AI marking: What marketing production must check under Article 50

AI marking is becoming a production responsibility: what CMOs need to organise

Editorial reference date: 17 October 2026. Article 50 of the EU AI Act has applied since 2 August 2026. For marketing teams, this does not mean adding a visible AI stamp to every asset. The relevant questions concern different obligations for providers and deployers, the type of content involved, and the context in which it is published. Confusing those distinctions can create unnecessary notices while leaving actual transparency requirements unaddressed.

The operational challenge starts before publication. An image moves from a generator through retouching and layout, then export, compression, and another processing stage on a platform. Technical provenance information can disappear along the way. Meanwhile, a concept originally intended for internal discussion might later appear as apparently authentic documentation. For a CMO, this means AI transparency belongs in briefing, procurement, approval, and distribution, not exclusively with the legal team.

This article separates the legal layers and translates them into a practical production approach. It does not replace assessment of individual cases. The controls below are organisational recommendations; they are neither a complete list of mandatory procedures nor a guarantee of legal compliance.

Two obligations your team needs to distinguish

Providers: technical detectability of output

Article 50(2) concerns providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video, or text content. They must ensure that outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated. Technical solutions should be effective, interoperable, robust, and reliable as far as technically feasible. The specific characteristics and limitations of different content types, implementation costs, and the generally acknowledged state of the art must be considered.

That is more precise than asking for an arbitrary metadata field. A field that nobody else can interpret does not resolve interoperability. Equally, a visible notice alone is not a complete answer to a machine-readable marking obligation. Our glossary on machine-readable AI marking explains the underlying terminology and distinction.

The obligation does not apply to the extent that the system performs an assistive function for standard editing or does not substantially alter the input data supplied by the deployer or their semantics. This limitation is not permission to exempt every feature marketed as an assistant. Assess what the operation actually changes: a technical correction and a materially altered scene are not automatically equivalent. The legislation also includes a narrow exception concerning legally authorised criminal-law purposes, not an ordinary marketing exemption.

Deployers: disclosure to people

Article 50(4) addresses deployers in particular situations. Where AI-generated or manipulated image, audio, or video content constitutes a deepfake, its artificial generation or manipulation must be disclosed. Not every synthetic image automatically constitutes a deepfake. The statutory definition, resemblance to existing people, objects, places, entities, or events, and a false appearance of authenticity or truthfulness are relevant to that assessment.

There is also a disclosure obligation for AI-generated or manipulated text published with the purpose of informing the public on matters of public interest. That text obligation does not apply where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for its publication. An unchecked click on an approval button is not a persuasive editorial process.

Roles follow actual activities rather than job titles. A brand using someone else's system will typically be a deployer; an organisation developing or commissioning a system and placing it on the market or putting it into service under its own name may be a provider. Agency contracts should clarify responsibilities, but do not automatically change statutory roles. The glossary on AI transparency obligations provides a starting point.

Why “all AI content needs a visible label” is wrong

The AI Act distinguishes technical marking from disclosure to an audience. Machine-readable information may serve technical processing. Required disclosure, however, must reach people clearly and distinguishably. Article 50(5) requires the information at the latest at the first interaction or exposure, while meeting applicable accessibility requirements.

This creates neither a universal visible-label rule for every AI-assisted advertisement nor permission to hide every disclosure in metadata. Ordinary product copy may require a different assessment from an AI-written article about public health. A synthetic product film may differ from fabricated footage of a real person. The actual classification matters more than the file extension or the fact that an AI tool appeared somewhere in production.

For evidently artistic, creative, satirical, fictional, or analogous works, deepfake disclosure is adapted: the existence of generated or manipulated content must be disclosed appropriately without hampering the display or enjoyment of the work. This is not a blanket exemption for art or satire. Likewise, the exception for editorially controlled text does not automatically remove a separate deepfake obligation concerning accompanying images or audio.

C2PA: useful provenance, not a truth machine

C2PA describes a standard for cryptographically secured provenance information. Content Credentials can carry signed statements about an asset, its ingredients, and editing actions. Validation can establish whether signed information remains unchanged and how it is bound to an asset. What a particular application records and displays still depends on its implementation and trust model.

A valid signature does not make a depicted scene true. It does not establish that every relevant edit was recorded, that a person consented, or that all usage rights are available. Nor does a technical provenance chain automatically satisfy Article 50. Your team still needs to examine purpose, scope, detectability, and the actual publication. Our glossary on C2PA and Content Credentials separates these concepts.

Metadata can be removed during export, screenshots, downloads, or platform uploads. C2PA also supports approaches through which provenance information may be rediscovered using additional bindings and external storage. Recovery depends on supported methods, available services, and the particular asset. It is not universal and should not be planned as a guaranteed fallback for every publication channel.

