Your AI Content Is Already Being Marked. Do You Know What You Must Disclose?

Does a business know that the rules for publishing artificial intelligence (AI) content changed on 2 August 2026? Very few do, and the entire industry moved to comply before most customers heard the rules existed. On that date the European Union's (EU) transparency rules for AI-generated content became enforceable ¹. In the weeks before it, around 190 organisations signed the European Commission's Code of Practice on Transparency of AI-generated Content, which sets out measures "to help providers and deployers of generative AI systems comply with the legal obligations to mark and label AI-generated content," with Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, OpenAI and Synthesia among the named signatories ². Google confirmed on 24 July that it was "signing the EU AI Act Code of Practice on Transparency of AI-Generated Content" and pointed to SynthID, its "industry-leading digital watermarking technology that helps people understand how content was created and edited" ³. Effectively every tool a business might use to make content has now agreed to stamp what it produces.

What that looks like in practice arrived twelve days after the deadline. Anthropic announced on 14 August that Claude would embed an invisible watermark in the text it generates, stating that it was "implementing watermarking to comply with the EU AI Act" and that it was "applying watermarking globally at launch" because it does not yet have "a durable way to scope it by region" ⁴. The mark is not a badge anyone can see, which is exactly why it has gone unnoticed: an imperceptible watermark woven "directly into the text itself," which "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing," alongside signed provenance metadata following the Coalition for Content Provenance and Authenticity (C2PA) standard attached to generated files in formats including .svg, .png and .jpg ⁵. The practical shift for a business is that evidence of AI involvement is now written in at the moment of generation rather than guessed at afterwards, so the question stops being whether anyone can tell and becomes whether the business knows what it is now supposed to disclose.

What the law actually requires disclosed is narrower than "anything AI touched" and wider than the word it uses suggests. The EU AI Act defines a deep fake as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" ⁶. Persons is the first word on that list and the only one most businesses read. Objects, places, entities and events are on it too, which puts a photorealistic reel of a restaurant's actual signature dish, generated from a single real photograph, inside the definition just as squarely as a fabricated celebrity endorsement. Both halves of that definition have to be met before any duty attaches, though. The content has to be AI-generated or manipulated, and it has to be something that would falsely appear authentic. Most commentary reads the first half and stops, which produces the widespread and incorrect belief that every AI-touched asset now needs a label. Real footage of a real dish, shot on a real camera, carries no disclosure duty at any point, however heavily it is graded or cut. What changes the answer is not whether AI was involved in production, it is whether the finished result shows something that never happened while looking like it did.

Three workflows land on the wrong side of that line, and they are in wide use precisely because they are cheap and fast. The first is the automated editor, CapCut being the most common, where a business hands over a folder of photos and a script and receives a finished, cut, photorealistic video back. The second is the AI presenter, a spokesperson who does not exist delivering a pitch to camera, which is the cleanest case the definition contains. The third is image-to-video, where one real product photograph becomes a moving sequence of plating, steam and motion that never occurred. The counter-example matters just as much: running AI denoising, upscaling or colour correction across real footage leaves a video that still truthfully shows the real thing, and nothing attaches.

A common assumption inside AI-assisted production is that human review settles the question, that an editor who takes the model's output and works on it has removed whatever obligation existed. For text, that assumption is broadly right. For visual content it is wrong. Article 50 attaches a disclosure duty to AI-generated text only where it is "published with the purpose of informing the public on matters of public interest," which leaves ordinary marketing copy outside it, and even that narrow duty lifts where the content "has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content" ⁷. Neither escape exists on the visual side. The obligation covering image, audio and video carries only two carve-outs, lawful law-enforcement use and evidently artistic or fictional work, and human editing is not among them. A business running a human-in-the-loop pipeline is doing the right thing for quality and accuracy, and on video it is not buying an exemption.

Where a business is based does not settle the question either. The AI Act extends to "providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union" ⁸, with no requirement anywhere in that text for an EU office, an EU contract or an EU customer base. How far that reach extends in practice is untested, with no case law yet drawing a line between an audience a business cultivates in Europe and a European who happens to scroll past. What is not untested is the second-order effect, because Anthropic faced exactly that question, concluded it could not scope compliance by region, and applied the marking to every user worldwide ⁴. A business outside Europe does not get to opt out of a rule its own tools have already adopted on its behalf, the same extraterritorial pattern that pulled privacy, consent and accessibility obligations onto businesses that never opened a European office.

The platforms arrived at the same place earlier and by their own route, which is why this binds a business today whatever happens to the jurisdictional question. YouTube requires "creators to disclose when they use AI to meaningfully alter or generate photorealistic content" ⁹, and its list of what does not require disclosure, "colour adjustment or lighting filters," "special effects filters," and "video sharpening, upscaling or repair," draws the same realism line the AI Act draws ⁹. Meta committed in February 2024 to "require people to use this disclosure and label tool when they post organic content with a photorealistic video or realistic-sounding audio that was digitally created or altered," adding that it "may apply penalties if they fail to do so" ¹⁰. Google's advertising documentation notes that regulations in "the European Union, India, and New York" now require disclosures on ads built with certain AI-generated assets ¹¹. None of those policies asks where the account is registered.

For most businesses the hard part is not deciding what the rules require, it is that nobody inside the business owns the question. A reel gets made because a product launched, a marketer or a freelancer builds it in whatever tool is fastest, and nothing in that chain stops to ask whether the finished file depicts something that never happened. That exposure is not only forward-looking either, because everything already published sits in the same unexamined pile, and marks embedded at generation do not expire when a business stops thinking about them. The first consequence is rarely a regulator. It is a platform quietly applying a label the business did not choose, or throttling distribution on an asset flagged as undisclosed, which surfaces as a campaign underperforming for reasons nobody can trace back to a cause. The label itself is not the thing to fear, since research covered previously found no measurable engagement penalty attached to AI labels. The thing that hurts is losing the choice, and a business cannot audit what it never recorded. Almost none have kept any record of which assets were synthesized.

So, plainly. Does a business have to mark its content as AI generated? Yes, whenever AI made or altered it and the result looks like something real that never happened. No, whenever a camera recorded it, however much it was graded or cut afterwards. Anything in between, mark it: the label costs nothing, and the alternative is a platform making the call for the business. That decision takes seconds while the file is being made and turns into guesswork a month later, which is why it belongs in the production process and not in a legal review.

Italian DesAIgns builds that check into video production rather than raising it once a campaign is already live, separating at the brief stage the footage that shows a real thing from the assets that synthesize one, so a business knows what carries a duty before publishing rather than after a platform decides on its behalf. Rules that moved twice inside a single month will move again, which is why this blog tracks them as they land, and the insights archive follows the same shift through SEO, paid ads and AI automation as each is reshaped by it. Disclosure is one half of how AI now reads a business. The other half is whether it can find and cite that business at all, which a quick AI visibility check answers by scoring a site's metadata, heading structure, structured data and crawler access.