Article 50 of the EU AI Act has applied since 2 August 2026. If you deploy AI to create a deepfake, you must disclose that the content was artificially generated or manipulated. But personal, non-professional use sits outside the Act entirely — and where content forms part of an evidently fictional or creative work, the obligation is reduced to disclosing that generated content exists, in a way that doesn't hamper enjoyment of the work.
Two things in Article 50 matter to a creator and neither gets much coverage. The scope test isn't about geography. And fiction is treated differently from a passing-off deepfake, which is exactly the distinction narrative work needs.
What is Article 50?
The transparency layer of the EU AI Act, and it's unusual in being risk-independent.
Most of the AI Act sorts systems into risk tiers and imposes obligations accordingly. Article 50 doesn't. It applies to any AI system used in the situations it covers, whatever tier that system sits in — which makes it the broadest-reaching obligation in the Regulation.
It has four routes. Two fall on providers, two on deployers. Creators are deployers, which means two of the four are yours.
The formal citation is Article 50 of Regulation (EU) 2024/1689. It entered into application on 2 August 2026, twenty-four months after the Act entered into force, and it's enforced by national market surveillance authorities in each member state.
Does it apply to you?
The test isn't where you are. It's whether what you're doing is professional.
The Act defines deployers as natural or legal persons, public authorities, agencies or other bodies using AI systems under their authority — excluding use for personal, non-professional activities.
The Commission's own FAQ works the example through. A person generating deepfakes in their personal capacity and posting them on social media is engaged in a personal activity, and that use is excluded from the Act's scope entirely. But where someone gains an economic benefit on a regular basis, or is otherwise involved in a business, trade, occupational or freelance activity, that's professional — and they're a deployer.
A hobbyist is out of scope. A monetised creator is in. That's the line, and it isn't drawn on a map.
Where this falls short. "Regular economic benefit" isn't quantified. Someone posting occasionally with modest ad revenue sits in genuinely ambiguous territory, and nobody has published a threshold. If you're running a channel as a business, assume you're a deployer.
What counts as a deepfake?
The definition is narrower than the everyday use of the word, and it has two parts.
Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.
Both parts have to be met. Content resembling something real but obviously not authentic isn't caught. The Commission's draft guidelines indicate that clearly fantastical or physically impossible content falls outside it.
Note also how broad the first part is. It isn't only people — objects, places, entities and events are all named. A generated shot of a real location, presented as authentic, engages the definition.
What does the deepfake obligation actually require?
Disclosure that the content has been artificially generated or manipulated, and it's for the audience rather than the file.
The Commission's FAQ is specific. Disclosure must reach a natural person on first exposure at the latest. It must be clear and distinguishable, understandable and perceivable without requiring any technical tools or dedicated actions. Visible labels for visual content, audible for audio.
And one thing that matters more than it sounds: deployers cannot rely on the provider's machine-readable marking to satisfy this. Provider-side marking under Article 50(2) is a separate obligation on a separate party. Your duty as deployer is independent of it.
The single exception on this limb is narrow — it doesn't apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.
Your generation tool's marking is the provider's compliance, not yours.
Which lands the same point as our disclosure guide, now with a regulator saying it. Most generation platforms add nothing visible at all — Hexcoded states plainly that it adds no AI label and no watermark, and that labelling where you publish is the publisher's obligation.
What if the work is obviously fiction?
The obligation is reduced, and this is the provision that matters most to narrative work.
The Article's own text: where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.
Three things follow from that wording.
It's a reduction, not an exemption. You still disclose. What changes is what you're disclosing and how much room it takes.
What you disclose is the existence of generated content — not a running identification of which elements are synthetic.
And the Regulation explicitly protects the work. "Does not hamper the display or enjoyment" is in the text. A disclosure that ruins the piece isn't what's being asked for, which is an unusually sensible thing to find in a regulation.
For a short drama series, that reads as an end-card or a description-level statement rather than an on-screen label across every episode.
What about the text obligation?
Separate limb, separate rules, and this is where the editorial exception actually lives.
Deployers publishing AI-generated or manipulated text for the purpose of informing the public on matters of public interest must disclose it. That obligation doesn't apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication.
