Synthesia and the EU AI Act: A Compliance Guide for AI Avatar Video

Probably not high-risk. Synthesia generates AI avatar video and synthetic, often cloned, voices, so the defining EU AI Act question for your organisation is Article 50 transparency for synthetic content under Regulation (EU) 2024/1689 — not the high-risk regime. For ordinary marketing, internal training, and corporate comms, a Synthesia video does not touch Annex III.

The realistic duties are narrower than the alarm suggests: Article 50 transparency where output reaches third parties, Article 4 AI literacy for the team, and data governance for the likeness and voice data you feed in. This page is a deployer-side playbook — distinct from the abstract Article 50 doctrine in the full Article 50 deepfake labelling rules and the use-based risk ladder in add Synthesia to your AI inventory.

---

Where Synthesia sits in the EU AI Act: mostly transparency, not high-risk

Most general business content generation is not high-risk. High-risk classification under Article 6(2) arises only where a system is used for a purpose listed in Annex III. An explainer video, a training module, or a marketing reel is not on that list. An avatar used to deliver an individualised recruitment decision or a creditworthiness explanation would be a separate Annex III question — driven by the use, not by Synthesia itself.

The responsibility split is the spine of this guide. Synthesia, the generator, carries the Article 50(2) machine-readable marking duty. Your company, the deployer that publishes the video, carries the Article 50(4) deepfake disclosure duty. The two stack, and neither discharges the other.

---

Why Synthesia output is usually a 'deepfake' under Article 3(60)

Article 3(60) defines a deep fake as AI-generated or AI-manipulated image, audio or video content resembling existing persons, objects, places, entities or events that would falsely appear to a person to be authentic or truthful. The test is the appearance of authenticity — not whether a real, named individual is depicted. A photorealistic Synthesia avatar speaking in a cloned or synthetic voice typically meets it, so most output is deepfake-grade and triggers the Article 50(4) deployer disclosure.

Custom and personal avatars built from a real employee, executive, or hired actor are squarely in scope, and stock avatars resembling plausible real humans generally are too — the viewer cannot tell a stock face from a colleague's, and a fictional subject does not take the output out of scope.

Clearly stylised, cartoon-style, or evidently non-realistic output may not meet the Article 50(4) deepfake disclosure trigger, because no reasonable viewer would take it for authentic footage. But it still requires the Article 50(2) machine-readable mark, which applies to all synthetic output: the lighter case removes the disclosure, not the provider's mark.

---

The two duties that apply: provider marking (50(2)) and deployer disclosure (50(4))

Synthesia's machine-readable marking duty — Article 50(2)

Article 50(2) requires the provider of a generative system to mark synthetic audio, image, video or text output in a machine-readable format, detectable as artificially generated or manipulated, using a solution that is effective, interoperable, robust and reliable as far as technically feasible. Interoperability is load-bearing: a proprietary watermark only Synthesia's own tooling can read does not satisfy the duty. In practice this points toward open provenance standards such as C2PA content credentials.

Your disclosure duty as the deployer who publishes the video — Article 50(4)

Article 50(4) requires the deployer that generates or manipulates a deepfake to make a clear, human-perceptible disclosure that the content is artificially generated or manipulated, at the latest at the time of the first interaction or exposure under Article 50(5). A machine-readable mark a viewer cannot perceive does not satisfy this; Synthesia embedding a mark does not relieve your team of the on-screen or audible disclosure, and your disclosure does not relieve Synthesia of marking.

Where a deepfake forms part of an evidently artistic, creative, satirical or fictional work, the Article 50(4) disclosure is reduced to a non-prominent form — but it is not eliminated, and a realistic avatar endorsement in an advertisement is not 'evidently artistic'. Separately, the Article 25 role-flip: if your company white-labels or substantially modifies a generative avatar capability and ships it under its own name or trademark, it can become a provider and inherit the Article 50(2) marking duty.

---

Consent and likeness data governance: the trap before the AI Act

Synthesia clones real faces and voices, the clearest differentiator from sibling guides. Before any Article 50 question, you need a GDPR lawful basis (GDPR Article 6) for processing the avatar subject's personal data, and a data processing agreement with Synthesia for the personal data you submit. The transparency layer sits on top of GDPR; it does not replace it.

Voice and facial-likeness data used to build a custom avatar can engage biometric and special-category protections under GDPR Article 9, requiring explicit consent or another specific legal ground. Explicit, documented, revocable consent from the person cloned is the safe baseline — not a buried clause in an employment contract.

Keep a governance checklist: written likeness and voice consent with a defined scope; retention and deletion rules for the source recordings; restriction to the agreed purposes; a plan for departed-employee or expired-actor avatars; and a record of who authorised each avatar. This sits alongside, not inside, the high-risk Article 10 data-governance regime.

---

Worked example: a 600-person SaaS company rolling out Synthesia for training video

Northwind Logistics, a 600-employee EU SaaS and logistics company, uses Synthesia to produce internal onboarding and compliance-training videos featuring a custom avatar of its Head of People plus a stock-avatar narrator. Synthesia is the provider, carrying the Article 50(2) marking duty. Northwind is the deployer, carrying the Article 50(4) disclosure duty wherever the output reaches third parties. Internal-only training still benefits from a clear 'this video uses an AI-generated presenter' notice, so the disclosure holds if a clip is later shared.

