The prevention of malicious deception by AI (especially generative AI) is one of the key aims of the EU’s Artificial Intelligence Act (Regulation (EU) 2024/1689, “AI Act”). To this end, the AI Act includes a number of different transparency obligations, most of which will enter into force on 2 August 2026. One obligation only has been deferred to 2 December 2026 (due to the recent political agreement on the Digital Omnibus on AI Regulation): the obligation on providers of generative AI systems to themselves label AI-generated content in machine-readable form.
Irrespective of these deadlines, companies should start considering now how they are going to legally comply with the transparency obligations. Some pointers are provided by the European Commission’s guidelines published on 8 May 20261 (currently still a consultation draft), which go into greater depth regarding the requirements of the AI Act. For advertisers and companies providing advertising services, these transparency obligations will be significant, as AI-generated product images, voice-overs and testimonials have been in the advertising industry’s toolbox for some time now.
In this article we look at the practical aspects of the AI transparency guidelines, focussing on the challenges they pose for online and audio advertising.
I. The transparency obligations and who they apply to
The AI Act contains five2 basic transparency obligations (Article 50(1) to (4)):
- AI interaction: Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system.
- AI content: Providers of AI systems generating audio, image, video or text content must ensure that this content is marked in a machine-readable format and detectable as artificially generated.
- Special systems: Deployers of emotion recognition or biometric categorisation systems must notify the natural persons concerned that the respective system is in operation.
- Deep fakes: Deployers of AI systems that generate deep fake images, audio or video must disclose the artificial nature of how they were generated.
- AI journalism: Deployers of AI systems that generate or manipulate text to inform the public on matters of public interest must likewise disclose the use of AI.
Obligations 1 and 2 target how the AI system itself functions, so they impact the providers of such a system, i.e. whoever develops it (or has it developed) and places it on the market or puts it into service under their own name (Article 3, point (3) AI Act).
The other obligations affect the deployers, i.e. whoever uses an AI system under their own responsibility. Personal, non-professional use for private purposes is exempted (Article 3, point (4) AI Act), but the guidelines interpret this use very narrowly.
Providers based outside the EU are subject to these obligations if they place their AI systems on the EU market. Both providers and deployers based outside the EU also have to meet the obligations of the AI Act if the output (e.g. an AI-generated advert) is used in the EU (Article 2, point (1), letters (a), (c) AI Act). This rule has particular relevance in advertising, as advertising content is intended to be used as widely as possible, and AI is used to help spread that content, for example through AI translation. On this point, the guidelines give the example of a non-European advertising company that used AI to generate an avatar of a celebrity for adverts in the EU as well.
The AI transparency guidelines go into the details of these five transparency obligations, including their exemptions and implementation.
II. The individual obligations and how they impact advertising
In advertising especially, the individual transparency obligations may apply simultaneously. Their common goal is to minimise the risks of identity fraud, disinformation, manipulation and scamming, protect the integrity of the information ecosystem, and enable natural persons to take informed decisions when faced with AI systems or AI output.
1. AI interaction, Article 50(1) AI Act
As we have seen, providers of AI systems intended to interact directly with natural persons are required to design them such that users are informed of their artificial nature at the latest at the time of the first interaction. This applies especially to AI-enabled voice assistants, chatbots or avatars, including those embedded in physical objects (such as care robots or robotic companion pets).
According to the guidelines, interaction entails the possibility of a bidirectional exchange of information or actions between natural persons and the AI system in question. Interaction does not apply to systems that only passively collect data. So the term would not apply to an AI-assisted software tool that uses data regarding a natural person (such as the last website visited by an internet user, a shopper’s outfit, or the means of transport used by a passer-by) to send advertising where no information is exchanged with the natural person.
The interaction must also be direct, i.e. occur in real time or near real time and without human involvement. According to the guidelines, therefore, the term would not apply where customer support staff draw on the assistance of an AI system when processing requests. This still leaves questions in more nuanced cases, however – for example where an AI system might answer e-mail queries itself, but with a few days’ delay to allow a human veto over the reply.