Conversely, an asset without discoverable credentials has not thereby been proven human-made. Its provenance may be unknown, the information may never have been supplied, or it may have been lost in transit. A failed validation attempt should not automatically be communicated as evidence of deception either. In an operational dashboard, “no information found” and “signature validation failed” are different states requiring different interpretation.

Solutions for production that carries transparency with it

• Assign responsibility before briefing. Name an owner for the published asset and decide who handles tool assessment, editorial control, technical checks, and legal escalation. This can sit within an existing approval system. What matters is that nobody assumes the agency, platform, or legal team has already checked the entire chain. Record who makes a fresh decision when an approved asset is subsequently changed.

• Keep inputs and transformations traceable. Record source material, permitted uses, tool and version, relevant editing operations, and intended channels. Retain only the information needed for that purpose; complete prompts may contain confidential or personal data. Distinguish technical correction from semantic alteration and briefly record the reasoning. Moving an internal mood board into a public campaign should trigger another assessment rather than inheriting the original assumption.

• Procure tools by inspecting their output. Ask providers which machine-readable markings they use, which formats they support, and what limitations are known. Request actual sample files. Test whether the information survives your editing, layout, and export workflow. A product badge or an “AI compliant” claim is not a substitute for a technical trial or a meaningful contractual allocation of responsibilities.

• Make editorial control substantive. For text about matters of public interest, review claims, sources, and context, and identify who holds editorial responsibility. Record the reviewer and material corrections. This supports accountability; it is not a universally prescribed statutory form. An automatic grammar check does not amount to comprehensive fact-checking, and a review process should match the subject and potential consequences of publication.

• Design accessible, contextual disclosure. Where disclosure is required, plan for the audience's first exposure to the content. The notice needs to be understandable and distinguishable, not merely discoverable somewhere. Consider language, readability, contrast, captions, screen-reader access, and audible information where appropriate to the medium. A hidden hashtag or a purely technical credentials display is not sufficient simply because it exists.

• Treat export and upload as separate checkpoints. Keep an approved master and examine each relevant distribution route. After compression, cropping, and upload, inspect the version people can actually access, not just the file in your editorial system. Check technical provenance and audience-facing disclosure separately. If a platform removes information, assess the distribution route instead of silently assuming complete preservation.

• Separate rights clearance from transparency. Check licences, personality rights, voice permissions, data protection, and any relevant trademark or advertising questions independently. A correct AI notice does not legalise an otherwise impermissible use. Conversely, a licence does not automatically eliminate transparency obligations. Link the results in the asset record while keeping their distinct responsibilities and decision criteria visible.

What a defensible approval route looks like

Start with a short intake: what will be published, for whom, and with what claim to authenticity? Identify which elements were AI-generated or manipulated. Assess provider and deployer roles separately. Then examine deepfake classification and, for text, public interest, editorial control, and responsibility for publication. Escalate uncertain cases for qualified legal assessment before publication rather than turning a production checklist into a legal conclusion.

Next, decide what technical provenance information is expected and what human-perceivable disclosure is required. Attach those decisions to the asset rather than leaving them only in email. Design implements the notice; production checks the export; the channel owner verifies the published version. A final record might contain the date, URL, version, check result, and responsible person.

Test variants as well. Portrait crops, short edits, thumbnails, muted autoplay, and embedded players can lose the original notice. When a longer production becomes a series of clips, an audience may encounter an excerpt first. Disclosure in the original long-form version does not automatically answer the requirements of that new point of exposure. Review the individual experience rather than assuming the campaign functions as a single uninterrupted work.

When something goes wrong, use a simple correction route. Where appropriate, pause further distribution, preserve the findings, correct the asset or accompanying information, and check again. Record whether existing publications can be replaced and which partners need notification. Do not promise complete retrieval: redistributed files and independent reposts may sit outside your control even after the original upload is corrected.

Distinguishing three common marketing scenarios

An AI-retouched product image: Standard correction may fall within the limitation on the provider marking obligation. Materially changing product properties, surroundings, or the depicted use requires closer examination. Also assess whether the image creates a misleading impression of authenticity and constitutes a deepfake. Product accuracy and advertising law remain separate questions. “Created with AI” does not cure a false representation of a product feature.

A synthetic testimonial: Recreating a real person or voice calls for careful deepfake assessment and separate rights clearance. Build any required disclosure into the script and sound design. Check the result without sound, in short extracts, and on partner websites. Consent from the depicted person does not automatically determine what transparency the audience must receive when encountering the testimonial.

