Midjourney and the EU AI Act: A Compliance Guide for AI-Generated Images

Probably not high-risk. Midjourney turns text prompts into still images, so the defining EU AI Act question for your organisation is Article 50 transparency for synthetic visual content under Regulation (EU) 2024/1689 — not the high-risk regime. For marketing, branding, concept art, or editorial illustration, a Midjourney image does not touch Annex III.

The realistic duties are narrower than the alarm suggests: Article 50 transparency where the image reaches the public, Article 4 AI literacy for your team, and an adjacent layer of copyright and likeness risk outside the Act. This page is a deployer-side playbook — distinct from the abstract doctrine in the full Article 50 deepfake labelling rules and the cloned-likeness case in the avatar-video transparency playbook for Synthesia.

---

Where Midjourney sits in the EU AI Act: a transparency duty, not high-risk

What counts as high-risk and what does not

Most business image generation is not high-risk. High-risk classification under Article 6(2) arises only where a system is used for a purpose listed in Annex III. A marketing visual, brand asset, concept art, or editorial illustration is not on that list, so the regime does not arise from the generation step itself. High-risk would only follow from a downstream use — an image system feeding an Annex III decision — assessed separately, driven by the use, not by Midjourney. The defining obligation is the Article 50 transparency regime for synthetic visual content — the limited-risk tier, not the high-risk stack.

Why image generation is a still-image problem, distinct from video and audio

Two duties stack. Midjourney, as the provider of a generative system, carries the Article 50(2) machine-readable marking duty; your company, as the deployer that publishes a deepfake image, carries the Article 50(4) human-perceptible disclosure duty. Neither discharges the other. Midjourney produces still images from text prompts, not cloned-likeness avatar video like Synthesia or cloned voice like ElevenLabs, so the deepfake trigger turns on whether the image resembles existing persons, objects, places, entities or events — not on whether a real person was cloned from source data.

---

When a Midjourney image is a 'deepfake' under Article 3(60)

The resemblance-to-reality test

Article 3(60) defines a deep fake as AI-generated or AI-manipulated image, audio or video content resembling existing persons, objects, places, entities or events that would falsely appear to a person to be authentic or truthful. For images, the test is the appearance of authenticity — not whether a named individual is depicted. A photorealistic scene, a realistic product shot, or a fabricated photograph of a recognisable place can meet it even with no real-person source data.

Photorealistic versus clearly stylised output

Photorealistic Midjourney output that could pass for a real photograph generally triggers the Article 50(4) deployer disclosure when published, and images depicting real public figures or real locations in fabricated scenes are squarely in scope. Clearly stylised, painterly, cartoon, or evidently illustrative output usually falls short of the disclosure trigger, because no reasonable viewer would take it for authentic footage — but it still requires the Article 50(2) machine-readable mark. The lighter case removes the disclosure, not the mark.

---

The two duties that apply: provider marking (50(2)) and deployer disclosure (50(4))

Midjourney's machine-readable marking duty — Article 50(2)

Article 50(2) requires the provider of a generative system to mark synthetic image output in a machine-readable format, detectable as artificially generated, using a solution that is effective, interoperable, robust and reliable as far as technically feasible. Interoperability is load-bearing: a proprietary watermark only Midjourney's own tooling can read does not satisfy the duty, which points toward open standards such as C2PA.

Your disclosure duty as the deployer who publishes the image — Article 50(4)

Article 50(4) requires the deployer that generates or manipulates a deepfake image to make a clear, human-perceptible disclosure that the content is artificially generated, at the latest at first exposure under Article 50(5). A machine-readable mark a viewer cannot see does not satisfy this: Midjourney embedding a mark does not relieve your on-image or caption disclosure, and your disclosure does not relieve Midjourney of marking. Where a deepfake image forms part of an evidently artistic, creative, satirical or fictional work the disclosure reduces to a non-prominent form — but a photorealistic image used as a real product photo is not 'evidently artistic'.

When your company becomes a provider — Article 25

The Article 25 role-flip: if your company white-labels or substantially modifies a generative image capability and ships it under its own name or trademark, it becomes a provider and inherits the Article 50(2) marking duty.

---

Training data, IP, and likeness: the issues unique to image generation

Copyright and training-data provenance

Image generation raises copyright and training-data questions that sit alongside, not inside, the AI Act transparency layer — the clearest differentiator from the video and audio sibling guides. These exposures are governed by EU and national copyright law and GDPR, not by Article 50: the Act tells you to mark and disclose synthetic output, not how the model was trained. Output resembling third-party brands, trademarks, logos, or protected characters carries exposure independent of the Act; the licence governs whether you may use an image commercially.

Output that resembles real people, brands, or protected works

Output resembling a recognisable real person can engage GDPR and image and likeness rights even though Midjourney did not clone that person from source data. A fabricated but realistic image of a real individual is also a deepfake under Article 3(60), so the GDPR and likeness layer and the Article 50(4) disclosure layer can fire at once. As a GPAI note, image foundation models touch the general-purpose AI track under Articles 51-55 (in force 2 August 2025), separate from the Article 50 deployer duties; Confir's GPAI support is partial and on the roadmap, not a complete provider-side solution.

