Deepfake Under the EU AI Act: Definition and the Disclosure Duty

A deepfake is defined in Article 3(60) of the EU AI Act, Regulation (EU) 2024/1689, as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The Act does not ban deepfakes; it requires that they be disclosed, so people are not deceived about what is real.

The disclosure duty (Article 50(4))

Article 50(4) places the duty on deployers: those who generate or manipulate deepfake content must disclose that the content has been artificially generated or manipulated. A parallel duty applies to AI-generated text published to inform the public on matters of public interest. Separately, Article 50(2) requires providers of generative systems to mark synthetic output in a machine-readable format.

The content-marking and watermarking obligations apply from 2 December 2026; most other Article 50 transparency duties apply from 2 August 2026.

The proportionate carve-out for art

The Act is measured about creative work. Where deepfake content is part of an artistic, creative, satirical or fictional work, the disclosure must be made in a way that does not hamper the display or enjoyment of the work — a caption credit rather than an intrusive overlay. The duty to disclose remains; only its presentation is relaxed.

Where deepfakes meet the prohibitions

Disclosure is the rule for lawful deepfakes, but some uses cross into prohibited territory regardless: a deepfake deployed as a manipulative technique that materially distorts behaviour and causes harm can breach Article 5(1)(a). And AI-generated child sexual abuse material falls under the new prohibition landing 2 December 2026. Disclosure does not cure a prohibited use.

How Confir helps

Confir flags where your systems generate or publish deepfake or synthetic content, maps the Article 50(4) disclosure and Article 50(2) marking duties and the 2 December 2026 deadline to how you publish, and separates the provider-side marking duty from your deployer disclosure. The engine is deterministic and rule-based.

Frequently asked questions

What is a deepfake under the EU AI Act?

Article 3(60) defines it as AI-generated or manipulated image, audio or video content resembling real persons, objects or events that would falsely appear authentic. The Act does not ban deepfakes but requires them to be disclosed so audiences are not deceived.

Do I have to label a deepfake?

Yes. Under Article 50(4), a deployer who generates or manipulates deepfake content must disclose that it is artificially generated or manipulated. Providers of generative systems must also mark synthetic output in a machine-readable format under Article 50(2). Content-marking obligations apply from 2 December 2026.

Is there an exception for artistic deepfakes?

There is a proportionality carve-out, not an exemption. For artistic, creative, satirical or fictional work, the disclosure must be made in a way that does not hamper enjoyment of the work — a caption credit rather than a banner. The disclosure itself is still required.

Can a deepfake be prohibited rather than just disclosed?

Yes. A deepfake used as a manipulative technique that materially distorts behaviour and causes harm can breach the Article 5(1)(a) prohibition, and AI-generated child sexual abuse material is prohibited from 2 December 2026. Disclosure does not cure a prohibited use.

What is the penalty for failing to disclose?

Article 50 transparency breaches fall in the Article 99(4) tier — up to €15 million or 3% of worldwide turnover. Prohibited uses fall in the higher Article 99(3) tier of €35 million or 7%. SMEs are capped at the lower figure under Article 99(6).

Related guides

• Article 50 transparency obligations
• Is Adobe Firefly high-risk under the EU AI Act?
• Article 5 prohibited practices
• EU AI Act for marketing and adtech
• How AI risk classification works