An AI-assisted article about energy policy: The publication may aim to inform the public on a matter of public interest, so assess the text provision explicitly. Where genuine human review or editorial control has taken place and editorial responsibility is held for publication, the corresponding disclosure obligation may not apply. Any accompanying manipulated image or audio element still requires its own assessment rather than inheriting the text exception.

What to measure without creating false confidence

Useful internal measures concern the process. Do published assets have a named owner? Were required notices checked in the version actually distributed? Which export routes remove provenance information? Where do roles or usage rights remain unresolved? These questions provide actionable management information without inventing a universal compliance score or pretending that every asset carries the same risk.

Record outcomes as verifiable states, such as “checked”, “unresolved”, or “reassessment required after channel change”. Avoid a single green badge that merges legal, editorial, and technical questions. For budgeting, identifying the handover that repeatedly loses information is often more useful than presenting a large total of supposedly safe assets. Measures should support decisions and learning, not turn incomplete evidence into reassuring performance theatre.

Procurement and collaboration need testable commitments

An agency or production brief should do more than say “please label AI”. Ask which components were modified, which systems were used, which file formats will be delivered, and what export limitations are known. Agree what information accompanies the assets and who answers follow-up questions. A broad guarantee without a traceable process provides limited help when the campaign reaches its final production stages.

Also specify what happens after delivery. If your internal team creates fresh edits or a media partner produces additional versions, an originally suitable disclosure may no longer work. Changes to the image, message, or publication context should trigger reassessment. The original approval concerns a particular version and use, not unlimited permission for every later adaptation or an assumption that every downstream platform preserves the same information.

For sensitive campaigns, run a small pre-publication test using real output formats. Have design, editorial, technical, and legal colleagues inspect the same near-final version. This exposes conflicting assumptions early: technical staff may expect credentials to survive while the platform removes them; editorial staff may rely on a notice that disappears in a mobile crop. Testing does not replace legal assessment, but makes the object of that assessment much more concrete.

FAQs

Does every AI-generated advertisement need a visible label?

No. Article 50 does not impose a universal visible-label obligation on all AI content. For text, relevant questions include whether publication aims to inform the public on matters of public interest and whether the editorial exception applies. Other legal obligations and voluntary transparency choices remain separate considerations. Do not infer a general exemption from the absence of this particular duty.

Is human proofreading enough for every exception?

No. The text provision connects human review or editorial control with editorial responsibility for publication. Its actual substance and implementation matter. This is also not a general deepfake exception, and it does not remove the separate provider obligation concerning technical marking. The appropriate review should reflect the content, intended audience, and publication context.

Is satire exempt from disclosure?

No. For evidently artistic, creative, satirical, or fictional works, the deepfake provision allows appropriate disclosure that does not hamper presentation or enjoyment. This concerns how disclosure is delivered rather than a blanket release from the obligation. Assess the format, audience, and first point of exposure instead of simply assigning a genre label.

Does C2PA automatically satisfy the AI Act?

No. C2PA can support technical provenance and integrity checking. Whether a particular implementation meets relevant duties depends on how it is designed and used. Signatures do not guarantee truth, usage rights, or complete legal compliance. Visible or audible disclosure may also be required, and the published version still needs to be checked.

Does missing provenance mean a human created the asset?

No. Credentials may be absent, removed, or undiscoverable in the tool being used. Recovery is not supported everywhere. Treat missing information as an absence of evidence, not proof of human origin or automatic proof of manipulation. Keep that distinction in internal records and in any explanation given to audiences or commercial partners.

Can platform labels replace internal checks?

No. Platform features can support implementation, but are not automatically sufficient for every content type, channel, and legal category. Check what the audience actually sees or hears and whether technical markings survive. Agreements with service providers do not eliminate the need to assess your own role, the particular publication, and any changes introduced downstream.

What Now?

Treat AI transparency as a property of your production chain. Separate provider marking from deployer disclosure, classify the actual content, and inspect the final published version. Start with one frequently used workflow, document its handovers, and improve it through observed failures rather than abstract assurances. The practical objective is reliable ownership and evidence at the points where decisions are made.

If you want to organise your content production around that approach, begin with responsibility, tool selection, and approval. You can get in touch to structure the workflow together. The goal is traceable production with appropriate disclosures, not a sweeping compliance promise or a claim that any single technology resolves every legal question.

Sources and interpretation

• EU Regulation 2024/1689, particularly Articles 3, 50, and 113: the authoritative legislative text for roles, transparency duties, and application dates.
• European Commission: questions and answers on Article 50: explanations supporting practical interpretation of the obligations.
• European Commission: guidelines on transparency obligations: interpretative guidance, not an independent amendment to the regulation.
• C2PA Explainer, version 2.2: technical foundations, trust model, and limitations of Content Credentials.