Blab AI
EU AI Act Enforces Deepfake Disclosure; U.S. States Adopt Varied Rules
On 2 August 2026 the European Union’s AI Act became fully enforceable, and Article 50 of the regulation introduced the first mandatory disclosure requirements for AI‑generated or manipulated media. The EU AI Office, a new body within the European Commission, now has the authority to investigate non‑compliance and impose fines of up to €15 million or 3 % of a company’s worldwide annual turnover, whichever is higher.
Article 50 splits responsibilities between providers and deployers. Providers of generative AI systems must embed a machine‑readable watermark in every output so that downstream tools can detect synthetic content. Deployers—any organization that uses an AI system to produce or alter images, audio, or video—must provide a clear, visible disclosure to the first viewer that the content is AI‑generated or manipulated. The disclosure must appear no later than the first exposure and meet accessibility requirements. The regulation also requires that chatbots and voice agents identify themselves as AI when interacting directly with people.
The law defines a deepfake as any AI‑generated or AI‑manipulated image, audio, or video that resembles an existing person, object, place, entity, or event and could be mistaken for authentic or truthful content. The definition deliberately covers content that is realistic enough to be plausible, even if it depicts a fictional persona. The regulation exempts content that is clearly impossible under the laws of nature, such as a human flying without mechanical aid. A marketing team that created a fall campaign using an AI‑generated actor and voiceover was cited as an example of a deployer that could fall under Article 50. The campaign was realistic enough that legal review did not flag it as a deepfake, illustrating the practical challenges of compliance.
The EU’s approach mirrors the extraterritorial reach of the General Data Protection Regulation (GDPR). A company outside the EU can be held liable if its AI‑generated content is used by EU audiences, whether through a global digital campaign, an EU‑targeted social media buy, or an e‑commerce page showing AI‑generated product imagery.
In the United States, state governments have taken a patchwork approach. California’s AI Transparency Act (CAITA), signed in 2025, requires generative AI systems with more than one million monthly California users to provide a free AI‑content detection tool and embed latent metadata in altered media. CAITA also imposes a provenance‑display duty on large platforms. New York’s Synthetic Performer Disclosure Law, effective 9 June 2026, is the closest U.S. counterpart to Article 50. The law mandates a clear and conspicuous disclosure on any commercial advertisement that includes a synthetic performer not recognizable as a real person. Penalties are $1,000 for a first violation and $5,000 for subsequent violations. Other states have focused on personality rights rather than disclosure. Arkansas, Hawaii, Illinois, Montana, Tennessee, Virginia, and Washington have expanded right‑of‑publicity statutes to cover AI‑generated voice and likeness. Tennessee’s ELVIS Act creates a property right that individuals can enforce against unauthorized AI voice clones, while Washington’s amendment extends the remedy to forged digital likenesses.
On 11 December 2025, former President Trump signed an executive order directing federal agencies to challenge state AI laws that could burden interstate commerce. The order established an AI Litigation Task Force and asked the Department of Commerce to identify state laws that impose “truthful output” or disclosure duties. The Federal Trade Commission was instructed to assess conflicts with federal deceptive‑practices law.
The EU and U.S. regulatory landscapes illustrate divergent strategies. Brussels has built a comprehensive, multi‑layered framework that applies to both providers and deployers, while Washington has left much of the detail to state laboratories of democracy. Companies operating globally must navigate both sets of rules, ensuring that AI‑generated media is properly marked and disclosed in each jurisdiction.
As of now, enforcement in the EU is active, with the AI Office and national authorities empowered to issue fines. In the U.S., state laws remain in effect but vary widely in scope and penalties. The next few months will see whether additional federal guidance or new state legislation further clarifies the obligations for AI‑generated content.
Article 50 splits responsibilities between providers and deployers. Providers of generative AI systems must embed a machine‑readable watermark in every output so that downstream tools can detect synthetic content. Deployers—any organization that uses an AI system to produce or alter images, audio, or video—must provide a clear, visible disclosure to the first viewer that the content is AI‑generated or manipulated. The disclosure must appear no later than the first exposure and meet accessibility requirements. The regulation also requires that chatbots and voice agents identify themselves as AI when interacting directly with people.
The law defines a deepfake as any AI‑generated or AI‑manipulated image, audio, or video that resembles an existing person, object, place, entity, or event and could be mistaken for authentic or truthful content. The definition deliberately covers content that is realistic enough to be plausible, even if it depicts a fictional persona. The regulation exempts content that is clearly impossible under the laws of nature, such as a human flying without mechanical aid. A marketing team that created a fall campaign using an AI‑generated actor and voiceover was cited as an example of a deployer that could fall under Article 50. The campaign was realistic enough that legal review did not flag it as a deepfake, illustrating the practical challenges of compliance.
The EU’s approach mirrors the extraterritorial reach of the General Data Protection Regulation (GDPR). A company outside the EU can be held liable if its AI‑generated content is used by EU audiences, whether through a global digital campaign, an EU‑targeted social media buy, or an e‑commerce page showing AI‑generated product imagery.
In the United States, state governments have taken a patchwork approach. California’s AI Transparency Act (CAITA), signed in 2025, requires generative AI systems with more than one million monthly California users to provide a free AI‑content detection tool and embed latent metadata in altered media. CAITA also imposes a provenance‑display duty on large platforms. New York’s Synthetic Performer Disclosure Law, effective 9 June 2026, is the closest U.S. counterpart to Article 50. The law mandates a clear and conspicuous disclosure on any commercial advertisement that includes a synthetic performer not recognizable as a real person. Penalties are $1,000 for a first violation and $5,000 for subsequent violations. Other states have focused on personality rights rather than disclosure. Arkansas, Hawaii, Illinois, Montana, Tennessee, Virginia, and Washington have expanded right‑of‑publicity statutes to cover AI‑generated voice and likeness. Tennessee’s ELVIS Act creates a property right that individuals can enforce against unauthorized AI voice clones, while Washington’s amendment extends the remedy to forged digital likenesses.
On 11 December 2025, former President Trump signed an executive order directing federal agencies to challenge state AI laws that could burden interstate commerce. The order established an AI Litigation Task Force and asked the Department of Commerce to identify state laws that impose “truthful output” or disclosure duties. The Federal Trade Commission was instructed to assess conflicts with federal deceptive‑practices law.
The EU and U.S. regulatory landscapes illustrate divergent strategies. Brussels has built a comprehensive, multi‑layered framework that applies to both providers and deployers, while Washington has left much of the detail to state laboratories of democracy. Companies operating globally must navigate both sets of rules, ensuring that AI‑generated media is properly marked and disclosed in each jurisdiction.
As of now, enforcement in the EU is active, with the AI Office and national authorities empowered to issue fines. In the U.S., state laws remain in effect but vary widely in scope and penalties. The next few months will see whether additional federal guidance or new state legislation further clarifies the obligations for AI‑generated content.
