As content generated or manipulated by artificial intelligence becomes more realistic, it is becoming increasingly difficult to distinguish authentic content from synthetic content. This development raises a key question: how can the public be enabled to identify the nature of the content to which they are exposed? It is precisely in this context that transparency obligations take on their full significance.
The European Commission’s guidelines on Article 50 of the AI Regulation, published on 20 July 2026, provide further details on the obligations applicable to deepfakes. They complement the Code of Practice on the Transparency of AI-Generated Content by clarifying the scope of these rules and their implementation. With regard to deepfakes, Article 50(4) requires ‘deployers’ of AI systems (persons who use AI in a professional capacity) to label them clearly and distinctly so that those exposed to them can recognise them.
A deepfake is defined by five criteria
A key challenge is determining what constitutes a deepfake. The European Commission’s guidelines set out five criteria that must be met.
- Content generated or manipulated by AI: this may be content created entirely by AI or existing content that has been modified using AI.
- Audio, video or image content: text manipulated by AI is therefore not covered by this definition.
- A depiction of a person, object, place, event or entity.
- An anchor in reality: The content exists, has existed or could exist in the real world.
- An appearance that may give the impression of being authentic: context is key here. In particular, one must take into account how closely the content resembles reality, the context in which it is disseminated and the message it conveys. The target audience must also be taken into account. Certain audiences, such as minors or the elderly, may be more prone to misjudging the authenticity of content. The same content may therefore be considered a deepfake for one audience but not necessarily for another.
Providers and operators: two distinct responsibilities
The AI Regulation distinguishes between the provider, who develops or commissions the development of an AI system for selling it on the market, and the deployer, who uses that system in the course of a non-private activity (unless it is for personal, non-professional purposes); for example, a public authority or a company that uses an AI system to generate deepfakes promoting their business.
Providers of generative AI systems must put in place mechanisms to identify content generated or manipulated by AI using machine-readable labels.
In the case of deepfakes, however, an additional responsibility falls on the deployer: it is their duty to inform those exposed to the content. The obligation of transparency therefore also extends to the way in which the AI is used and how the content is subsequently disseminated.
The guidelines refer to the Code of Good Practice, which sets out various options enabling operators to meet these obligations. Adherence to the Code remains voluntary. However, it is a recognised means of demonstrating compliance with Article 50(4). Stakeholders who choose not to follow the Code must be able to demonstrate their compliance by other means offering an equivalent level of protection. The Commission therefore invites deployers to draw on the Code of Good Practice when establishing their transparency practices.
What are the obligations for deployers?
When a deployer uses an AI system to generate or manipulate content, they must check whether it constitutes a deepfake before publishing it.
In particular, they may ask themselves the following questions:
- Is the content generated or manipulated by AI?
- Is it an image, audio or video?
- Does it depict a person, an object, a place, an event or an entity?
- Is the content anchored in reality?
- Could the content give the false impression of being authentic?
If the answer to all these questions is yes and the content is intended for publication, the deployer must then include a label indicating that it is a deepfake. It is also recommended that internal procedures be put in place to ensure that this verification and identification are carried out systematically when creating and publishing a deepfake.
Transparency is a shared responsibility
The European Commission’s guidelines emphasise that transparency is not just a matter for AI providers. The deployer, whether a media organisation, a business, a content creator or an individual, also has an important role to play. Everyone must be mindful of the content they produce and the way in which it is communicated to their audience.
As AI systems become more sophisticated, it is therefore essential to enable the public to understand the nature of the content to which they are exposed. This transparency helps to maintain a reliable and comprehensible information environment, which is essential to the proper functioning of a free and democratic society. Compliance with obligations regarding the identification of deepfakes is a shared responsibility, and everyone has a duty to scrutinise the content they publish.