AI Image Disclosure Laws in 2026: A Brand's Compliance Guide
Prateek Gupte
Updated October 28, 2026. All four regimes in this guide are now live. This update adds the EU’s final Article 50 guidelines and Code of Practice, the Digital Omnibus outcome, and the current penalty figures.
Yes. In 2026 most brands using AI-generated imagery in advertising have to disclose it, and every rule in this guide is now in force. New York’s synthetic performer law took effect June 9. The EU AI Act’s labelling rules have applied since August 2. California’s AI Transparency Act started the same day. The FTC has always been able to treat a misleading AI ad as a deceptive practice. If an AI-generated person appears in your ad, label it.
The rules differ by jurisdiction. They treat a generated model and a real person’s likeness differently. And none of them prescribes the exact wording of the label. This guide maps the four regimes that matter for ecommerce and fashion brands, shows where disclosure applies (ads, yes; product pages, it depends), and covers how to label AI images without your creative looking like a warning sticker.
Key Takeaways
New York is live. N.Y. Gen. Bus. Law § 396-b has required conspicuous disclosure of AI “synthetic performers” in ads since June 9, 2026. The penalty is $1,000 for a first violation and $5,000 for each one after.
The EU AI Act applies now. Since August 2, 2026, Article 50 has required anyone who publishes a realistic AI image that could pass as authentic (a “deep fake”) to label it visibly. Metadata alone does not count. The Digital Omnibus did not delay this.
The EU’s final guidance is broad. The Commission’s guidelines say a deep fake does not have to show a real person. A photoreal AI model wearing your product can qualify.
The FTC is the US backstop. Misleading AI in ads can be a deceptive practice under Section 5. Civil penalties are up to $53,088 per violation where they apply, an amount unchanged for 2026.
A generated model is not a digital twin. Using a real person’s AI likeness brings in consent and right-of-publicity law as well as labelling.
When Maya, who runs marketing for a mid-market apparel brand, moved her fall campaign to AI-generated models, her first instinct was to say nothing. Her agency disagreed. They added one line, “Models in this campaign were created with AI,” to the paid social creative. The campaign performed fine. There was no complaint, no scramble when New York’s law took effect, and no awkward call with legal when the EU rules followed in August. The disclosure cost one line of copy.
Do You Actually Have to Disclose AI-Generated Images?
In most advertising contexts in 2026, yes. The clearest trigger: if an AI-generated person appears in a commercial ad, disclose it. That covers AI fashion models, synthetic spokespeople, and AI influencers in paid placements.
Light editing generally falls below the line. Removing a background, correcting color, or relighting a real photo leaves a real product and real people in the picture, and the EU guidelines treat standard editing as an assistive function. A fully AI-generated scene with an AI model is clearly above the line. The practical rule: disclose when AI created or substantially changed what the viewer sees, especially a person.
Three questions sort almost any image:
Is it an advertisement? Paid social, display, and video ads are in scope. Organic product pages are a softer case.
Does it show an AI-generated person, or a realistic AI scene that could pass as a real photo? A generated person is the highest-risk element in every regime here.
Does it reach a regulated market? New York and the EU apply to any brand whose content reaches their consumers, wherever the brand is based.
If the answer to all three is yes, disclose. For the rights and ethics behind this, see our complete legal and ethical guide to AI fashion imagery.
The Four AI Image Disclosure Laws That Matter in 2026
Four regimes shape what brands must do:
NY § 396-b: AI synthetic performers in ads reaching New York consumers. In effect since June 9, 2026. $1,000 first violation, $5,000 after.
EU AI Act, Article 50: labelling of AI deep fakes published in the EU, plus machine-readable marking by AI tools. Applies since August 2, 2026. Fines up to €15 million or 3% of worldwide turnover.
California SB 942: generative AI tools with over 1 million monthly users. Operative since August 2, 2026. $5,000 per violation, per day.
FTC Act, Section 5: deceptive AI in US advertising. Always on. Civil penalties up to $53,088 per violation where they apply.
