Brussels, 22 July 2026
What are the main provisions of the EU AI Act to consider?
The AI Act came into force on 1st August 2024. The transparency obligations in Article 50, which are the most relevant for CEPIC members, become applicable on 2 August 2026.
The EU Regulation requires certain categories of actors that synthetic content be “marked in a machine-readable format and detectable as artificially generated or manipulated” (Art. 50 (2)) and that “image, audio or video content constituting a deep fake” be disclosed as having been “artificially generated or manipulated.” (Art. 50 (4)). Failing which, a fine of up to 15 million euros or 3 per cent of total worldwide turnover may be imposed (Article 99 (4) (g)).
The EU AI Act is accompanied by two implementation documents that provide support on how to comply with the law in practice.
To whom and from when does the law apply?
The European law applies to any company operating within the territory or selling its services and products within the European Union, regardless of where its head office or operational entity is located. The law applies from 2nd August. However, Providers of AI systems that were already placed on the market before 2 August 2026 have until 2 December 2026 to comply with machine-readable marking (Article 50(2)).
The law differentiates between two types of actors:
The “Providers” of “AI systems” and the “Deployers” of “AI systems”.
Of course, a CEPIC member may act as both Provider and Deployer where it develops, or has developed, a relevant AI system and places it on the market or puts it into service under its own name or trademark, while also using that system under its authority. In that case, the obligations attached to each role must be assessed separately.
Art. 50 creates the specific transparency obligation for the deployment of “deep fakes”. This provision is one of the key reasons the AI Act distinguishes between providers (Article 50(2)) and deployers (Article 50(4)) of AI systems.
What is a deepfake following the AI Act?
Deepfakes are defined in Art. 3 of the AI Act.
Art. 3 of the AI Act defines a “deepfake” as “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful."
From this definition, the image, audio or video content must be disclosed as artificially generated or manipulated when three cumulative conditions are met
(i) the content must be AI-generated or AI-manipulated;
(ii) it must consist of image, audio or video content resembling existing persons, objects, places, entities or events; and
(iii) it must falsely appear authentic or truthful to the persons exposed to it, taking into account the context of dissemination and the likely audience.
The Guidelines further explain that assessments should always consider the context in which content is presented and the reasonable expectations of the intended audience. Not every AI-generated image constitutes a deepfake. For instance, images that do not resemble real people, places, objects or events, or that are clearly fictional, generally fall outside the definition. The Commission Guidelines also clarify that deepfake content created before 2 August 2026 does not need to be labelled retrospectively.
The Code of Practice clarifies how the Article 50(4) obligation should be implemented in practice. The deployer must ensure that users are informed that the specific image, audio, or video has been artificially generated or manipulated when it constitutes a deepfake. The objective is that recipients can recognise the artificial nature of the content.
Are there any exceptions to the rules set above?
Yes. Notably, Article 50 (4) provides that
“This obligation shall not apply where (...) the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.”
The Commission Guidelines clarify that this exception is intended to preserve artistic freedom while ensuring an appropriate level of transparency. In such cases, disclosure may be made through accompanying information without interfering with the display or enjoyment of the work.
Is it necessary for compliance to sign the Code of Practice?
The short answer is no.
The Guidelines published on 20 July say: “Compliance with the Code of Practice creates a presumption that the corresponding commitments have been implemented, but it does not replace compliance with the AI Act itself.”
In other words, signing the Code of Practice before 27 July solely demonstrates commitment to follow the Commission's voluntary compliance framework. The list of initial signatories by the 27th of July will be public. Signing remains possible after that date.
In any case, the Code of Practice is a useful practical roadmap for implementing compliant tools, such as C2PA or digital watermarking.
Which technology is the most likely to demonstrate compliance with the requirements of the AI Act?
Any technology that enables machine-readable marking that is effective, interoperable, robust and reliable may be used.
The AI Act is technology neutral. The Commission Guidelines expressly confirm that the Regulation does not prescribe any specific technical solution or standard. Providers remain free to choose the most appropriate implementation provided it fulfils the requirements set above. Any technology that enables compliance may be used.
Nevertheless, CEPIC recommends that its members continue to use IPTC metadata fields to identify content that has been generated or manipulated by AI. IPTC metadata is an established and widely used industry standard that supports machine-readable transparency, thereby contributing to compliance with the transparency requirements set out in Article 50 of the AI Act.
CEPIC also encourages its members' customers to preserve and read IPTC metadata rather than strip or discard it during processing. Where appropriate, members may also wish to consider complementary technologies, such as C2PA Content Credentials and digital watermarking to enhance interoperability and content provenance.
Where do I get further guidance? How can I get support to make sure that my company is compliant?
Several CEPIC members propose their services either to interpret the law or to implement technical solutions that are consistent with the Code of Practice. You may find them on the Directory available on the website or by contacting CEPIC. Please make sure you follow our webinars and conferences in order to stay informed.