AI-Generated Product Images and the EU AI Act: What E-commerce Has to Disclose

Most of the writing about the EU AI Act is about chatbots and risk tiers, and almost none of it is about the thing that actually affects an e-commerce team: if you publish AI-generated images, you have to say so, sometimes to machines and sometimes to people.

This is a practical note on what that means for a product catalogue. It is not legal advice (get that from a lawyer who has read your specific setup), but the shape of the obligations is clear enough to act on.

Two duties, two audiences

The AI Act's transparency rules in Article 50 have applied since 2 August 2026. For images they contain two separate duties, and most confusion comes from mixing them up.

They do not substitute for each other. A perfect C2PA manifest does nothing for a shopper scrolling past your ad, and a visible badge is invisible to a platform's detection pipeline. Where both apply, you need both.

Who counts as the deployer

If your team decides to use AI imagery, sets the parameters and approves what gets published, you are a deployer. That holds whether the images are made in-house or by an agency. When an agency produces them for you, both of you are typically deployers, and the responsibility is shared. It cannot be written out of existence in a contract, so agree on who labels what at the briefing stage, not after launch.

The rules also reach beyond EU borders. If your images are aimed at people in the EU, they apply regardless of where your company is based.

When a product image needs a visible label

The visible label is required for deep fakes, and the Act's definition has two parts. An image is a deep fake when it:

1. resembles existing persons, objects, places or events, and
2. would falsely appear to a person to be authentic or truthful.

Nearly every photorealistic product image passes the first test. The second test is where the real decision sits: does the AI part change what the viewer believes about the product or the situation?

Usually needs a visible label:

• An AI-generated model wearing, holding or using your product. The synthetic person is doing the persuading, and a shopper will read them as a real person who really wore the garment
• A product shown in a place or situation that does not exist, presented as if it does
• An AI edit that changes what the product looks like or does

Usually does not:

• Colour correction, retouching, background removal and upscaling
• Resizing, cropping and recomposing a real product photo
• A generic AI background that says nothing about the product and that nobody would read as a factual claim
• Illustrations and clearly stylised graphics that do not look like photographs

There is a relief for evidently artistic, creative, satirical or fictional work, where the disclosure only has to be done in a way that does not spoil the work. A packshot or a campaign image for a real product is rarely that.

If you are unsure about a borderline image, label it. A visible label costs a few pixels in a corner. Getting it wrong can cost up to €15 million or 3% of worldwide annual turnover, and misleading-marketing rules apply on top of the AI Act anyway.

What a good visible label looks like

The European Commission's Code of Practice on marking and labelling AI-generated content describes how a label should behave. Following it is voluntary, but it is the clearest guide to what "clearly disclosed" means in practice:

• Visible at first exposure. The viewer sees it the moment they see the image, not after a click or a hover
• Part of the image itself. A caption below the image or a note in the alt text gets lost the moment the image is shared on its own
• Survives download and resharing. If someone saves the image and posts it elsewhere, the label goes with it
• Not covered by logos, price tags or other overlays
• Plain language that a normal person understands

Platform labels such as an "AI info" tag added by a social network do not discharge your duty. They are the platform's disclosure, not yours, and they disappear as soon as the image leaves that platform.

The EU AI icons

To make this easier, the Commission published an official set of AI icons in September 2026. The icon reads "AI" with a short text, and comes in two versions that map neatly onto product imagery:

• AI generated for images created by AI
• AI modified for real photos that AI has meaningfully altered

Each comes in black or white, solid or 50% transparent, so it stays legible on light and dark images. Using the official icons is optional, and a custom label is fine as long as it meets the criteria above. The advantage of the official one is that people will learn to recognise it.

What satisfies the machine-readable marking

This part is the tool's job, but you should know what to look for, because a tool that skips it leaves you publishing unmarked files. The marking has to be machine-readable (software can detect it without reading English) and robust (it travels with the file through normal handling). In practice that means metadata inside the image file, and two standards do this work.

C2PA content credentials

C2PA (Coalition for Content Provenance and Authenticity) defines a cryptographically signed manifest embedded in the file. It records who produced the image and how: the "Content Credentials" pin you may have seen on published images.

The signature is the important part. It means:

• The claim about origin is attributable, not just asserted
• Any later edit breaks the seal, so a viewer can distinguish an untouched file from a tampered one
• Verification does not require trusting the publisher

IPTC DigitalSourceType

IPTC is the metadata standard the photo industry already runs on, and it has a DigitalSourceType field. The relevant value for fully synthetic imagery is trainedAlgorithmicMedia.

This is the field newsrooms, stock libraries and an increasing number of marketplaces actually read. It is simpler than C2PA and not cryptographically signed, which is precisely why you want both. IPTC gets read by the widest range of tools; C2PA makes the claim provable.

Does human review exempt you?

This is the most common thing people half remember, and the exemption is real. It is just not the one you want.

The human-review carve-out applies to AI-generated text published to inform the public on matters of public interest. Where that text has been through editorial control and a person holds editorial responsibility for it, the disclosure duty falls away.

It does not extend to images. Reviewing an image before you publish it is good practice, and it matters for accuracy and for product-claims law, but it is not a route out of labelling a deep fake. The machine-readable marking has no human-review exemption either. Its one narrow relief is for tools performing an assistive editing function that does not substantially alter the input, and generating a new scene around a product is not that.

What this means for a catalogue

1. Labelling has to be automatic. A catalogue is thousands of images produced over months by several people. Any process that depends on someone remembering to tag an image will fail, and it will fail on exactly the image that gets audited. Both the marking and the label should happen at export, as part of the download.

2. It has to survive your pipeline. Many resizing and optimisation steps strip everything non-pixel by default, including your machine-readable marking. A visible label burned into the pixels survives that, but it can still be cropped away by an aggressive thumbnail crop. Check both on the image the customer actually receives.

3. Decide per image type, once. Write down which kinds of images in your catalogue get a visible label (on-model shots, lifestyle scenes) and which do not (retouched packshots), and why. A short documented policy makes every later decision fast and gives you something to show if anyone asks.

4. Marketplaces will check before regulators do. Platform policies on AI-generated content are tightening faster than enforcement is ramping up, and a listing pulled for an unlabelled AI image costs you a week at the worst possible moment. The compliance case and the commercial case point the same way.

How to check your own files

You do not need to take a vendor's word for it.

• Content Credentials Verify (verify.contentauthenticity.org): drop an image in and see whether a manifest exists, whether the signature validates, and what it claims.
• exiftool: exiftool -DigitalSourceType image.jpg shows the IPTC field. Run it on an image that has been through your full pipeline, not one straight from the generator.
• Round-trip test: export an image, push it through your CDN and your marketplace feed, download what a customer would actually receive, and check that the metadata and the visible label are both still there. This is the test that finds the problem.

What Magnifiq does

Magnifiq covers both duties in one download option, Content Credentials:

• A signed C2PA manifest stating that Magnifiq produced the image, signed with a certificate from a C2PA-trusted authority. Magnifiq is an approved C2PA Conforming Product
• The IPTC DigitalSourceType field set to trainedAlgorithmicMedia
• An optional visible EU AI label burned into the image, using the Commission's official icon. Magnifiq picks "AI generated" or "AI modified" from how the image was made, and you choose the corner. A plain "AI" icon is available if you add your own text label
• Works for JPEG, PNG, WebP and AVIF. Without the visible label, the metadata is written into the file without re-encoding a single pixel

The visible label is a separate tick inside that option, because whether an image needs one depends on what it shows. If a channel's own pipeline chokes on metadata it does not understand, you can still download a clean file and add the label yourself.

One thing worth saying out loud

There is a version of this where disclosure is treated purely as a cost: a box to tick, minimally, hoping nobody looks.

The other reading is that provenance is about to become a feature. When a customer can verify that a product image came from the brand that sells the product, unlabelled imagery starts to look like the suspicious option rather than the neutral one. Brands that label properly and early get to point at that.

Either way the labelling is cheap and automatic. There is no good reason to publish without it.

Quick checklist

• Every AI-generated image carries a signed C2PA manifest
• Every AI-generated image carries IPTC DigitalSourceType
• Realistic images that could pass as real (AI models, invented scenes) carry a visible label at first glance
• The visible label is in the image itself, not only in a caption or alt text
• Your resize/optimise pipeline preserves the metadata, and your crops keep the label
• You have verified a file as the customer receives it, not as it left the generator
• You and your agency have agreed in writing who labels what
• Your marketplace listings comply with each platform's own AI-content policy
• Someone owns this. It is not "whoever exports the image remembers"