New York: the Synthetic Performer Disclosure Law
N.Y. General Business Law § 396-b (bills S8420A / A8887B) has been in effect since June 9, 2026. If you know a commercial ad includes an AI-generated “synthetic performer,” you must disclose it conspicuously. A synthetic performer is a digital figure created by generative AI that gives the impression of a human performance and is not recognizable as any identifiable real person.
Penalties are $1,000 for a first violation and $5,000 for each one after. The statute doesn’t say whether a violation is counted per ad, per placement, or per campaign. There is no private right of action, so enforcement falls to the New York Attorney General. As of this update there are no reported enforcement actions and no AG guidance, so “conspicuous” is still undefined. Use the FTC’s “clear and conspicuous” standard as your benchmark. The law exempts audio-only ads, AI used only for translation, ads for films, TV, and games that match how the work uses AI, and media outlets that just run someone else’s ad. Our explainer on New York’s AI disclosure law covers the details.
The EU AI Act: Article 50 transparency
Article 50 has applied since August 2, 2026. It has two parts that matter to brands:
Providers mark. Generative AI tools must mark their outputs in a machine-readable way, using metadata, watermarks, or both. Tools already on the EU market before August 2 have until December 2, 2026 to comply. That grace period came from the Digital Omnibus, adopted in summer 2026. It is the only part of Article 50 the Omnibus delayed.
Deployers label. Whoever uses an AI system to publish a deep fake must disclose it clearly, at the latest on first exposure, in a way people can see without special tools. If your brand creates the image, your brand is the deployer. Using a freelancer or contractor to operate the tool doesn’t change that.
Two developments since our June version matter most.
First, the Commission published its final Code of Practice on marking and labelling AI-generated content on June 10, 2026. It is voluntary, but it is the clearest guide to what a compliant marking and labelling setup looks like.
Second, the Commission’s Article 50 guidelines, adopted in July, read “deep fake” broadly. A deep fake is AI content that resembles existing people, objects, places, or events and would falsely appear authentic. The guidelines say the subject only has to be something that could plausibly exist. A photoreal AI model wearing your real product, shot in a believable setting, can therefore meet the definition even though the model is not a real person. Background scenes and standard post-production are unlikely to qualify on their own.
Some other practical points from the guidance:
Metadata is not enough. The provider’s machine-readable mark does not satisfy your duty as a deployer. You need a visible label.
Creative work gets lighter labelling, not an exemption. For clearly artistic or fictional work, you can disclose in a less intrusive way, for example in credits, but you still disclose.
No retroactive duty. Content published before August 2, 2026 doesn’t have to be relabelled, though the Commission encourages it.
Penalties. Breaching Article 50 can cost up to €15 million or 3% of worldwide annual turnover, with proportionality for SMEs. National market surveillance authorities enforce it.
The full text is in Article 50 of the EU AI Act.
California: the AI Transparency Act (SB 942)
California’s AI Transparency Act has been operative since August 2, 2026. AB 853 moved the start from January to line up with the EU. The law applies to the tools rather than to brands directly. Generative AI providers with more than one million monthly users in California must offer a visible disclosure, a hidden “latent” one (metadata or watermark recording the provider, system, timestamp, and a unique ID), and a free public detection tool. Penalties are $5,000 per violation, and each day counts as a separate violation. AB 853 extends duties to large online platforms from January 1, 2027.
It matters to brands because it decides what provenance data comes with the images you generate. That data is your proof of origin under the EU and FTC regimes, so choose tools that produce it.
The FTC: the federal backstop
There is no single federal AI disclosure statute. Under Section 5 of the FTC Act and the Endorsement Guides, an ad that misleads people about AI can still be a deceptive practice. AI testimonials, fabricated before-and-after results, and synthetic influencers presented as real people are the highest-risk uses. The FTC’s rule on fake reviews and testimonials explicitly covers AI-generated reviews.
