The EU AI Act's New Labelling Rules, and What They Mean for Your Copy

Article 50 of the EU AI Act has been in force since 2 August 2026, and it changes something concrete about a category of content most corporate teams publish regularly: anything AI-assisted that informs the public on a matter of public interest. That includes more marketing and reporting copy than most teams have registered.

What the rule actually says

Article 50 sets out transparency duties across four areas: systems that interact directly with people (chatbots), AI-generated content more broadly, emotion recognition and biometric categorisation, and — the part with the sharpest teeth for a comms team — deepfakes and AI-generated text published to inform the public on matters of public interest. Deployers publishing that kind of text have to disclose that it is artificially generated or manipulated, unless it has been through a process of human review and editorial responsibility (the Act's own Article 50 text sets this out in full, and the European Commission's FAQ is the clearest plain-language walk-through). Deepfakes — AI-generated or manipulated image, audio or video content that resembles something real — need clear and distinguishable disclosure, provided no later than first exposure, in each case; evidently artistic, satirical or fictional work gets a lighter version of the same duty. The obligations apply to systems already in service, not just new ones, though content generated and published before 2 August 2026 doesn't need retrospective labelling (Stibbe's scope-and-timeline note covers this clearly). The penalties for non-compliance run up to €15 million or 3% of worldwide annual turnover, whichever is higher.

The carve-out is the part worth reading twice

The exemption for content that has been through "human review or editorial control" is doing a lot of work in this rule, and it's the part that should actually change how a team scopes a brief. It means a sustainability report, an investor communication or a public-facing statement drafted with AI assistance but genuinely reviewed and taken editorial responsibility for by a named person is outside the disclosure duty for that reason — not because the tool wasn't used, but because a person stood behind the result. A report produced with heavy AI involvement and rubber-stamped without real review sits in a much greyer position, and that's precisely the gap this rule was written to close.

Practically, that turns "did a human review this properly" from a quality question into a compliance one. The review step that's always mattered for accuracy now also matters for whether a disclosure label is legally required.

A standard is forming underneath the law

Separately from the legal deadline, the European Commission published a draft Code of Practice on marking and labelling AI-generated content on 17 December 2025, expected to be finalised around May–June 2026 as a voluntary standard providers can sign up to ahead of enforcement. It sets out a multi-layered approach — machine-readable provenance data embedded using standards like C2PA, alongside visible labelling — because no single marking technique holds up on its own once content is compressed, cropped or re-edited (Cooley's summary of the draft Code is a good starting point if a client asks what "compliant" is likely to mean in practice). Worth knowing about even for teams outside the EU's direct reach, because it's the technical standard the market is converging on, and clients publishing into EU markets will start asking suppliers about it regardless of where the supplier itself is based.

How this differs from industry self-regulation

It's worth being precise about what's law and what's still a professional norm. The UK's IPA and ISBA have their own principles on AI disclosure between agencies and clients, and increasingly written into standard creative services frameworks — but those are contractual and reputational, not backed by a statutory fine. Article 50 is the first time a comparable disclosure duty has direct legal force, and the two shouldn't be confused when advising a client on what they're actually required to do versus what good practice suggests they should do anyway.

The chatbot duty is separate, and easy to miss

Article 50 also covers systems that interact directly with a person — a customer service chatbot on a corporate website, for instance. Where it isn't obvious from the circumstances that a person is talking to a machine rather than a human, the deployer has to say so. This is a distinct duty from the public-interest-content rule above, with no equivalent human-review carve-out: if a client runs a chatbot on their site and it isn't already clearly flagged as automated, that's a gap worth raising even though it isn't, strictly, a content-writing question. It's frequently missed precisely because a comms or content team assumes it's someone else's problem, and a legal or product team assumes the same in reverse.

What to actually do about it

• Audit what's already been through AI tools. Not to panic about it — most marketing copy has always had some tool assistance somewhere, and that's not what this rule targets — but to know where the exposure actually sits, specifically content published to inform the public that hasn't had real editorial review.
• Fix the review step, not just the disclosure line. A named reviewer taking genuine editorial responsibility is the thing that keeps content out of the disclosure duty in the first place, so it's worth more than a label would be.
• Keep a record of that review. If a regulator or a client ever asks whether a piece of public-interest content needed a disclosure label, "yes, and here's who reviewed it and when" is a much better answer than reconstructing it after the fact.
• Treat deepfake disclosure as non-negotiable. That duty has no substantive-review exemption in the way the text rule does — if a visual or audio asset has been AI-generated or manipulated to resemble something real, it needs clear disclosure regardless of how carefully it was reviewed.