An important exemption from the transparency obligation exists where the artificial nature of the interaction is “obvious”. In line with consumer protection law, the criterion for “obvious” is what is immediately evident to a reasonably well-informed, observant and circumspect natural person in the respective context. For this purpose, providers should keep in mind the potential and reasonably foreseeable target audience, which in advertising will usually be the target group. The standards for “obvious” are particularly high if the target group includes vulnerable individuals such as persons with disabilities, elderly people or minors. Under the guidelines, AI chatbots that recommend products in online shops or on platforms are – as a rule – not exempted. Interestingly, however, in the case of interactions with AI-enabled Non-Playable Characters (NPCs) in a videogame, the guidelines deem it sufficient that the “artificiality” of the interaction is obvious. So it could often be enough to clearly mark an interactive AI system as artificial and of machine origin (e.g. an online customer service representative called “Robot Buddy”) without necessarily using the term “artificial intelligence”. But it remains to be seen whether this view will carry the day.
To comply with this information obligation, the Commission recommends taking a multimodal approach to disclosure. Options include clear textual pointers (“You are interacting with an AI system”), visual cues such as icons or coloured frames, or for language-based systems a spoken statement at the beginning of the interaction. The latter is particularly relevant to audio advertising, for instance on AI-assisted telephone hotlines or via voice assistants. The obligation is not, however, met by unclear or ambiguous references such as “assistant”, references solely to terms and conditions, purely machine-readable markings, or ambivalent technical descriptions such as “this system uses LLMs”.
In the context of interactions that are sustained or involve emotions, such as with AI companions, periodic reminders may also be necessary to ensure continued user awareness. The guidelines also warn against overly intrusive disclosure techniques that may undermine users’ ability to process the information (“banner blindness”).
2. AI content, Article 50(2) AI Act
Providers must mark AI-generated or manipulated image, video, audio or text content in a machine-readable format, while also making it detectable as such to persons exposed to the content. This provision applies not only to content that is entirely AI-generated, but also to a mixture of AI-generated and human-generated material.
An important point to note for the audio advertising industry is that “audio” is defined broadly as a “time-varying signal” that may include speech, instrumental music, or other audio signals. This means that radio commercials, podcast adverts and synthetic voice-overs may also be subject to marking requirements, even if only individual elements – such as an AI-generated jingle or a synthetic background voice-over – are embedded within content that is otherwise produced by humans.
The guidelines specify that the technical solutions for marking and detection must be effective, interoperable, robust and reliable, but also acknowledge that no single technique for marking currently meets all four requirements at the same time. In practice, this means that a combination of different methods is typically required – such as watermarking in images, cryptographically signed metadata in the file header, and fingerprinting for tracking purposes. Providers may implement the markings at different stages of the value chain and rely on upstream solutions, such as watermarks already embedded by a third-party AI tool. Even so, providers retain ultimate responsibility for meeting all compliance requirements.
The obligation to mark content does not apply if the AI system merely performs “an assistive function for standard editing” or does not substantially alter the input data or “the semantics thereof”. The guidelines provide numerous examples to illustrate this distinction. While grammar correction, compression, minor cropping, minor colour adjustments, as well as the removal of red-eye and sensor spots do not fall under the marking obligation, adding objects, deleting backgrounds, altering body shape or skin colour, extreme colour and contrast adjustments as well as any other substantial alteration of the content do require marking. Ultimately, it comes down to a case-by-case assessment of what constitutes a “substantial alteration”, with no clear-cut boundaries. Even a “minor” colour adjustment to a photograph may, for instance, significantly alter a model’s skin colour or make the sky look like it belongs to a different season.
Audio content raises similar questions of where to draw the line. While mere noise suppression or volume normalisation are relatively clear cases of standard editing, and the use of a synthetic voice for a radio or podcast advert clearly requires marking, other forms of audio correction (e.g. removing verbal slips or stuttering) may fall into a grey area, with the guidelines tending to interpret the exception narrowly.
