Under the EU AI Act, an ad shown in the EU that counts as a deep fake (often written deepfake), such as a realistic AI person or a product image that misleads about the real product, needs a visible or audible AI label, and that label is the deployer's duty. The deployer is the business that decides whether and how an AI system is used to make the ad. Where a studio or agency takes those decisions in production, that is the studio or agency. The brand becomes a deployer too when it takes those decisions itself, for example by choosing a synthetic presenter. The duty has applied since 2 August 2026.
The tool vendor's duty is separate. As provider, it marks the output for machines, and tools already on sale before 2 August 2026 have until 2 December 2026 to do so.
Since when does an AI ad need a label in the EU?
Since 2 August 2026. Article 113 of the AI Act, Regulation (EU) 2024/1689, reads: "It shall apply from 2 August 2026." The Commission's Article 50 FAQ, last updated on 24 July 2026, confirms that Article 50 applies from that date.
One date moved, for one duty. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force three days later. Its new Article 111(4) gives providers of AI systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2), the machine-readable marking duty that sits with the tool makers.
The label did not move. The FAQ says the grace period applies "only as regards the marking and detection obligation", so an ad that counts as a deep fake needs its visible label now. Content generated before 2 August 2026 "does not need to be labelled retroactively", which makes the generation date of each file worth recording.
Provider or deployer: which role does each party in an ad job hold?
Article 3(3) of the AI Act makes the provider the party that "develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market". In an ad job, that is the company behind the video or image model.
Article 3(4) makes the deployer the party "using an AI system under its authority". The Commission's Article 50 guidelines of 20 July 2026 read authority as "assuming responsibility over the decision to deploy the system and over the manner of the actual use of the system (including its outputs)". Decisions count. Who holds the login does not.
The FAQ names "an advertising company" as its example of a deployer that is a legal person, so the people working there are not separate deployers. A deployer "remains a deployer even if third parties (e.g. contractors, freelancers) are involved in the operation of the system on its behalf and under its responsibility and control". Paragraph 15 of the guidelines adds that one company "may fulfil more than one role concurrently", for example a brand that builds its own generation system and runs its ads through it.
| Role | Typical party in an ad job | Duty | From when |
|---|---|---|---|
| Provider (Article 3(3)) | The company that makes and sells the video or image model | Mark outputs in a machine-readable format so they are detectable as AI-made (Article 50(2)) | 2 August 2026; 2 December 2026 for systems placed on the market before 2 August 2026 |
| Deployer (Article 3(4)) | The studio or agency that decides whether and how AI is used in the ad | Disclose a deep fake with a visible or audible label, at the latest at first exposure (Article 50(4) and 50(5)) | 2 August 2026, no delay |
| Deployer as well | The brand, when it decides whether and how AI is used, for example by choosing the AI presenter (our reading of guidelines paragraphs 12 and 14) | The same disclosure duty; agree in writing which deployer applies the label | 2 August 2026, no delay |
| Provider and deployer | A brand or studio that builds its own generation system and uses it for ads | Both: the machine-readable mark and the visible label | The label from 2 August 2026; the mark on the provider dates above |
| Not a deployer | A brand that only commissions the ad and leaves the AI decisions to its supplier | No Article 50(4) duty of its own; the rules on misleading ads still apply | Not applicable |
| Not a deployer | Meta, TikTok or YouTube when they only carry the ad | None as deployer; a platform's own label tool can meet the deployer's duty inside that platform only if it gives a clear and distinguishable AI label | Not applicable |
A brand that only commissions the ad is not the deployer
Paragraph 14 of the guidelines answers the brand question directly. A company that "merely commissions an advertising agency to produce an advertisement, without taking decisions and exercising control over whether and how the advertising agency uses AI ... is not a deployer".
That exemption is narrow. On our reading of paragraph 14, a brand that decides the ad will use AI scenes or chooses the synthetic presenter is taking the decisions the paragraph describes, and becomes a deployer next to its supplier. If that is how your team works with its studio, plan as a deployer.
Being based outside the EU does not take a brand out of scope when it directs its ads at EU audiences. The same paragraph covers "a company established in a third country that uses an AI system to generate a deep fake of a celebrity featured in an advertisement displayed in the Union". Paragraph 13 limits this to content the company itself directs or authorises into the EU.
The label must also reach the viewer intact. Paragraph 12 says deployers in complex production and distribution chains "should take proportionate measures" so their label is displayed clearly at first exposure, "e.g., via contractual conditions with distributing partners, user experience (UX) settings and interfaces to be displayed". Between a brand and its supplier, write the split into the agreement.
Platforms sit outside the role. Paragraph 16 excludes services "whose role is limited to disseminating or transmitting AI-generated or manipulated content created by third parties", which describes Meta and TikTok when they only run your ad. Paragraph 126 adds a narrow route. Where a very large online platform or search engine gives deployers a tool that lets them label deep fakes "in compliance with Article 50(4) AI Act (i.e. a clear and distinguishable disclosure of the AI-origin)", those deployers "can rely on such tools ... within the context of the VLOP or VLOSE used". The paragraph frames this for AI built into the platform, and the deployer stays responsible for the label. Before relying on a platform setting, check that its label shows on the ad itself when people first see it.
Run one ad through the tree below to see who applies its label.
