AI Content Labeling Rules Arrive December 2026: What Marketing and Comms Teams Must Do

If you skimmed the coverage of the EU's Digital Omnibus package this spring, you probably came away thinking the AI Act got kicked down the road. That was mostly true. The high-risk obligations that had product and legal teams sweating moved out by more than a year. But the transparency and labeling rules barely moved, and they happen to be the rules that land on marketing and communications teams. Chatbot disclosure duties still take effect on August 2, 2026. The machine-readable marking requirement for AI-generated content got a grace period of exactly four months, to December 2, 2026, and per Gibson Dunn's analysis of the omnibus agreement, that grace period only covers systems already on the market before August 2026. If your team ships AI-generated content into Europe, the runway is measured in months.

The omnibus moved almost everything except labeling

Quick recap of where things stand. EU legislators reached political agreement on the omnibus changes to the AI Act in May 2026. The headline moves, as the Gibson Dunn alert lays out, were deferrals: compliance deadlines for stand-alone high-risk systems under Annex III shifted from August 2, 2026 to December 2, 2027, and AI embedded in regulated products moved to August 2028.

Article 50, the transparency article, stayed on schedule. Its obligations apply from August 2, 2026. The one concession was on Article 50(2), the requirement that providers mark AI-generated content in a machine-readable way. Systems placed on the market before August 2, 2026 get until December 2, 2026 to comply with marking. Anything launched after that date has to comply from day one.

So the labeling timeline now reads like this. On August 2, 2026, people must be told when they're interacting with an AI system, deployers must disclose deepfakes and certain AI-written text, and newly launched generative systems must mark their output. On December 2, 2026, the marking requirement catches up with every generative system already in use, which covers most of the tools your marketing team licensed in 2024 and 2025.

We published a breakdown of what Article 50 requires B2B SaaS companies to disclose before the omnibus was agreed, plus an overview of what the Digital Omnibus changes for mid-size companies. The substance of both still holds. Read the dates in this post as the current ones. And I keep hearing "the AI Act got delayed" in planning meetings, so it's worth saying plainly that for content teams, it didn't.

Who has to label what

The text of Article 50 splits obligations by role. Providers build or sell the AI system. Deployers use it under their own authority. A marketing team using Midjourney, Runway, or an LLM to produce content is a deployer. The tool vendor is the provider. If your company also ships a generative feature inside its own product, congratulations, you're a provider for that feature and you carry both sets of duties.

Four obligations matter for content teams:

• Interactive AI must identify itself. Chatbots, voice agents, and anything else a person converses with must be designed so people know they're dealing with AI, unless that's already obvious to a reasonably well-informed person. The duty sits with providers, but deployers inherit the practical work of making sure the disclosure actually appears in their implementation.
• Synthetic content must carry machine-readable marking. Providers of systems that generate audio, images, video, or text must mark outputs so they're detectable as artificially generated. This is the piece with the December 2, 2026 date for existing systems.
• Deepfakes must be visibly disclosed. Deployers who publish AI-generated or AI-manipulated image, audio, or video that could pass as authentic must say so. That duty attaches to whoever publishes, meaning your team, not your tool vendor.
• Certain AI-written text must be labeled. Deployers who publish AI-generated text with the purpose of informing the public on matters of public interest must disclose it, unless the text went through human editorial review with a person taking responsibility for it.

There's a fifth obligation covering emotion recognition and biometric categorization, which matters if you run sentiment scoring on customer calls, but for most marketing teams the four above are the whole exposure.

Where typical marketing work actually lands

The good news first. Most AI-assisted marketing copy comes out fine. The European Commission's draft transparency guidelines, which Covington's Global Policy Watch team summarized in May, carve out text that received genuine human editorial review, described as deliberate examination of the substance of the content. A skim and a thumbs-up doesn't qualify, but the normal flow of a marketer drafting with an LLM, rewriting, and taking ownership of the result does. The same guidelines exempt assistive editing entirely, so grammar correction, spellcheck, audio noise reduction, and minor color adjustments don't trigger marking.

Now the traps, because they sit closer to daily marketing work than most people assume.

• Photorealistic synthetic people. AI spokesperson videos, avatar presenters, staged customer photos, and testimonial-style clips with generated faces sit in deepfake territory. The guidelines define a deepfake by its effect, meaning content that would falsely appear authentic to a person, judged across a diverse audience. Your intent doesn't factor into it.
• Voice cloning. A cloned founder voice reading ad copy or a podcast intro is manipulated audio of a real person, and it needs a disclosure.
• Heavier edits than you'd expect. Per the same guidelines, AI translation, AI summarization, object removal, and face alteration all fall inside the marking rules. That includes localizing a campaign video into German with an AI dubbing tool.
• No commercial carve-out. There's a lighter regime for evidently artistic or satirical work, but the guidelines state it doesn't apply when content serves primarily an informative or commercial purpose. An ad is commercial by definition, so don't plan around that exemption.

