Who has to label AI content: you, your agency or the platform?

AI content usually passes through three pairs of hands before a customer sees it: a business that wants an image, video or text, an agency or freelancer that makes it, and a platform that shows it. When a rule says "label it", each of the three can point at another. This guide sets out whom each rule actually names, using the rule texts and the European Commission's Guidelines on Article 50 of the AI Act (C(2026) 5054 final, July 20, 2026).

It is general information, not legal advice, and we checked every source on October 21 and 22, 2026. The Guidelines are non-binding (paragraph 5); only the Court of Justice of the EU interprets the Act. To see which rules reach your content at all, start from our AI disclosure laws finder, or try the reading aid for the Commission's worked examples, and read the page on Article 50 of the EU AI Act.

The EU test: provider, deployer and everyone else

Article 50 puts its duties on two roles. The Guidelines describe a provider in paragraph 10 as a person or body that develops an AI system, or has it developed, and places it on the market or puts it into service "under their own name or trademark". The provider owes Article 50(1), telling people they are dealing with an AI, and Article 50(2), marking the system's output in a machine-readable way. Paragraph 11 gives the example: a company that offers a chatbot or an image generator to others under its own name is the provider, including when its customers use the system without modifying it.

A deployer is different. Paragraph 12 defines it as a person or body "using AI systems under their authority" for something other than a personal, non-professional activity. The same paragraph explains authority: it means "assuming responsibility over the decision to deploy the system and over the manner of the actual use of the system (including its outputs)". It "does not necessarily require technical control over the operation of the AI system, so long as the deployer takes the decision for what purposes and how to use the AI system". The deployer owes Article 50(3) and 50(4): the label on a deep fake and the label on AI-written text published to inform the public on matters of public interest.

A deployer outside the EU is bound where it foresees the content being used in the EU, "including by posting deep fakes on the globally accessible internet" (paragraph 13). Purely personal, non-professional use is excluded (paragraph 19). Our page on Article 50 covers the dates, the fines and the exceptions.

When an agency makes it and a client publishes it

Paragraph 14 is the closest the Commission comes to the agency question. It says that "a company that merely commissions an advertising agency to produce an advertisement, without taking decisions and exercising control over whether and how the advertising agency uses AI in the production process, is not a deployer". It also says that "a legal person remains a deployer even if it involves third parties (e.g. contractors, freelancers) in the operation of the system on its behalf and under its responsibility and control". And its example of a deployer is a company in a third country that "uses an AI system to generate a deep fake of a celebrity featured in an advertisement displayed in the Union".

Read together, the test is who takes the decision to use the AI and controls how. The employees of a deployer are not separate deployers (paragraph 14), so the person at the agency who pressed the button is not the one the rule names; the agency, as a legal person, is. The table applies that test to three common set-ups. It is our reading: the Guidelines give no example with exactly these facts.

The Guidelines mention contracts once in this context. Paragraph 12 says deployers in complex content chains should take proportionate measures to make sure their label is displayed clearly at first exposure, for example via "contractual conditions with distributing partners". That is a way to make the label arrive. We found no passage saying a contract changes who counts as the deployer, but a contract can still do useful work, as the checklist below shows.

What a platform does and does not do

On the EU side the answer is short. Paragraph 16 says that providers of hosting services, including online platforms, and broadcasters, "whose role is limited to disseminating or transmitting AI-generated or manipulated content created by third parties" are "not deployers within the meaning of the AI Act". The Commission still says they are "strongly encouraged" to preserve the marking and labeling, and the paragraph leaves their duties under the Digital Services Act untouched. A platform is therefore not the party the AI Act asks to label your content. It is a party whose rules and whose own labels you will meet.

Platform rules are contract terms, not law, and they ask the account that uploads. The table lists what we read on each platform's own pages.

Amazon is missing from the table on purpose. CNBC reported on July 23, 2026 that Amazon told sellers to add the XMP keyword contains-synthetic-performer to listing and A+ images of photorealistic people created entirely by AI. We could not read Amazon's own rule text, which needs a Seller Central login, and whether older images must be tagged is unresolved, so we do not say it is required. Our page on platform AI disclosure rules keeps the detail, and our guide to AI image metadata explains what survives a platform's image processing.

A platform's toggle or tag tells the platform something; it does not make the platform the one who labels your ad for the audience. A label the platform adds from its own signals is outside your control, so check each placement as a viewer sees it.

United States: who the statutes name

US AI disclosure statutes are written around the party that creates the content, not the one that hosts it. The table sets out the words each one uses.

The FTC's rule on fake reviews names a "business", and the FTC's own answers say advertising agencies, public relations firms and review brokers "are not immune from liability under the rule". That rule is about false reviews, not about labels; our guide to AI-generated reviews covers it. For the New York and California ad statutes, read our guide to synthetic performer ads, and for listing photos, virtual staging disclosure.

A division of work that holds up

This is our suggestion for a brief or a statement of work, not a legal safe harbor. It works whichever party the law ends up naming, because it makes each step someone's named job.

1. Name who decides whether and how AI is used. That is the fact paragraphs 12 and 14 turn on, so write it down, with the person's role.
2. Require the agency to say when AI was used. For each asset: which tool, and whether a person, place, product or event in it is synthetic or altered. Without that, the client cannot tell which assets need a label.
3. Assign the label. Say who writes it, who places it on each channel, and who checks the result as a viewer sees it, including on mobile, in zoom views and after a platform resizes the image. Our accessible AI label generator writes label text with its text equivalent.
4. Assign the platform settings. Toggles such as TikTok's and Google's label setting belong to the account that runs the ad.
5. Keep the markers. Do not strip C2PA or IPTC data from files you pass on. The Commission's Code of Practice asks signatories to preserve markings, and China's labeling measures forbid maliciously removing or altering them.
6. Keep a record. Paragraph 148 expects businesses that have not signed the Code to be able to show how they meet Article 50, for example with a gap analysis against the Code. A dated note of each decision is the raw material.
7. Check the audience, not only the file. A label that exists in the source and not on the page the customer sees has not done its job. The free AI label checker reads label wording on a live page.