On money: the FTC’s maximum civil penalty is $53,088 per violation, and the agency kept it unchanged for 2026. Civil penalties mostly apply when a rule (such as the fake-reviews rule) or an existing order is violated. A first-time Section 5 case usually ends in a consent order, not a fine. The bigger cost is the investigation, the order, and the reputational damage. The FTC’s AI guidance hub is the canonical source.
A note on federal preemption. A December 2025 executive order set up a Justice Department task force to challenge state AI laws. As of this update, no court or federal statute has displaced New York’s or California’s disclosure rules, and Congress has not passed preemption. Plan on the state laws staying in force.
Not sure your current creative would pass? Start by auditing every ad running in New York and the EU. If you want output built to be disclosed cleanly, see how Caimera handles rights and provenance.
Synthetic Performers vs. Digital Twins: Two Different Rulebooks
A synthetic performer is a generated person who is not a real, identifiable individual: an AI fashion model that exists only as pixels. New York’s § 396-b is built for exactly this case. Under the EU’s broad reading of “deep fake,” a photoreal synthetic performer used in an ad should be labelled there too.
A digital twin is an AI recreation of a specific real person. Once a real, identifiable likeness is involved, labelling isn’t enough. Right-of-publicity and digital-replica law apply, and they turn on consent and licensing. You generally need the person’s written permission before you generate or run their likeness. In the EU you still label the result as well.
The cleanest path is to use generated models for scale and keep digital twins for talent you have licensed. Caimera supports both: AI fashion models from a curated model library, plus Enterprise digital twins with the rights handled. Never generate a real person’s likeness without consent.
Where Disclosure Applies: Ads, Product Pages, and Social
Paid social and display ads are the clearest case. Instagram, Facebook, TikTok, and Pinterest placements with an AI-generated person need disclosure under New York’s law and labelling under the EU AI Act.
Organic product pages are the grey area in the US. New York’s law covers advertisements, and a standard product page may not count as one, though a promotional page could be read either way. The EU rule is broader: it applies to deep fakes you publish, not only to ads. If you sell into the EU, assume a realistic AI model on a product page needs a label.
You are responsible for your agency’s work. If a partner makes an undisclosed AI choice in your campaign, your brand still carries the risk. EU guidance expects you to secure labelling through contracts with distribution partners. Update vendor contracts to require disclosure.
How to Disclose AI Images Without Killing Your Creative
These are the mechanisms that work across all four regimes. Use the visible ones for people and the invisible ones for audit:
A visible label or caption. A short line like “Created with AI” or “AI-generated model” near the creative, where people see it on first view. This is what New York and the EU deployer duty require.
Alt text and product-description tags. An “AI-generated image” note that also helps accessibility and SEO. Treat it as a supplement to a visible label on ads, not a replacement.
Embedded metadata. A field such as ai_generated=true. Shoppers never see it, but platforms and auditors can read it. It is the basis of the EU’s machine-readable marking requirement.
C2PA / Content Credentials. Cryptographic provenance that travels with the file. It is becoming the standard way to prove origin at scale, and the EU Code of Practice expects a layered approach like this.
A persistent watermark. A small “AI” mark in a corner, useful for video and high-visibility placements.
For most brands the best combination is a visible caption on ads and on realistic AI imagery, plus embedded metadata on everything. The caption covers New York, the FTC, and the EU deployer duty. The metadata covers marking and gives you an audit trail.
Want disclosure-ready assets out of the box? Enterprise plans include legal indemnification for AI content, which is often what gets legal and procurement to yes.
Platform Rules Often Bite Before the Law Does
The platforms where your creative runs have their own AI disclosure policies, and they often act faster than regulators:
Meta (Instagram and Facebook) applies “AI info” labels and asks advertisers to disclose AI-generated or altered imagery in certain contexts.
TikTok auto-labels AI-generated content and requires creators to flag realistic AI media.
Pinterest labels AI-generated Pins and uses metadata signals to detect them.
Amazon has tightened its stance on AI imagery in listings, especially main images.
Shopify allows AI-generated product imagery and relies on disclosure and accuracy rather than prohibition.
Platforms read the same metadata that California and the EU now require tools to embed, so expect more automatic labelling. If you build disclosure into your workflow once, you satisfy the platforms and the law together.
