Adobe Firefly Under the EU AI Act: Not High-Risk, but Squarely in Article 50
Adobe Firefly is not high-risk under the EU AI Act. The real duty is Article 50 content marking and disclosure, applying from 2 December 2026.
Adobe Firefly is not high-risk — but it is the design tool most directly affected by the EU AI Act, Regulation (EU) 2024/1689. Generating images and design assets is not an Annex III use, so the high-risk regime does not attach. What does attach is Article 50: Firefly produces synthetic content, and the Act requires AI-generated media to be marked and, in some cases, disclosed. The headline date is 2 December 2026.
Why image generation is not high-risk
Article 6(2) makes a system high-risk only where its purpose sits in Annex III — recruitment, credit scoring, biometric identification, and the rest. Producing marketing imagery, concept art or edited photos is none of those. So Firefly itself is a minimal-risk classification. The obligation it carries is not about risk tier at all; it is a transparency duty that applies to generative systems regardless of their tier.
The duty that matters: Article 50 content marking
Article 50(2) requires providers of generative AI systems to mark synthetic image, audio, video and text output in a machine-readable format detectable as artificially generated or manipulated. Adobe builds provenance signals (Content Credentials) into Firefly to support this on the provider side. Article 50(4) then puts a duty on deployers: if you generate or manipulate deepfake content, or publish AI-generated content, you must disclose that it is artificial.
For a team using Firefly, the operative duty is usually the 50(4) deployer disclosure for published synthetic creative. The fixed deadline is 2 December 2026, so the practical task is to build marking and disclosure into your creative workflow before then, rather than retrofit it across a back catalogue.
The carve-out for creative work
The Act is proportionate about art. Artistic, creative, satirical or fictional work still requires deepfake disclosure, but in a manner that does not hamper the display or enjoyment of the work — a credit line or a caption note rather than a banner that ruins the piece. The exemption is about presentation, not a pass to skip disclosure.
When Firefly output could sit inside a high-risk system
Firefly is minimal-risk, but the system it feeds might not be. If generated imagery were used inside an Annex III use — synthetic faces in a biometric pipeline, say — the high-risk classification would attach to that system, not to Firefly. And manipulative use of synthetic media that materially distorts behaviour and causes harm could reach Article 5(1)(a) prohibited territory. These are edge cases for a design tool, but they show the pattern: classify the system the content lands in, separately from the generator.
Provider or deployer?
You are a deployer under Article 26 when you use Firefly to make assets; Adobe is the provider and carries the Article 50(2) marking duty and the GPAI obligations (Articles 51–55) for the underlying model. Your obligation is the Article 50(4) disclosure for what you publish. If you built your own generative feature on Firefly's services under your own name, Article 25 could make you the provider — then the 50(2) marking duty would be yours too.
Timeline and penalties
Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI duties since 2 August 2025 (with Adobe); most Article 50 transparency from 2 August 2026; the content-marking and watermarking obligations from 2 December 2026. The high-risk dates (2 December 2027 for stand-alone Annex III systems, 2 August 2028 for product-embedded Annex I systems, as set by the Digital Omnibus adopted in June 2026) are largely irrelevant to Firefly, because image generation is not an Annex III use.
Penalties under Article 99: Article 50 transparency breaches sit in the €15 million or 3% tier (Article 99(4)), not the lowest tier; prohibited practices are €35 million or 7% (99(3)); misleading information to authorities is €7.5 million or 1% (99(5)); the Article 99(6) SME cap is the lower figure.
Worked example: a 50-person brand studio
Vermillion & Co., a 50-person brand studio in Milan, uses Firefly for campaign imagery and generative fill. The classification is minimal risk — no Annex III use — so there is no high-risk stack. The live duty is Article 50: from 2 December 2026 the studio must ensure Firefly's synthetic output is marked, and must disclose AI-generated or deepfake-style creative it publishes for clients under Article 50(4). Vermillion updates its delivery workflow now — keeping Firefly's Content Credentials intact on export and adding a standard AI-content disclosure line to published synthetic assets — so the December date arrives as routine. A clearly artistic, fictional campaign still carries a disclosure, placed as a caption credit rather than an intrusive overlay.
How Confir helps
Confir registers Firefly as a minimal-risk generative tool whose live obligation is Article 50, and maps the disclosure and content-marking duties — including the 2 December 2026 date — to the way you actually publish synthetic content. It separates the provider-side marking duty (Adobe's) from your deployer disclosure duty, and flags the rare case where generated content feeds an Annex III system. The engine is deterministic and rule-based — the same inputs always yield the same cited finding.
Frequently asked questions
Is Adobe Firefly high-risk under the EU AI Act?
No. Generating images and design assets is not an Annex III use, so Firefly is minimal-risk. Its relevant obligation is not about risk tier — it is Article 50 transparency, which requires synthetic content to be marked and, where it is a deepfake or published AI content, disclosed. The content-marking duties apply from 2 December 2026.
When do I have to label AI-generated images from Firefly?
The content-marking and watermarking obligations under Article 50(2) apply from 2 December 2026, and the deployer disclosure for deepfake or published AI content under Article 50(4) applies to what you publish. Build marking and a standard disclosure into your creative workflow before that date rather than retrofitting it later.
Does artistic or fictional work still need disclosure?
Yes, but proportionately. Artistic, creative, satirical or fictional work requires deepfake disclosure in a manner that does not hamper enjoyment of the work — a caption credit rather than an intrusive banner. The exemption concerns how you present the disclosure, not whether you make it.
Who has to mark Firefly's output — Adobe or us?
Both, in different ways. Adobe, as the provider of the generative system, carries the Article 50(2) machine-readable marking duty and builds provenance signals into Firefly. You, as the deployer, carry the Article 50(4) disclosure duty for deepfake or published AI content. If you build your own generative feature on Firefly under your own name, Article 25 can make the marking duty yours too.
What is the penalty for getting AI-content disclosure wrong?
Article 50 transparency breaches fall in the Article 99(4) tier — up to €15 million or 3% of total worldwide annual turnover, whichever is higher — not the lowest tier. Prohibited practices are higher at €35 million or 7%, and SMEs and start-ups benefit from the Article 99(6) cap at the lower of the percentage or fixed amount.
Related guides
- Article 50 transparency obligations
- How AI risk classification works
- EU AI Act for marketing and adtech
- Build your AI system inventory
- Provider versus deployer roles
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →