What the regulation actually requires
Article 50 of the European AI Act does not say that everything made with AI carries a label. It says something narrower, and that difference is what you either pay for or save.
The disclosure duty covers images, audio and video that constitute a deep fake: content meeting two conditions at once — it imitates a person, place or event that exists, and it could look authentic to whoever sees it. If either is missing, it is not one.
Two nuances almost nobody applies correctly. First: in manifestly artistic, satirical or fictional work the disclosure still exists, but in a form that does not spoil the work. Second: text published to inform the public on matters of public interest is covered too, unless it went through human review and someone holds editorial responsibility.
Penalties for breaching Article 50 reach €15 million or 3% of worldwide turnover, whichever is higher.
Who answers, to whom, and under which law
The law is Regulation (EU) 2024/1689, the Artificial Intelligence Act. It is a European regulation: directly applicable, with no national transposition needed.
Article 50 splits the duties between two roles, and mixing them up is the most expensive mistake in this area:
- The provider develops the AI system and places it on the market. It owes the machine-readable marking that makes synthetic origin detectable.
- The deployer uses the system and publishes the output. That is where almost any brand sits, and it is the role we audit: the duty to disclose to the public that content is artificial falls here.
The market surveillance authority in Spain is AESIA (Spanish Agency for the Supervision of Artificial Intelligence), created by Royal Decree 729/2023 and based in A Coruña. Penalties follow Article 99 of the Regulation, and the Spanish organic law bill implementing it — approved by the Council of Ministers on 26 May 2026 — designates AESIA as the lead authority.
Two dates worth keeping apart: the Article 50 transparency duties have applied since 2 August 2026. Providers of systems already on the market before that date have until 2 December 2026 to meet Article 50(2). That transition belongs to the provider, not to the deployer: whoever publishes is already bound.
What we deliver is the documentary traceability of that compliance: what was reviewed, against which criterion, and on what date.
What you get
- An inventory of the AI-generated or AI-manipulated pieces you publish: site, campaigns, social, catalogue, audio.
- A verdict per piece: labelled, not labelled, or borderline — and why, with the article applied.
- The wording of the label where one is needed, and where to place it so it complies without ruining the piece.
- A dated document you can file. If someone asks two years from now, the answer is already written, and dated before the question.
When the answer is that you need nothing
It happens often, and we say so anyway. A clearly synthetic illustration imitates nothing that exists. A voice that impersonates no one in particular does not either. A stylised product render may fall outside, depending on how it was made — while a synthetic photograph of the same product falls inside.
An audit that always concludes "label everything" is not an audit: it is a fear policy. The value is in knowing where the line runs.
One honest note: we are not a law firm. The verdict is technical and documentary, meant to support a conversation with yours, not to replace it.
Would you rather do it yourself? We have written the full guide and it is free: how to comply with Article 50 step by step — the case table with its verdict, the label wording ready to copy and the four-column record to keep.