Turn Compliance Into a Trust Advantage
Disclosure is not only about managing risk. In a Yahoo and Publicis Media study, adding an AI disclosure label was associated with higher consumer trust, not lower. Most shoppers say AI makes it hard to know what is real, and most already assume brands use AI in their ads. Saying nothing looks like hiding. A clear, on-brand label looks confident.
The brands doing this well treat the label as a values statement. It’s the same instinct behind keeping AI output on-brand instead of shipping slop. For the opposite case, what happens when a platform loses trust, read our Higgsfield case study.
Your AI Disclosure Checklist (Updated for Q4 2026)
Audit live creative running in New York, the EU, and California for AI-generated people and realistic AI scenes.
Set one disclosure standard: a visible caption on ads and realistic AI imagery, and embedded metadata on everything.
Label EU product pages too wherever a photoreal AI model could pass as a real photo.
Separate synthetic performers from digital twins, and get written consent for any real likeness.
Update agency and vendor contracts to require AI disclosure, and to keep labels intact across distribution partners.
Confirm your tools’ marking. Check that each AI tool you use will meet the EU’s December 2, 2026 machine-readable deadline and California’s latent-disclosure rules.
Write your label wording and have a lawyer approve it.
Frequently Asked Questions
Do I have to disclose AI-generated images on my website?
For advertising, yes in New York, and yes across the EU for any realistic AI image that could pass as authentic. In the US, organic product pages are a grey area because New York’s law covers advertisements. In the EU, the labelling duty covers deep fakes you publish anywhere, so a photoreal AI model on a product page should carry a label. Get legal advice on your specific pages.
What happens if I don’t disclose AI in my ads?
In New York, $1,000 for a first violation and $5,000 for each one after. In the EU, Article 50 breaches can reach €15 million or 3% of worldwide turnover. In the US, the FTC can treat misleading AI as a deceptive practice. Civil penalties of up to $53,088 per violation apply when a rule or order is broken, and first-time cases usually end in a consent order.
Did the EU delay the AI labelling rules?
No. The Digital Omnibus, adopted in summer 2026, delayed the high-risk AI rules. For Article 50 it gave one grace period only: AI providers whose tools were on the market before August 2, 2026 have until December 2, 2026 to add machine-readable marking. Brands’ duty to label deep fakes has applied since August 2, 2026.
Is an AI fashion model a deepfake?
Under New York’s law, no. An AI fashion model is a “synthetic performer,” and a recreation of a real person falls under separate digital-replica and right-of-publicity rules. Under the EU AI Act it can be. The Commission’s guidelines say a deep fake doesn’t have to show a real person, so a photoreal AI model that could pass as a real photo shoot can qualify and should be labelled.
Does AI background removal or color correction count?
Generally no. Standard edits to a real photo leave a real product and real people in the picture, and the EU treats standard editing as an assistive function. Disclose when AI creates or substantially changes what the viewer sees, especially a person.
What should an AI disclosure actually say?
None of these laws prescribes exact wording. Short, specific, and visible works best: “Created with AI” or “AI-generated model.” Show it where people see the image first, and use it consistently. A vague or buried label can fail New York’s “conspicuous” test and the EU’s first-exposure requirement.
The Bottom Line
In 2026 AI image disclosure stopped being a future problem. New York went live in June. The EU AI Act and California followed in August, and the EU’s final guidelines read “deep fake” broadly enough to cover photoreal AI models. The FTC remains the backstop in the US.
The fix is simple. Set one disclosure standard, separate generated models from licensed digital twins, update your vendor contracts, and use tools that embed provenance metadata. A clear AI label also tends to build trust, so treat it as a statement rather than a warning.
This guide is general information, not legal advice. AI disclosure rules are still changing, so confirm the current rules with qualified counsel before you publish. Last reviewed October 28, 2026.
Ready to produce on-brand AI imagery that is built to be disclosed? Start free with 20 credits, compare plans, or talk to our team about Enterprise indemnification.
