AI-Generated Product Images and the EU AI Act: What E-commerce Has to Disclose

Most of the writing about the EU AI Act is about chatbots and risk tiers, and almost none of it is about the thing that actually affects an e-commerce team: if you publish AI-generated images, you have to say so, and you have to say so in a way a machine can read.

This is a practical note on what that means for a product catalogue. It is not legal advice (get that from a lawyer who has read your specific setup), but the technical shape of the obligation is clear enough to act on.

The obligation, in plain terms

The AI Act's transparency provisions have applied since 2 August 2026. They require that synthetic image content is marked in a machine-readable format and detectable as artificially generated. The duty falls on providers of the generating system, and there are parallel disclosure duties on deployers who publish such content.

Two words carry the weight:

Machine-readable. A disclaimer in the page copy, an "AI-generated" badge in your CMS, or a note in the alt text does not satisfy this. Those are human-readable. The marking has to be something software can detect without reading English.

Detectable. It has to survive normal handling. An image gets uploaded to a marketplace, resized by a CDN, pulled into an affiliate feed and re-shared on social. A marking that only exists in your own database is not travelling with the file.

Together those point at one place: inside the image file itself.

Does human review exempt you?

This is the most common thing people half remember, and the exemption is real. It is just not the one you want.

The carve-out applies to text published to inform the public on matters of public interest, which is broadly journalism. Where that text has been through editorial control and a person holds editorial responsibility for it, the disclosure duty falls away.

It does not extend to images. The image, audio and video duty sits in its own provision, and its only exceptions are law enforcement use and evidently artistic, creative, satirical or fictional work, where disclosure is merely allowed to be done in a way that does not spoil the work. A packshot is none of those.

The machine-readable marking discussed here is also a duty on the provider of the generating system, not on you as the publisher, and it has no human-review exemption at all. Its one narrow relief is for systems performing an assistive editing function that does not substantially alter the input. Generating a new scene around a product is not that.

So reviewing an image before you publish it is good practice, and it matters for accuracy and for product-claims law. It is not a route out of labelling the file.

One genuine grey area is worth naming. Whether a given product image is a "deep fake" under the Act turns on whether it resembles existing objects or persons and would falsely appear authentic. For a plain packshot of a real product that is arguable in both directions. For an AI model wearing a real garment it is much less arguable. If your catalogue leans on the second kind, assume you are in scope.

What actually satisfies it

Two standards do this work in practice, and they complement rather than compete.

C2PA content credentials

C2PA (Coalition for Content Provenance and Authenticity) defines a cryptographically signed manifest embedded in the file. It records who produced the image and how: the "Content Credentials" pin you may have seen on published images.

The signature is the important part. It means:

• The claim about origin is attributable, not just asserted
• Any later edit breaks the seal, so a viewer can distinguish an untouched file from a tampered one
• Verification does not require trusting the publisher

A signed manifest is the strongest available answer to "prove this is what you say it is".

IPTC DigitalSourceType

IPTC is the metadata standard the photo industry already runs on, and it has a DigitalSourceType field. The relevant value for fully synthetic imagery is trainedAlgorithmicMedia.

This is the field newsrooms, stock libraries and an increasing number of marketplaces actually read. It is simpler than C2PA and not cryptographically signed, which is precisely why you want both. IPTC gets read by the widest range of tools; C2PA makes the claim provable.

What this means for a catalogue

Three things change operationally.

1. Labelling has to be automatic. A catalogue is thousands of images produced over months by several people. Any process that depends on someone remembering to tag an image will fail, and it will fail on exactly the image that gets audited. The labelling has to happen at export, by default, without a decision.

2. It has to survive your pipeline. Check what your image processing does to metadata. Many resizing and optimisation steps strip everything non-pixel by default, including your disclosure. An image that left your system correctly labelled can arrive at the customer stripped bare.

3. Marketplaces will check before regulators do. This is the practical pressure. Platform policies on AI-generated content are tightening faster than enforcement is ramping up, and a listing pulled for an unlabelled AI image costs you a week at the worst possible moment. The compliance case and the commercial case point the same way.

How to check your own files

You do not need to take a vendor's word for it.

• Content Credentials Verify (verify.contentauthenticity.org): drop an image in and see whether a manifest exists, whether the signature validates, and what it claims.
• exiftool: exiftool -DigitalSourceType image.jpg shows the IPTC field. Run it on an image that has been through your full pipeline, not one straight from the generator.
• Round-trip test: export an image, push it through your CDN and your marketplace feed, download what a customer would actually receive, and check that again. This is the test that finds the problem.

What Magnifiq does

Every export carries both markings by default:

• A signed C2PA manifest stating that Magnifiq produced the image
• The IPTC DigitalSourceType field set to trainedAlgorithmicMedia
• Written into JPEG, PNG and WebP without re-encoding a single pixel

That last detail matters more than it sounds. Adding metadata by decoding and re-encoding a JPEG loses quality every time. Writing into the container preserves the pixels exactly.

You can also strip everything for a clean export. It is a per-download choice, not a global setting, because occasionally a channel's own pipeline chokes on metadata it does not understand.

Magnifiq's C2PA conformance application was submitted in August 2026 as a Generator Product, Implementation Class Backend, Assurance Level 1, against Content Credentials 2.2, covering JPEG, PNG, WebP and AVIF.

One thing worth saying out loud

There is a version of this where disclosure is treated purely as a cost: a box to tick, minimally, hoping nobody looks.

The other reading is that provenance is about to become a feature. When a customer can verify that a product image came from the brand that sells the product, unlabelled imagery starts to look like the suspicious option rather than the neutral one. Brands that label properly and early get to point at that.

Either way the marking is cheap and automatic. There is no good reason to publish without it.

Quick checklist

• Every AI-generated image carries a signed C2PA manifest
• Every AI-generated image carries IPTC DigitalSourceType
• Your resize/optimise pipeline preserves both
• You have verified a file as the customer receives it, not as it left the generator
• Your marketplace listings comply with each platform's own AI-content policy
• Someone owns this. It is not "whoever exports the image remembers"