AI labelling obligation

The obligation has two strands. Providers design their systems so that users recognise a chatbot as an AI, and they mark the outputs of generative systems in a machine-readable format. Deployers disclose deepfakes and AI-generated texts on matters of public interest to their audience. A transitional period until 2 December 2026 exists only for machine-readable marking in systems that were already on the market before 2 August 2026. The legal framework is described in the entry on the EU AI Act.

Who the labelling obligation applies to

The AI Act distinguishes two roles, and what a company has to do depends on this distinction. Providers develop an AI system or have one developed and place it on the market or put it into service under their own name. Deployers use an AI system under their own authority. For image, text and voice tools, the typical SME is a deployer: it uses an image model, a text assistant or speech synthesis that someone else has built.

This brings both relief and an obligation. The technically demanding side, i.e. the machine-readable watermark in every generated file, is the provider’s responsibility. The organisationally inconvenient side, i.e. the visible notice on deepfakes and certain AI-generated texts, is the deployer’s responsibility. If you use a deceptively realistic AI image from a commercial service in a campaign, you cannot rely on the provider’s marking to fulfil your own disclosure obligation: the invisible watermark is meant for machines, the notice is meant for people.

With chatbots, the role tips faster than many people think. If you build a bot based on a language model yourself, or have an agency build it, and use it on your website under your own name, you are its provider according to the Commission’s guidelines, even if you only use it in your own customer contact. The AI notice in the chat is then your obligation and not that of the model manufacturer. If, on the other hand, a company integrates a ready-made service unchanged that someone else offers under their own name, this obligation lies with the provider of the service. For standard bots that are configured or rolled out under your own brand, the guidelines give no explicit answer. If in doubt, add the notice yourself. It costs one sentence.

The five cases at a glance

The deadlines, and the most common misconception about them

The general transparency obligations of Article 50 have applied since 2 August 2026. The Digital Omnibus on AI, in force since 27 July 2026, expressly did not postpone them. Only one part of the obligation was postponed: for machine-readable marking under Article 50(2), a grace period applies until 2 December 2026, and only for systems placed on the market before 2 August 2026.

Many articles turn this into a blanket “Article 50 has been postponed to December 2026”. This is the most widespread error on the topic and an expensive one in practice, because a company relying on it believes it still has time. There is no grace period for any of the other obligations under Article 50. The provider’s chatbot notice and the disclosure of deepfakes and texts by deployers have been due since August 2026.

Two clarifications from the Commission’s guidelines help with planning. A system that both chats and generates content benefits from the grace period only for the marking; its provider has owed the notice in the conversation since 2 August 2026. And nobody has to label retroactively: deepfakes generated before 2 August 2026 do not need a subsequent notice, nor do AI-generated texts that were generated and published before that date. If, however, you only publish an older AI-generated text now, you must label it, insofar as it falls under the text obligation.

What comes next

On 2 December 2026, it is not only the grace period that ends. On the same date, a new prohibition under Article 5 takes effect: AI systems that generate non-consensual intimate material of identifiable persons or child sexual abuse material are then prohibited if that is their purpose or if they can foreseeably generate such content without effective safeguards. For a medium-sized company, this is not a day-to-day compliance issue, but it is a selection criterion for service providers and tools. How these dates fit into the overall AI Act roadmap is shown in the article EU AI Act for SMEs.

What a label that holds up has to look like

The Regulation does not prescribe a format. It requires the information to be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure to the content, and to conform to the applicable accessibility requirements. In June 2026, the European Commission published the Code of Practice on Transparency of AI-generated Content, followed on 20 July 2026 by the guidelines on the transparency obligations. The code is voluntary, but the Commission and the AI Board have confirmed it as an adequate way to demonstrate compliance. If you do not sign it, you have to show yourself that your own measures are equivalent.

Four reliable rules can be derived from the guidelines. First: the notice belongs on the content, not in secondary documents. Second: it must be perceptible without any interaction, i.e. not only after clicking “show more”. Third: it must refer to the content, not to the service used to generate it. Fourth: mixed forms are also covered; content does not have to be entirely AI-generated for the obligation to apply.

Wordings that work

• Image: “AI-generated” in the caption, for collages “AI-generated elements”.
• Video: an overlay in the first few seconds plus a notice in the description, not only there.
• Synthetic voice: a spoken or displayed notice at the beginning; for telephony, the notice before the first dialogue step.
• Chatbot: a sentence in the greeting that names the machine, for example “You’re chatting with an AI assistant”, and a permanently visible notice in the window.
• Text: a note at the beginning or end if the text falls under the disclosure obligation and has not been editorially reviewed.

According to the guidelines, the following are not sufficient: a notice only in the terms and conditions or the documentation, a watermark that people cannot perceive as the only notice, the vague label “assistant” and blanket statements such as “Services on this website use AI”.

In addition, the Commission provides an official icon set: three symbols for “Basic”, “Fully AI-Generated” and “Partially AI-Modified”, each in several variants, free of charge and without an attribution requirement. Using them is voluntary, but it saves you the discussion about whether your own label was recognisable enough.

