfake video calls used to steal millions from companies, and AI-generated news sites mushrooming with zero editorial oversight. What the guidelines don’t address, and what will likely become the real battleground, is enforcement. A machine-readable watermark is only as good as the tools that detect it, and right now, those tools are patchy at best. The Commission has laid down a marker, but whether it changes behavior or just creates a compliance paperwork industry is the open question.