3. Special AI systems, Article 50(3) AI Act
Deployers of AI-based emotion recognition and biometric categorisation systems must inform individuals exposed to these systems of their use. In an advertising context, this might include, for example, camera systems that capture customer reactions to in-store displays and measure advertising impact in real time, or platforms that deliver specific adverts based on detected emotions. The obligation to provide information applies regardless of whether the system operates in real time or with a delay.
How use of the system is disclosed may vary depending on context, ranging from a visible sign at a store entrance to an app pop-up to an onboarding message during initial registration. Although, under the guidelines, there is no obligation to give the reasons for using the system, data protection law will generally require disclosure of the purpose of the data processing (Article 13 GDPR).
As emotion recognition systems also constitute high-risk AI systems, additional regulatory requirements apply alongside the transparency obligation described above, unless such systems are already prohibited under Article 5(1)(f) AI Act.
4. Deep fakes, Article 50(4), first subparagraph AI Act
A further transparency obligation of particular relevance to advertising concerns deep fakes. Deployers must disclose when AI-generated or manipulated image, audio or video content constitutes a deep fake.
A deep fake is defined as content that resembles existing persons, objects, places or events and would appear to be authentic (Article 3, point (60) AI Act). The resemblance must be appreciable. By this standard, a commercial in which an AI-generated image of a famous sportsperson or actor promotes a product will generally be subject to the transparency obligation. The same applies to social media posts featuring an AI-generated depiction of an influencer. However, according to the guidelines, a deep fake does not always have to mimic a specific, existing individual – it is sufficient for the depicted subjects to resemble someone or something than can exist or could have existed. This means that even an “anonymous” voice or a generic virtual representation of a consumer could constitute a deep fake if it appears realistic. Whether the deployer intended to deceive is irrelevant – the sole decisive factor is whether the content is objectively capable of creating the impression of authenticity. “Robotic voices”, anthropomorphised animal characters or “aliens” promoting a product, on the other hand, do not count as deep fakes (even if the intention is to deceive).
Of particular practical relevance to online advertising is the guidelines’ requirement that the potential diverse composition of the expected audience must be taken into account. Depending on the likely reach of the deep fake, the deployer must therefore also have regard for those groups that are particularly easily deceived, such as children, the elderly or (other) groups of persons with lower digital and AI literacy.
The AI Act provides for a reduced transparency obligation for works that are clearly artistic, creative, satirical, fictional or analogous (Article 50(4), sentence 3). The guidelines specify, for the first time, when content is to benefit from this special treatment. Three criteria are decisive in this regard: (i) whether the content displays formats or styles typical of at least one of the five content categories, (ii) the context in which the content is presented, and (iii) audience expectations. Crucially for advertising agencies, this special treatment does not extend to content that primarily serves a commercial purpose. According to the guidelines, an AI-generated video featuring simulated consumers promoting a product does not explicitly constitute a work of art – even if the campaign deliberately adopts an avant-garde style. Careful assessment is therefore required to determine whether a particular instance of advertising may benefit from the reduced transparency obligation or not.
5. AI journalism, Article 50(4), second subparagraph AI Act
The AI Act not only requires disclosure for deep fakes but also contains a separate transparency obligation for AI-generated text with the purpose of informing the public on matters of public interest.
Simple commercial advertising content, such as AI-generated slogans, product descriptions or promotional social media posts, is generally unlikely to fall under this provision. The difficulty for advertising instead lies in the grey areas, where content involving health, safety or sustainability claims can quickly cross into the realm of “public interest”. For example, advertising a dietary supplement using AI-generated health claims, an insurance policy using AI-formulated safety promises or a consumer product using AI-created sustainability claims may each trigger an obligation to disclose. This applies all the more to advertising in a political, religious or ideological context.
The transparency obligation does not apply if the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for it – something which advertising companies can achieve through systematic human approval processes. However, it is important to ensure that these processes also involve deliberate engagement with the substance of the AI-generated content and are not limited to purely formal checks.
6. Horizontal requirements of Article 50(5) AI Act
Article 50 AI Act requires that all transparency information be provided in a clear and distinguishable manner. It must therefore be noticeable, easy to understand and easy to identify as separate from other content. An AI notice buried in tiny footer text to an online banner is therefore no better for meeting this requirement than a technical label visible only in a website’s source code. The information must be provided to each natural person no later than upon their first interaction with or exposure to the AI system or its content.
