The EU AI Act and generated images

Since 2 August 2026 the EU AI Act’s transparency obligations apply. For an online store using generated product imagery, the practical question is narrow: what has to be marked, in what form, and who is responsible for doing it.

Two obligations, on two different parties

Article 50 splits the duty. Providers of AI systems that generate synthetic image, audio, video or text must mark the output in a machine-readable format, so that it is detectable as artificially generated or manipulated. That is the obligation of whoever builds and offers the generation system: the model provider or the platform, not the merchant.

Deployers, which is you when you generate images for your own catalogue, carry a disclosure duty in narrower circumstances. It applies chiefly where the content is a deep fake, meaning it resembles real people, objects, places or events and would falsely appear authentic. There, the fact that the content is artificially generated or manipulated has to be disclosed.

What "machine-readable marking" means in a file

The Act asks for marking that is effective, interoperable, robust and reliable as far as is technically feasible, and names the kinds of technique rather than mandating one. In practice, three things travel with an image:

• C2PA Content Credentials, a signed provenance manifest embedded in the file, recording that it was generated and by what. It is the closest thing the industry has to a standard.
• IPTC metadata, in particular the Digital Source Type field set to a value such as trained algorithmic media, which is what most stock and publishing pipelines read.
• Invisible watermarking, a signal carried in the pixels themselves, which survives re-encoding and cropping better than metadata does.

They are complementary rather than alternatives. Metadata is precise and easily stripped; a pixel watermark is durable and carries less. Serious pipelines write both, and keep their own record of what was generated when.

Where the line sits for product photography

Not every use of a model triggers a disclosure duty. The Act carves out AI used in an assistive way that does not substantially alter the input data or its semantics. Correcting the lighting on a photograph of your own product, removing its background, or sharpening it does not change what the product is. Placing that product in a kitchen it was never in, or generating a person using it, is a different act.

What it means for a Merchant Center feed

Nothing in the marking requirement conflicts with Google’s image rules. Google prohibits visible watermarks, overlays and text on product images; the Act asks for marking that is machine-readable and invisible. The two sit in different places in the file.

The requirement that does bite is the older one: the main image has to show the product as it actually is. A generated image that flatters a product beyond what arrives in the box is a misrepresentation under advertising law and platform policy alike, and marking it as AI-generated does not cure that.

A workable position

1. Use generation for the scene and photography for the product, so the item shown is the item sold.
2. Keep provenance marking intact end to end. Check that your image pipeline and CDN do not strip metadata on resize. Many do, without warning.
3. Record what was generated, from what source, with which tool and when. If a question is ever asked, that record is the answer.
4. Disclose visibly where content could read as authentic: a generated person, a generated place, a scene a buyer would take for a photograph.
5. Keep the source files. They are what prove the product in the picture is the product on the shelf.