Stylized content is generally lower risk. A cartoon illustration or an obviously synthetic 3D render isn't trying to pass as real, and the deepfake duty keys on authenticity. The closer your generated content gets to photoreal humans, real places, and real events, the harder the disclosure duties bite.

What compliant labeling looks like in practice

Compliance has two layers, and mixing them up causes most of the confusion I see.

The first layer is machine-readable marking, and it's mostly your vendors' job. Think provenance metadata such as C2PA content credentials, invisible watermarks of the SynthID variety, and fingerprinting. The Commission's draft guidelines acknowledge that no single marking technique currently meets all the requirements on its own, so providers are expected to layer several. Your job as a deployer is simpler and gets ignored anyway: don't destroy the marks. Image optimizers, CMS upload pipelines, resizing services, and re-encoding steps routinely strip metadata. Keep original files, ask each vendor what marking they embed, and check whether your publishing pipeline preserves it end to end.

The second layer is human-facing disclosure where the rules require it. The guidelines are specific about quality. Disclosures must be clear and distinguishable, delivered at first exposure, and persistent enough that someone who joins a video midway still sees them. A line buried in your terms of service explicitly fails the standard. In practice this looks like a chatbot whose first message says you're chatting with an AI assistant, a visible "generated with AI" note on and alongside synthetic video, and a spoken or on-screen disclosure at the start of a cloned-voice audio spot.

There's also help available. The Commission published its Code of Practice on marking and labelling of AI-generated content on June 10, 2026. It's voluntary, and signatories get a much clearer compliance story with regulators. The practical move for a deployer is to ask every generative vendor two questions: what machine-readable marking do you embed today, and are you signing the Code of Practice. Vendors that answer both well take a lot of work off your plate.

US companies are in scope more often than they think

The AI Act doesn't care where you're incorporated. Its scope provisions cover providers placing AI systems on the EU market, and they also cover providers and deployers located outside the EU whenever the system's output is used inside it. For published content, exposing an EU audience counts. A campaign targeted at EU prospects, a chatbot on a site that serves EU visitors, a synthetic launch video shown at a Munich trade fair, all of it puts a US company inside the rules.

The ceiling for transparency violations sits at 15 million euros or 3 percent of global annual turnover, whichever is higher, under the Act's penalty schedule (we broke down the full fine structure separately). I don't expect regulators to open with maximum fines over an unlabeled banner ad, and early enforcement will likely chase egregious deepfake cases. But complaint-driven enforcement is cheap for a competitor or an annoyed customer to trigger, and the major ad and social platforms already require AI-disclosure toggles that make non-disclosure easy to spot. Getting this right is mostly a checklist exercise, and getting it wrong is the kind of story the trade press loves to write up.

The Monday morning workflow: inventory, then a decision tree

Here's the exercise I'd run this month with any marketing or comms team shipping into Europe. We run a version of it with clients at FirmAdapt, and the inventory step alone usually surfaces two or three AI tools nobody remembers procuring.

Step one, build the inventory. One spreadsheet, every place AI-generated or AI-manipulated content ships. Website chat and voice agents. Paid social and display creative. Email programs. Blog and newsroom. Video, audio, and podcast content. Product UI copy. PR statements. Sales decks. Stock-style imagery in your asset library. For each row, capture the tool used, whether you're a provider or a deployer for it, the content type, whether it reaches EU audiences, whether the output is photoreal or stylized, whether a human meaningfully reviews it, and what label or marking it carries today.

Step two, run each row through a short decision tree.

1. Does a person interact with it live, as with chat or voice? Then disclose that it's AI at first contact, unless no reasonable person could mistake it for a human.
2. Is it audio, image, or video that AI generated or materially manipulated? Then confirm machine-readable marking survives your publishing pipeline. And if a reasonable viewer could take it as authentic, add a visible disclosure on the content itself.
3. Is it text published to inform the public on a matter of public interest, such as reports, market commentary, or news-style content? Then label it, unless a named person reviewed the substance and takes editorial responsibility.
4. Is it AI-assisted but human-owned work, like drafted-then-rewritten copy, grammar fixes, or light retouching? Then it sits outside the labeling rules. Keep provenance notes anyway, because proving an exemption is easier than arguing about it later.

Step three, make it stick. Add the tree to your campaign QA checklist. Record tool and provenance details in your DAM metadata fields. Name one owner, usually brand or comms ops. Then re-run the inventory quarterly, because the tool list you have in July won't match the one you have in November.

Dates to work backwards from

Between now and year end, two dates drive the plan. By August 2, 2026, interactive disclosures need to be live, and your deployer-side processes for deepfake and public-interest text disclosure need to exist. By December 2, 2026, machine-readable marking needs to be verified end to end, including for every generative tool you adopted before this summer, which is exactly where the omnibus grace period applies.

The actual work is an inventory, a handful of vendor emails, some disclosure copy, and one change to a QA checklist. Teams that do it in July will barely notice the December date. Teams that wait will be retrofitting labels onto a quarter's worth of holiday campaign assets in November, and that's a much worse week.