Who enforces the obligation in Germany

Since 29 July 2026, Germany’s Act on Market Surveillance and the Promotion of Innovation in Artificial Intelligence, KI-MIG for short, has applied. The central market surveillance authority and single point of contact is the Bundesnetzagentur (Federal Network Agency), flanked by sectoral responsibilities, such as BaFin for the financial sector and the state media authorities for the media sector. The authority also runs an AI Service Desk with an online tool for an initial assessment of the risk class and has an explicit mandate to advise companies on implementation. Its overview of the transparency obligations (in German) organises Article 50 into provider and deployer obligations.

An AI regulatory sandbox in regular operation, into which a company could submit its system, does not exist yet, however. So far there is a completed pilot project simulating a sandbox, which the Bundesnetzagentur concluded together with other bodies in March 2026. This is not an omission: the Digital Omnibus only obliges Member States to have at least one operational national sandbox in place by 2 August 2027.

The fines for infringements of the transparency obligations go up to €15 million or 3 per cent of worldwide annual turnover; for small and medium-sized enterprises, the lower of the two amounts applies in each case, and since the Digital Omnibus also for small mid-cap enterprises.

An approach you can implement in three weeks

1. Inventory. Record where in the company AI content is created: marketing, social media, customer service, sales documents, website, agency services. The list is often longer than expected, because teams use tools that nobody procured centrally.
2. Rule. Write a short, binding house rule: which content gets labelled, with which wording, in which place. For your own chatbots, the AI notice belongs in the greeting.
3. Process. Tie the rule to the approval process for publications so that it does not depend on individuals.
4. Evidence. Record who adopted the rule and when, and how people were trained. This links the labelling to the AI literacy obligation under Article 4, which has applied since February 2025 anyway.

Why the obligation is less work than it sounds

For deployers, the technical part of the labelling obligation is small. A sentence, an overlay, a caption: that is a few minutes of work per piece of content. The obligation becomes expensive elsewhere, namely with the question of who in the company actually knows where AI is involved. The problem usually lies less in the law than in the transparency of your own production chain: a social media team uses an image model, sales has cover letters drafted, the agency supplies visuals, and nobody has a list.

That is why it pays to treat the obligation not as a legal task, but as an inventory task. Once you have taken stock, you can tie the labelling into existing approvals, and at the same time you are a step further with the risk classification under the AI Act and with the training obligation under Article 4. All three topics need the same foundation, and the inventory is that foundation.

Typical borderline cases in SMEs

AI-generated product image. Caution is advised here. According to the Commission’s guidelines, a product image can also be a deepfake, because the definition covers objects as well as persons, and it is enough that what is shown could exist in this form. As an example, the Commission cites an AI image in advertising or on the packaging that can mislead about the appearance, properties or quality of the product. The company publishing the image must then make the disclosure as the deployer. A real product in front of an AI-generated background, on the other hand, is not a deepfake, as long as the depiction does not mislead about the product itself; according to the guidelines, colour corrections, aesthetic background changes and arrangements of existing products are generally not relevant. Under unfair competition law, the question of whether the image misleads about the properties of the product remains separate: a rendered piece of furniture that looks different in reality can be a misleading statement even with an AI notice.

Machine-translated website texts. According to the guidelines, AI translations count as standard editing, to which the machine-readable marking does not apply. The disclosure obligation for AI-generated text only covers texts that inform the public on matters of public interest, and it does not apply if a human has reviewed the translation and holds editorial responsibility for it. Product descriptions and service pages are typically not covered, as long as they make no claims about, for example, health, consumer safety or sustainability.

Synthetic voice in the phone system. Two obligations need to be separated here. If the system holds a conversation, it is a voicebot, and the notice of the AI interaction must come before the first dialogue step. This obligation applies to the provider, which includes the company that has the voicebot built under its own name. A notice in the hold music does not count. A pure announcement is not a conversation. According to the broad interpretation in the guidelines, it can still be a deepfake if the voice imitates a real person or sounds so realistic that callers take it for a recording of a human. A short notice at the beginning of the announcement settles this.

AI summaries in customer service. An AI that summarises the history of a case for an employee does not create published content and does not trigger a labelling obligation. Even if the summary goes to an individual customer, it is not a publication to inform the public; the text obligation then does not apply. It is different when an AI agent sends the reply on its own: the guidelines treat this as an interaction with an AI system, and the message needs an AI notice. This is exactly the boundary that should be written into the house rule.

Agency services. What matters is who decides on the use of AI. If the company specifies whether and how the agency uses AI, it remains the deployer, even if the agency operates the tools. If it merely orders a visual and leaves it to the agency whether and how it uses AI for it, it is not a deployer according to the guidelines. The obligation then lies with the agency, which must ensure, for example through contractual clauses, that the label reaches the audience. In practice, both sides benefit from a clause that obliges the agency to report AI components and to label content that requires labelling, plus a spot check at acceptance.

How it differs from other transparency requirements

The AI labelling obligation is not the labelling of advertising and not the legal notice (imprint) obligation. Nor does it replace any information required under data protection law: if a chatbot processes personal data, the information obligation under the General Data Protection Regulation continues to apply alongside it. Conversely, a privacy notice is not sufficient as an AI label, because it does not appear at the first exposure to the content and does not state that the content was artificially generated. If you try to cover both in one sentence, you end up fulfilling neither obligation properly.

Labelling must also be kept separate from the question of whether something is permitted. A labelled deepfake of a real person is not allowed simply because it is labelled: personality rights and the right to one’s own image additionally require the consent of the person depicted. The label answers the question of whether the audience is being deceived, not the question of whether the depiction was permissible.