---

Worked example: a 350-person consumer brand using Midjourney for marketing imagery

Lindqvist & Co, a 350-employee EU consumer-goods brand, uses Midjourney for social-campaign visuals, lifestyle product mockups, and concept art — a mix of photorealistic lifestyle scenes and clearly illustrated key art. Midjourney is the provider, carrying the Article 50(2) marking duty; Lindqvist is the deployer, carrying the Article 50(4) disclosure duty wherever photorealistic output reaches the public. Five concrete actions cover its position:

• Add a human-perceptible 'AI-generated image' disclosure to the photorealistic campaign visuals.
• Treat the clearly illustrated key art as outside the Article 50(4) trigger, while still relying on the Article 50(2) mark.
• Verify Midjourney's provenance, marking, and commercial-licence terms.
• Ban prompts that name living public figures or competitor brands, to control likeness and IP exposure.
• Deliver Article 4 AI literacy to the creative team.

These uses are not high-risk. Had Lindqvist instead fed generated images into an Annex III decision pipeline, that downstream use would be assessed separately under Article 6(2).

---

Deadlines, penalties, and a 2026 action plan

What did and did not move

Article 50, including the Article 50(2) marking duty, has applied since 2 August 2026. Under Article 111(4), inserted by the Digital Omnibus, generative systems already on the market before that date have until 2 December 2026. Freshness note: the Digital Omnibus (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026, so these dates are settled law.

Already in force: Article 5 prohibitions and Article 4 AI literacy since 2 February 2025 (the Omnibus replaced Article 4 with a softer duty); GPAI obligations under Articles 51-55 since 2 August 2025.

Penalties for getting it wrong

Breach of the Article 50 transparency duties falls under Article 99(4).

The €35 million or 7% top tier under Article 99(3) is reserved for the Article 5 prohibited practices and does not apply to labelling failures. None of the transparency-tier work — inventory, disclosure template, provenance and licence checks, prompt rules, Article 4 literacy — waits on the high-risk track.

---

How Confir helps

Register Midjourney in your AI inventory and Confir's deterministic, rule-based classification engine runs a transparency-trigger checklist from how you describe the system — whether output is realistic enough to be a deepfake, and whether you hold the provider or the deployer role. The workflow captures the Article 50(2) marking and Article 50(4) disclosure duties, records the adjacent IP, licence, and likeness position per image use, and produces an auditable record.

The synthesis engine is deterministic and rule-based — no model inference, no hallucination. The same system description yields the same obligations every time, with the firing rule in plain language for any reviewer. General-purpose AI workflow support remains on the roadmap, not a complete provider-side solution.

---

Frequently asked questions

Is Midjourney high-risk under the EU AI Act?

Not in ordinary use. Generating images for marketing, branding, concept art, or editorial illustration is not an Annex III purpose under Article 6(2), so it is not high-risk. The defining duty is Article 50 transparency where the image reaches the public, plus Article 4 AI literacy for the team. High-risk would only follow from a downstream use — for example feeding generated images into an Annex III decision — not from the image-generation step itself, which is assessed separately.

Who is responsible for marking — Midjourney or our company?

Both, at different points. Midjourney, as the provider of the generative system, carries the Article 50(2) duty to embed a machine-readable mark in every output, using a solution that is effective, interoperable, robust and reliable. Your company, as the deployer that publishes the image, carries the Article 50(4) duty to make a clear, human-perceptible disclosure to the audience. The provider's mark does not discharge your disclosure obligation, and your disclosure does not discharge the provider's marking duty.

Does the EU AI Act cover Midjourney's training data or copyright?

Not through the transparency duties. The Article 50 obligations are about marking and disclosing synthetic output, not about how the model was trained. Copyright, training-data provenance, trademark, and image-likeness questions are governed by EU and national copyright law and GDPR, which sit alongside the AI Act. Practically, restrict prompts that name living people or protected works, document the commercial-licence terms of your Midjourney plan, and keep a register of which published images are AI-generated.

When do the Midjourney content-marking rules apply?

Article 50, including Article 50(2) marking, has applied since 2 August 2026; under Article 111(4), inserted by the Digital Omnibus, generative systems already on the market before then have until 2 December 2026. The Digital Omnibus was voted by the European Parliament on 16 June 2026 and adopted by the Council on 29 June 2026, and has been in force since 27 July 2026.

Does a Midjourney image count as a deepfake if no real person is depicted?

It can. Article 3(60) defines a deep fake by resemblance to existing persons, objects, places, entities or events that would falsely appear authentic — not by whether a named individual is shown. A photorealistic fake photograph of a real-looking place or a believable scene can meet the test even with no real-person source data. Clearly stylised or evidently illustrative images usually do not, because no reasonable viewer would take them for authentic footage, though they still need the Article 50(2) machine-readable mark.

What penalties apply if we get Midjourney labelling wrong?

Breach of the Article 50 transparency duties falls under Article 99(4): fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The €35 million or 7% top tier under Article 99(3) is reserved for Article 5 prohibited practices and does not apply to labelling failures. Supplying incorrect or misleading information to authorities is a separate Article 99(5) offence at up to €7.5 million or 1%. SMEs and start-ups benefit from the Article 99(6) cap at the lower of the percentage or the fixed amount.

---

Related guides

• the full Article 50 deepfake labelling rules
• Article 50 transparency obligations
• the avatar-video transparency playbook for Synthesia
• the limited-risk transparency tier
• add Midjourney to your AI inventory