The product shot for next week's promotion took twenty minutes instead of two weeks. The model cut out the packaging, built a background and produced three crops for the email. Then someone on the team asks the question nobody can answer cleanly: does that need a label?
The short answer is sometimes, and usually not for the reason people assume. The duty everyone has been talking about since August is aimed first at the companies that build the tools, not at your marketing team. What actually binds your team is three other things: one narrow case in the law, the rules of the ad platforms, and whether the origin of the file is even readable by the time it gets uploaded.
This guide separates those three layers, walks through the two metadata standards every major platform now reads, and ends with a checklist for email, web and paid. This is not legal advice, and it reflects the state of play on 4 November 2026. We checked the standards and platform behaviour that day on each vendor's own pages, and the legal points in the European Commission's publications.
Three layers people keep confusing
Most internal arguments about this go sideways because two people are talking about different layers. Separate them before you argue about wording.
| Layer | Who requires it | What it means for you |
|---|---|---|
| Law | EU AI Act, Article 50 | Narrow for you: only content that shows real people or events inauthentically |
| Platform rules | Google, Meta, TikTok, Pinterest | Broad: touches every ad and every upload, law or no law |
| Metadata | C2PA and IPTC | Technical: decides whether a platform can recognise the origin at all |
The third layer gets overlooked most often in marketing, and it is the only one fully in your hands. It decides whether your image picks up a label without you doing anything, and whether you can later show how it was made.
What the EU AI Act actually asks of you
The legal basis is Regulation (EU) 2024/1689. Article 50 covers transparency obligations and has applied since 2 August 2026.
Two paragraphs matter for creatives, and they address different parties. Paragraph 2 obliges providers of generative systems to mark their outputs in a machine-readable way so they can be detected as artificially produced. That is the image model's duty, not yours. Paragraph 4 obliges deployers, which is you, to disclose content that depicts people or events inauthentically. The disclosure has to happen no later than the first exposure, visibly or audibly. The Commission is explicit that you cannot satisfy this by relying on the provider's machine-readable marking: metadata is not a disclosure to a human being.
That gives your team the distinction it needs:
- A real product on a generated background depicts nobody inauthentically. Article 50 produces no disclosure duty for it.
- A generated testimonial, a face, a voice, a staged scene with a recognisable person or an actual event is the paragraph 4 case. That needs a notice people can see or hear.
- Artistic, satirical or fictional work has a narrower duty that must not interfere with displaying or enjoying the work. In retail that is rarely the right route.
Two more points are useful in practice. Content that was generated and published before 2 August 2026 does not have to be marked retroactively. And since June 2026 there is a Commission Code of Practice on the transparency of AI-generated content: signing is voluntary, and non-signatories have to be able to demonstrate compliance with Article 50 by other adequate means.
One thing we are deliberately not putting in your calendar as a deadline: the Commission's FAQ describes a grandfathering rule running to 2 December 2026 for systems that were already on the market before 2 August 2026. It depends on an amending regulation whose final status could not be confirmed from a primary source on 4 November 2026. Do not plan around it, and verify the point if it genuinely matters to you.
One frame the AI Act does not change: misleading advertising was already prohibited. If a generated image shows a product that does not ship that way, the problem is not a missing AI label. For how to settle permissions and sign-off for these tools inside a team, see our piece on AI policy for marketing teams.
What sits inside the file: C2PA and IPTC
This is the technical part, and it is manageably technical. Two standards split the work, and you only need to know them, not build them.
| Standard | What it is | Field and value |
|---|---|---|
| IPTC Photo Metadata | A single field in the image naming its origin | digitalSourceType carrying the trainedAlgorithmicMedia URI |
| C2PA Content Credentials | A signed provenance chain carrying more than one field | Assertions about creation and editing inside a signed manifest |
IPTC is the small, robust part. For fully generated images the digitalSourceType field takes the URI http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia, readable as "Created using Generative AI". For images only edited with a model there is a separate value, compositeWithTrainedAlgorithmicMedia, readable as "Edited with Generative AI". That split matters more than it sounds: retouching and generating are not the same thing, and the standards reflect it.
C2PA goes further. Content Credentials collect assertions about an asset, such as that it was created, which editing steps followed and which capture device was involved. Those assertions are bundled into a claim, signed by the claim generator's credential, and bound to the file as a manifest. The user-experience guidance maps trainedAlgorithmicMedia to an "AI-generated" label and the editing case to "AI-edited". The standard is governed by a steering committee of eleven members, including Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. TikTok joined the committee on 27 July 2026, per the consortium's own announcement.