III. Interaction with other legal frameworks
The transparency obligations under the AI Act form part of a broader regulatory landscape that includes various EU and national legal regimes.
First, data protection law must be considered: Creating a deep fake using a celebrity’s likeness or voice for advertising purposes will typically involve the processing of personal data and must therefore comply with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679), in particular by ensuring a valid legal basis and transparency to the individuals concerned.
Unfair competition law is equally relevant. Under the Unfair Commercial Practices Directive (Directive 2005/29/EC, “UCPD”), implemented in Germany through the Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb, “UWG”), consumers must not be deceived about material product characteristics. Importantly, the concept of deception under the UCPD and the authenticity criterion under the AI Act’s definition of deep fakes must be treated separately. As a result, content that is correctly labelled as AI-generated under the AI Act may still be considered unfair under the UWG – for example, where a testimonial by a celebrity that is labelled as being AI-generated still creates the impression of genuine endorsement.
The Consumer Rights Directive (Directive 2011/83/EU) is also relevant, as it requires traders to inform consumers about the main characteristics of the goods or services. Where a service is AI-driven – for example, an AI-powered companion app – the AI functionality itself may constitute a key characteristic that must be disclosed prior to purchase. These obligations apply independently of whether an AI interaction is considered “obvious” under the AI Act.
Finally, intellectual property and personality rights must also be taken into account. Deep fakes depicting protected content or identifiable individuals may raise copyright, trademark and personality rights issues. For instance, an AI-generated advert recreating a well-known film scene or using a protected melody may give rise to separate IP claims alongside the transparency obligations under the AI Act.
IV. Sanctions and enforcement
Companies that fail to comply with the AI Act’s transparency obligations risk significant fines. In the worst case, these may amount to up to EUR 15 million or, if higher, up to 3% of the company’s total worldwide annual turnover (Article 99(4) AI Act). While lower than the maximum fines under the GDPR, the potential penalties remain substantial. Enforcement will primarily fall to national market surveillance authorities designated by Member States, as well as the AI Office at EU level. In Germany, however, the relevant implementing legislation must still enter into force; a government draft was adopted on 11 February 2026 and is currently progressing through the legislative process.
In addition, companies may face private enforcement risks, including cease-and-desist claims or injunction actions brought by competitors and consumer protection organisations.
V. Outlook
The new transparency obligations incentivise early action, as the strategic and operational considerations required to avoid their application – or to ensure seamless compliance – take time to implement.
The guidelines provide a useful starting point for these considerations, offering practical orientation that the abstract wording of the legislation alone cannot provide. Companies should therefore make use of the remaining period until August (or December) 2026 to map their AI systems, clarify their role as provider or deployer, and assess existing marketing practices for potential exposure to the new transparency obligations. As noted above, the relevant benchmark is not a company’s subjective intent, but the potential effect on the target group: Even an advertising image merely enhanced by AI could, in certain cases, be classified as a deep fake.
It is crucial to approach AI Act compliance holistically, taking into account its interaction with data protection, unfair competition and intellectual property law.
Finally, companies should bear in mind that the guidelines – particularly in their current draft form issued for consultation – are not legally binding. The authoritative interpretation of the AI Act ultimately rests with the courts, including the Court of Justice of the European Union. Depending on the circumstances, there may be room to adopt a well-reasoned alternative interpretation. In practice, however, the guidelines are expected to set the tone for the interpretation of the relevant requirements and to significantly influence enforcement. Initial regulatory and court decisions will therefore be important milestones and should be closely monitored.
1 European Commission, Draft Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (the ‘AI Act’), online available here.
2 The Commission’s guidelines on AI transparency organize the obligations under Article 50 AI Act into just four specific obligations, combining the obligations mentioned here in paragraphs 4 and 5 into a single one. However, their scope of application and exceptions vary so widely that a functional separation is more helpful for understanding.
Forward