Five concrete actions cover Northwind's position:

• Secure explicit written likeness and voice consent from the Head of People, with a defined scope and a revocation route.
• Sign a data processing agreement with Synthesia for the personal data submitted.
• Add a visible or audible AI-generated disclosure to each published video.
• Log the avatar inventory and the matching consents in a register.
• Deliver Article 4 AI literacy to the content team.

These training videos are not high-risk. Had Northwind instead used a Synthesia avatar to deliver individualised recruitment outcomes (Annex III point 4(a), employment), the high-risk regime would apply — triggered by that use, not by Synthesia's generation step, and assessed separately.

---

Deadlines, penalties, and a 2026 action plan

Under the Digital Omnibus, the Article 50 content-marking and watermarking obligations move to a fixed calendar date of 2 December 2026; the standards-contingent 'stop the clock' variant was rejected, so it is a hard date. Freshness note: the Digital Omnibus has been adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026 — with entry into force on Official Journal publication, expected before 2 August 2026.

Already in force and unaffected: Article 5 prohibitions and Article 4 AI literacy since 2 February 2025; GPAI obligations under Articles 51-55 since 2 August 2025, on a track separate from Article 50.

Breach of the Article 50 transparency duties falls under Article 99(4): up to €15 million or 3% of total worldwide annual turnover, whichever is higher.

The €35 million or 7% top tier under Article 99(3) is reserved for the Article 5 prohibited practices and does not apply to labelling failures. The third tier is 1%, for incorrect information.

What to do now: inventory every Synthesia video and avatar; confirm the consents and DPA position for each custom avatar; standardise an on-screen plus machine-readable disclosure template; verify Synthesia's marking and provenance capability; and brief the content team on Article 4 literacy. None of this waits on the high-risk track — it is transparency-tier work.

---

How Confir helps

Register Synthesia in your AI inventory and Confir's deterministic, rule-based classification engine runs a transparency-trigger checklist from how you describe the system — whether the output is realistic enough to be a deepfake, and whether you hold the provider or the deployer role. The workflow captures the Article 50(2) marking and Article 50(4) disclosure duties, records the likeness-consent and DPA position for each avatar, and produces an auditable record.

The synthesis engine is deterministic and rule-based — no model inference, no hallucination. The same system description yields the same obligations every time, with the firing rule in plain language so any reviewer can check it. General-purpose AI workflow support remains on the roadmap and is not marketed as a complete provider-side compliance solution.

---

Frequently asked questions

Is Synthesia high-risk under the EU AI Act?

Not in ordinary use. For marketing, internal training, and corporate-comms videos, Synthesia output is not an Annex III purpose under Article 6(2), so it is not high-risk. The real duties are Article 50 transparency where the video reaches third parties, Article 4 AI literacy for the team, and data governance for the cloned face and voice. High-risk would only arise from the use — for example delivering an Annex III recruitment outcome — not from the avatar-generation step itself, and that is assessed separately.

Do we have to label every Synthesia avatar video?

Usually yes. A photorealistic avatar speaking in a synthetic or cloned voice meets the Article 3(60) deepfake definition because it would appear authentic to a viewer, so as the deployer publishing it you owe a clear, human-perceptible disclosure under Article 50(4), at the latest at first exposure. Clearly stylised or cartoon-style output may fall short of the deepfake disclosure trigger, but all synthetic output still needs the Article 50(2) machine-readable mark embedded by the generative system.

Who is responsible for marking — Synthesia or our company?

Both, at different points. Synthesia, as the provider of the generative system, carries the Article 50(2) duty to embed a machine-readable mark in every output, using a solution that is effective, interoperable, robust and reliable. Your company, as the deployer that publishes the video, carries the Article 50(4) duty to make a clear, human-perceptible disclosure to the audience. The provider's mark does not discharge your disclosure obligation, and your disclosure does not discharge the provider's marking duty.

What consent do we need to clone an employee's face and voice?

Before any AI Act question, GDPR applies. Cloning a real face and voice processes personal data, and facial-likeness and voice data can engage special-category protections under GDPR Article 9, so explicit, documented, revocable consent with a defined scope of use is the safe baseline, alongside a lawful basis under GDPR Article 6 and a data processing agreement with Synthesia. Keep a record of who authorised each custom avatar, restrict use to the agreed purpose, and retire avatars when consent is withdrawn.

When do the Synthesia content-marking rules apply?

Under the Digital Omnibus, the Article 50 content-marking and watermarking obligations move to a fixed calendar date of 2 December 2026; the standards-contingent 'stop the clock' variant was rejected. This change has been adopted — provisional agreement on 6-7 May 2026, COREPER text confirmed around 13 May 2026, European Parliament plenary vote on 16 June 2026, and Council adoption on 29 June 2026 — with entry into force on Official Journal publication, expected before 2 August 2026.

What penalties apply if we get Synthesia labelling wrong?

Breach of the Article 50 transparency duties falls under Article 99(4): fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The €35 million or 7% top tier under Article 99(3) is reserved for Article 5 prohibited practices and does not apply to labelling failures. Supplying incorrect or misleading information to authorities is a separate Article 99(5) offence at up to €7.5 million or 1%. SMEs and start-ups benefit from the Article 99(6) cap at the lower of the percentage or the fixed amount.

---

Related guides

• the full Article 50 deepfake labelling rules
• Article 50 transparency obligations
• how to structure an AI transparency notice
• the limited-risk transparency tier
• add Synthesia to your AI inventory