Key Contacts: Hugo Grattirola – Partner |
Introduction
The European Union (“EU”) acknowledges that AI-generated or AI-manipulated media in the form of text, images, audio, and video is affecting the digital information landscape by reducing the capacity of ordinary users to distinguish it from human-created material. In order to remediate this problem, the EU has developed a Code of Practice on the Transparency of AI-Generated Content (the “Code“), to be read in tandem with the legal obligations set out under the EU AI Act. For companies that provide or deploy generative AI systems, the Code represents significant guidance on how to disseminate AI products responsibly.
Background and Legal Context
The Code’s was developed by 6 independent experts, drawing on input from 180 stakeholders. The Code operates alongside but does not replace the transparency obligations contained in Article 50 of the AI Act, which governs the marking and labelling of AI-generated content. Deepfakes and AI-generated or AI-manipulated text published on matters of public interest must be clearly labelled.
Transparency obligations under the AI Act are applicable from 2 August 2026, save for machine-readable marking requirements which will apply from a later deadline of 2 December 2026.
The Code is currently undergoing an adequacy assessment by the European Commission and the AI Board.
Structure of the Code
The Code includes two separate sections, one for providers of AI systems within the meaning of the AI Act, and the other one for deployers.
For providers, the Code sets out the rules for marking and detection of AI-generated and manipulated content, which will require them to:
- mark all AI-generated or manipulated audio, image, video, and text outputs in a machine-readable format so they are detectable as artificially generated or manipulated (e.g. an imperceptible watermark embedded within the content);
- record AI-generated information in digitally signed and time-stamped metadata in a secure and tamper-evident manner;
- neither place on the market nor promote tools whose purpose is to circumvent these markings;
- provide a detection solution enabling relevant persons inter alia deployers and end users, to verify whether content has been generated or manipulated by their AI system (e.g. a web API, downloadable software, or published specification);
- make the detection solution available free of charge (with limited exceptions for high-volume commercial users), and always provide free access to competent authorities;
- document, implement, and keep up to date a compliance process describing how the Code’s measures have been implemented; and
- provide proportionate training to personnel involved in ensuring compliance.
For deployers of AI systems, the Code sets out the rules for labelling of deepfakes and AI-generated and manipulated text, which will require them to:
- disclose that image, audio, or video content constituting a deep fake has been artificially generated or manipulated;
- use an EU icon label (discussed more below) that is clear, recognisable, and proportionate in size;
- ensure compliance with the European Accessibility Act and Web Accessibility Directive, including inter alia audio descriptions (where applicable);
- maintain appropriate internal compliance processes specifying how disclosure obligations are implemented; and
- review substantiated reports of mislabelled or incorrectly labelled content and remedy non-compliance without undue delay.
The lists above are non-exhaustive, and providers and deployers should review the Code to be aware of the full extent of their requirements.
The EU Icons
To support consistent labelling, the EU has introduced a set of standardised icons that deployers of generative AI systems may use to label AI-generated or AI-manipulated content as follows:
| Icon | When to use | Use case examples |
Basic icon  | When AI is involved in the creation of deep fake content (image, audio, video) or published text or when a custom text label or interactive second layer is implemented | Deep fake video with the text label “voices generated with” followed by the basic icon |
Fully AI-Generated 
| When the entire deep fake content (image, audio, video) or text is fully generated by AI with no human-created elements or human editorial control (apart from prompting) | Fully AI-generated deep fake videos with politicians or fictional events Fully AI-composed music or art |
Partially AI-Modified | When pre-existing, human-made content is partially modified with AI turning it into a deep fake or text on matters of public interest | A face in an authentic photograph is swapped with a face of a politician using AI Authentic photographs of an empty apartment is furnished using AI |
By signing up to the Code and using the above icons, organisations commit to make the icon clearly perceivable and distinguishable at the latest at the time of first exposure of a natural person to the AI content.
Limitations and Exceptions
Article 50 of the AI Act and the Code recognise the following categories of exception that corporate compliance teams should be aware of:
1. Artistic, Creative, Satirical, and Fictional Works
Where deepfake content forms part of an evidently artistic, creative, satirical, fictional, or analogous work or programme, the transparency obligations are limited to disclosure in an appropriate manner that does not hamper the display or enjoyment of the work.
2. Law Enforcement Authorisation
The disclosure obligation does not apply where the use of deepfakes or published text on matters of public interest is authorised by law for the purposes of detecting, preventing, investigating, or prosecuting criminal offences.
3. Human Review or Editorial Control for Text
The disclosure obligation does not apply to AI-generated text that has undergone a process of human review or editorial control, where a natural or legal person holds editorial responsibility for the publication of the content.
What’s Next?
The European Commission is now inviting all providers and deployers to sign up to the Code by 22 July 2026. Companies should be aware that adherence to the Code is voluntary, but compliance with Article 50 of the AI Act is not. The Code provides a framework through which signatories can demonstrate compliance with Article 50’s marking and labelling requirements. It will be complemented by Commission guidelines on the scope of the transparency obligations under Article 50.
Following a positive adequacy assessment, providers and deployers who sign the Code will be able to rely on its measures as evidence of compliance (subject to the Code’s own important qualification that adherence to it “does not constitute conclusive evidence of compliance” with the obligations under Article 50) — reducing their administrative burden. Signatories to the Code will also participate in dedicated ‘signatory taskforces’, which will share implementation practices and advance consistent application of the marking and labelling requirements.
Providers and deployers who choose not to sign the Code are not exempt from Article 50 of the AI Act. They will instead be required to demonstrate compliance by alternative means, assessed individually by the relevant national authorities on a case-by-case basis.
Penalties for Non-Compliance
Companies should be mindful that the penalty regime under the AI Act for non-compliance with the Article 50 transparency obligations can attract administrative fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Whilst adherence the Code is not mandatory, it provides a convenient way to aid a company’s compliance with the AI Act and, with adherence to the guidance, be less exposed to such fines.
This article was written with the assistance of associate Laura Higgins Mulacahy.