The known weakness belongs in the picture: metadata can be stripped, and plenty of processing pipelines strip it automatically on upload or resize. Google explicitly reminds publishers and merchants not to strip metadata from images. For you that means relying on metadata for traceability and never for the visible disclosure your customers see.
What the platforms label on their own
Platforms are moving faster here than legislators, and they are not moving in the same way. The state of play on 4 November 2026, each checked on the vendor's own pages:
- Google introduced an AI label setting for ads in July 2026, rolling out gradually across Google Ads, Display & Video 360, Campaign Manager 360, Merchant Center and Ads Editor. It lets you place a text or visual AI label inside image and video creatives. Google states itself that using the setting does not guarantee compliance with any specific regulation. Images and videos generated inside Google Ads tools carry C2PA data, and outputs of Google's own generative tools additionally carry the invisible SynthID signal. Election ads follow a separate route: an "Altered or synthetic content" checkbox in campaign settings, plus a prominent in-ad disclosure for some formats. Trivial edits such as cropping or colour correction are excluded.
- Meta labels images from its own tools visibly and embeds invisible watermarks and metadata in the files. For third-party images it is building out detection of the C2PA and IPTC origin signals so it can label material from tools by Google, OpenAI, Microsoft, Adobe, Midjourney and Shutterstock automatically.
- TikTok applies its label automatically when a video was made with its own AI effects or arrives carrying Content Credentials, and says it was the first video platform to read them. The label only shows up when the information is actually present in the file.
- Pinterest labels images on the basis of the IPTC field.
The pattern is the real story: platforms read both standards and apply labels themselves. Your remaining choice is whether the label suits your creative, or whether an automatic overlay surprises you in exactly the corner where the price sits.
Your own channels: email, web, paid
In your own channels there is no platform labeling anything for you. Three places are worth the effort.
Email. A label belongs in the image, not in the metadata. Mail clients do not render Content Credentials, and plenty of recipients never load images at all. If you send generated visuals regularly, put the label into the image template once rather than into each campaign. Have the alt text name the origin too, so the information survives with images switched off.
Web and blog. This is where labeling can be automated. Our own blog images are an example: every hero in this series is a generated 3D illustration, and the export applies the same badge the app does. A dark pill reading "AI GENERATED", a little over five percent of the shorter edge in height, inset from one corner. The label is produced by the script, not by the reviewer, so it cannot be forgotten. The alt text opens with "AI-generated 3D illustration", as it does on this post.
Paid. Here the constraint is layout. If the platform can place a label, plan for the corner it lands in. A label you place yourself has the advantage that you control its size, position and contrast.
Six rules that survive contact with a team
- Separate generation from editing. A generated visual and a retouched photo take different metadata values and often deserve different sign-off.
- People and real events are the hard line. The moment a person or an actual event is shown inauthentically, you need a visible notice, not just a field in a file.
- Label in the image, provenance in the metadata. Two jobs, two tools. Neither substitutes for the other.
- Automate the label at export. Any disclosure that depends on somebody remembering will eventually be missing.
- Audit your pipeline. If your image server strips metadata, the provenance chain is gone at the end even though the tool wrote it.
- Write it down once. Two paragraphs in the marketing policy are enough: which cases get a visible label, who writes the alt text, who signs off.
What you need for this
Disclosure is a sign-off problem in the end, and sign-off needs visibility. Creative shows you the visuals and mechanics actually running in the market, and the Campaign Planner ties sign-off to the date the visual is meant to go out. If you would rather do the checking from your own AI client, connect Reyo MCP to your account and work on the data directly; the MCP guide covers the setup. What we do with your data and what we do not is on our trust page.
One note on our own data, because it belongs to a piece about transparency: we see what was sent, not how it performed. And we do not name the shops, because this is about the patterns, not the senders.
If you want more of the technical side: AI marketing agents shows where an agent genuinely takes work off a team in flows like this, Claude for marketing covers getting brand voice and style guide into the client as context, and what is an MCP server explains the plumbing behind the connection.
Last reviewed 4 November 2026. Not legal advice. The statements about C2PA, IPTC, Google, Meta, TikTok and Pinterest were checked that day on each vendor's own pages, and the legal points in the European Commission's publications. Verify the current state before you turn any of it into a rule for your team.