Two reasons to know this. It's narrower than it's often read — it targets published informational text on matters of public interest, not internal drafting and not marketing copy. And the editorial-responsibility exception is frequently misattributed to the deepfake limb, where it doesn't apply.
For most video creators this limb is irrelevant. For anyone running an AI-assisted publication alongside the video, it isn't.
What are the dates?
Two that matter, and one has already passed.
| Date | What applies |
|---|---|
| 2 August 2026 | Article 50 transparency obligations entered into application |
| 20 July 2026 | Commission published interpretive guidelines on Article 50 |
| 2 December 2026 | End of the transitional window for machine-readable marking on generative systems already on the market |
Source: European Commission and Article 50 of Regulation (EU) 2024/1689, September 2026.
The December deadline is a provider obligation rather than a deployer one, so it's your tools' problem rather than yours. It's worth knowing because it may change what your tools embed — and, per the FAQ, that still won't discharge your own disclosure duty.
What should you actually do?
Five steps, and the first two settle most cases.
Decide whether you're a deployer
Personal, non-professional use is out of scope. Regular economic benefit, or a business, trade, occupational or freelance activity, puts you in. If you're running a channel as a business, assume you're in.
Decide whether your content meets the deepfake definition
Does it resemble existing persons, objects, places, entities or events — and would it falsely appear authentic? Both parts. Clearly fantastical content doesn't qualify.
If it's evidently fictional, use the reduced obligation
Disclose that generated content exists, in a manner that doesn't hamper the work. An end-card or a description-level statement rather than a persistent on-screen label.
Make the disclosure perceivable without tools
Visible for visual content, audible for audio, at first exposure at the latest. Metadata alone doesn't satisfy it.
Don't assume your platform's marking covers you
Provider-side machine-readable marking is a separate obligation on a separate party. The Commission says explicitly that deployers can't rely on it.
This describes Article 50 of Regulation (EU) 2024/1689 as it stood at the publication date. Enforcement is by national market surveillance authorities and practice varies between member states. Commission guidance continues to develop. Nothing here is legal advice — take advice before relying on any of it for a commercial delivery.
- Article 50 has applied since 2 August 2026 and is risk-independent. It reaches any system used in the situations it covers
- The scope test is professional versus personal, not geographic. Regular economic benefit puts you in
- A deepfake must both resemble something real and falsely appear authentic. Both parts, or it isn't one
- Disclosure is for the audience — visible or audible, at first exposure, perceivable without tools
- Evidently fictional work gets a reduced obligation: disclose that generated content exists, without hampering the work
- That's a reduction, not an exemption. You still disclose
- The editorial-responsibility exception is for the text limb, not deepfakes. It's widely misattributed
- Your platform's machine-readable marking doesn't discharge your duty. The Commission says so explicitly
The test in Article 50 is professional versus personal use rather than geography. Personal, non-professional activity is excluded from the Act's scope. Where someone gains economic benefit on a regular basis, or is in a business, trade, occupational or freelance activity, they're a deployer and the obligations apply.
Article 3(60) defines it as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic or truthful. Both parts must be met, so clearly fantastical content doesn't qualify.
Where content forms part of an evidently artistic, creative, satirical, fictional or analogous work, the obligation is limited to disclosing that generated content exists, in a manner that doesn't hamper the display or enjoyment of the work. It's a reduced obligation, not an exemption.
No. The Commission states explicitly that deployers cannot rely on the machine-readable marking embedded by the provider to fulfil their own disclosure obligation. Provider marking and deployer disclosure are separate duties on separate parties.
It applies to the text limb, not deepfakes. Where AI-generated text published to inform the public on matters of public interest has undergone human review or editorial control and a person holds editorial responsibility, the disclosure duty doesn't apply. It's frequently and wrongly attributed to the deepfake obligation.
Clearly and distinguishably, on first exposure at the latest, understandable and perceivable by a natural person without any technical tools or dedicated actions. Visible labels for visual content and audible disclosure where audio is the relevant mode.
The labelling is yours
Hexcoded adds no AI label and no watermark to output, and says so plainly — which under Article 50 is the honest position, since provider marking wouldn't discharge your duty anyway. What is documented is the consent behind every human creator.
Read the disclosure positionMore on workflow, compliance and delivery in Production.