Now that the EU AI Act’s transparency obligations apply, the practical question companies ask is very specific: do I have to put “AI-generated” on my product images?
The short answer is that it depends on what was generated, and most articles on the topic do not help because they stop at a general summary of the rules without descending to the use case. This one tries the opposite.
A caveat first: this is a practical guide written from experience implementing it in projects, not legal advice. For decisions with regulatory impact, the interpretation should be validated by your legal team.
What the rules require, briefly
The transparency block of the Regulation rests on four ideas:
- If an AI interacts with people, those people must know, unless it is obvious from the context.
- Whoever provides a generative system must mark its outputs in a machine-readable format that allows detection that they are artificial.
- Whoever deploys the system must disclose when the generated or manipulated content may mislead, most notably where it depicts real people, places or events.
- There are exceptions for assistive or standard editing uses that do not substantially alter the original content.
Point 4 is the one almost never mentioned, and the one that changes the conclusions most in an ecommerce setting.
The case that matters most: product images
Applying the above to catalogue photography, three quite different situations emerge:
Replacing the background or relighting a real photo. The product is preserved pixel by pixel and what changes is the environment. It is functionally equivalent to studio retouching, which has been normal and accepted practice for decades. This is the case that fits best within the exception for editing that does not substantially alter the content.
Generating the whole scene including the product. Here the product shown is not exactly the one shipped. Beyond the transparency issue, there is a prior advertising issue: you are showing something you cannot deliver.
Generating models or people. The most delicate ground. If the image depicts a person who appears real, it falls squarely within the disclosure obligations, and it also intersects with image rights.
The operational conclusion we give in projects is the same one we already recommended for business reasons: do not generate the product, generate its context. That is the practice that best withstands both regulatory scrutiny and the returns rate. How it is implemented is in our AI product photography guide.
Chatbots and customer service agents
This is the easiest obligation to meet and one of the most frequently missed, almost always through careless design.
If a customer writes to your widget and an automated agent replies, they have to be able to know it is not a person. None of this requires an intimidating legal notice: it is enough that the name and presentation do not simulate a human and that the system clarifies it if asked.
The three errors we see:
- Giving the bot a person’s name and a person’s profile photo.
- Never indicating that it is automated, trusting that “it is obvious”.
- The agent, asked directly, failing to confirm it clearly.
The third is the most serious and the easiest to fix: it should be in the system instructions from day one. We cover it when building agents in how to create an AI agent with an LLM for customer service.
Marketing, social and editorial content
Illustrative and conceptual images. A clearly stylised illustration deceives nobody about its nature. The risk appears when the image is photorealistic and depicts a scene the viewer may take as real.
Text. Where content is published to inform the public on matters of public interest, disclosure duties apply, with relevant nuances where there is human review and someone assumes editorial responsibility. A corporate blog article reviewed and signed by a person is in a very different position from a feed published automatically without supervision.
Voice and video with people. The most restrictive case. If a real person is depicted saying or doing something, the disclosure obligation is clear, and there are image and voice rights the Regulation does not replace.
Platforms. Regardless of the European rules, the major social networks have their own synthetic content disclosure policies, with automatic labelling based on metadata. Complying with the law does not exempt you from the policies of the platform you publish on.
How labelling works in practice
There are three layers, and they complement each other:
1. Machine-readable marking. Metadata and embedded marks that let automated systems detect synthetic origin. This layer belongs mainly to the model provider, although your pipeline must avoid destroying it.
Here lies the most common and most silent technical error: image optimisation processes usually strip metadata. If your CDN or your compressor clears EXIF to save bytes, you are erasing exactly the signal that identifies provenance. It is worth checking, because nobody notices until someone asks.
2. Provenance and traceability. Content credential standards that record verifiably how a file was created and edited. This is the direction the industry is moving in, and adopting it early is easier than retrofitting later.
3. Visible disclosure. The notice the user sees. This layer belongs to whoever publishes, and it is the one requiring judgement: it must be clear and accessible without turning every product listing into a legal notice.
Who is responsible for what
A common source of confusion is assuming that if you use a third-party tool, compliance is theirs. It does not work that way:
- The provider of the generative system has obligations regarding technical marking of outputs.
- The company deploying it has its own disclosure duties towards its end users.
Your provider marking images correctly does not exempt you from disclosing when you publish content that may mislead. And conversely: a visible notice does not fix your pipeline having destroyed the metadata.
A practical checklist
For a company using generative AI on its site or product:
- Inventory. Where generative AI is used: catalogue, marketing, support, content.
- Classification by confusion risk. Could someone take this as real and make a decision accordingly?
- Chatbots identify themselves in their presentation and when asked directly.
- Metadata survives the image pipeline: check CDN, compressors and resizing.
- The product is never altered in catalogue images: not shape, not true colour, not packaging labelling.
- Visible disclosure wherever content could be mistaken for real material.
- Internal record of what content was generated, with which tool and who approved it.
- Legal review of edge cases, especially where people appear.
The second-to-last point is always underestimated and is the one that saves the day when a query arrives: without a record, six months later nobody remembers whether a specific image was generated or photographed.
What was already required before the Regulation
It is worth keeping in mind that misleading advertising was already prohibited long before generative models existed. Showing a product looking unlike what is delivered is a consumer law problem regardless of how the image was produced: with AI, with Photoshop or with a very skilled photographer.
For an ecommerce this is both reassuring and demanding. Reassuring because the underlying criterion has not changed. Demanding because it means “the AI did it” has never been a defence.
Conclusion
The right question is not “must I label my AI images?” but “can someone mistake this for something real and make a decision based on that confusion?”. Almost every practical case resolves under that criterion, and it coincides with the one consumer law already required.
For an ecommerce, the operating rule is simple and overlaps with what is already advisable commercially: generate the context, never the product; identify your automated agents; do not destroy metadata; and document what you generate.
The general picture of the Regulation and its timelines is in AI regulation in Europe. If you would like us to review your specific case — what content you generate and where you are exposed — tell us about your situation.