What the EU AI Act Means for AI-Generated Fashion Images

A retailer asked us three questions about publishing AI-generated product and on-model images on an EU store. Are the model images presumably classifiable as deepfakes, so the retailer, as deployer, has to disclose them? Will the provider supply an AI Act conformity document that states the data retention period and the processing location? Will the images carry the metadata the regulation expects? The answers below follow the regulation and the Commission pages. The customer stays anonymous.

What does Article 50 require when a fashion retailer publishes AI-generated images?

Regulation (EU) 2024/1689 sorts duties by use. Article 50(2) tells the provider of a system that generates synthetic images to mark outputs in a machine-readable format and to make them detectable as artificially generated or manipulated. The solution has to be effective, interoperable, robust, and reliable as far as technically feasible, given the content, the cost, and the state of the art. Article 50(4) tells the deployer, where the image is a deepfake, to disclose that fact. Article 50(5) says the information is clear and distinguishable at the latest at first exposure, and that it meets accessibility requirements. The Service Desk page for Article 50 states the same split.

Article 50(2) stops where the system assists standard editing, or does not substantially alter the input or its meaning. A color correction on a packshot and a newly generated on-model frame are different operations. Which side a tool sits on is a fact about the edit, then a question for counsel.

Are AI-generated model images deepfakes that a retailer must disclose on the e-commerce page?

A retailer asked us whether AI-generated model images are presumably classifiable as deepfakes, so the retailer, as deployer, would have to disclose them on the product page. The regulation uses a definition, and the disclosure follows when the content meets it. Article 3(60) defines a deep fake as AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful. Both parts have to be met.

An on-model image can resemble an existing object, because the garment, shoe, or bag is a real SKU. It can also present a person. A synthetic model is not a contracted model, and a face that does not depict a real individual is not that individual. Whether the frame resembles existing persons, and whether it would falsely appear authentic, are questions about the picture the shopper sees. Use of a generator does not settle them.

Where the content is a deepfake, Article 50(4) puts disclosure on the deployer, and Article 3(4) puts the retailer who publishes the image in that seat. The same paragraph narrows the duty for content that is part of an evidently artistic, creative, satirical, fictional, or analogous work: disclose that generated content exists, without hampering the work. A product page and a campaign film are different publications. This guide does not classify your frames. Counsel reads the images and the page together. Production is covered in the seasonal collections guide.

Who is the provider and who is the deployer when a retailer uses an image generation system?

Article 3(3) is the provider: the person who develops the system, or has it developed, and places it on the market under its own name. Article 3(4) is the deployer: the person using it under its authority, outside a personal activity. AIORA is the provider of the generation system. The retailer who publishes the images is the deployer. Marking is the provider's Article 50(2) duty. A visible deepfake disclosure is the deployer's Article 50(4) duty. The Commission guidelines of 20 July 2026 explain scope for both roles.

Will the AI provider supply an AI Act conformity document with data retention and processing location?

A retailer asked for an AI Act conformity document covering retention period and place of processing. That document is the EU declaration of conformity. Article 47 requires one for each high-risk system. Article 11 requires the technical documentation that goes with it. Article 16 places both among the duties of high-risk providers.

Classification is Article 6. Annex III, via Article 6(2), lists biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. Article 6(1) covers AI that is a product, or a safety component of a product, under Annex I, where that product requires a third-party conformity assessment. Generating a fashion product image is not one of those listed uses.

AIORA's position follows that list. The generation system is not a high-risk system, so the duties in front of a retailer are the Article 50 transparency duties. No EU declaration of conformity exists for an image generation tool like AIORA. Counsel should still test that classification against the actual use.

Retention period and processing location are questions under the GDPR, Regulation (EU) 2016/679. Article 4(1) defines personal data as information relating to an identified or identifiable natural person. AIORA's statement about a normal product run: product photos, product master data, and generated images with synthetic models, meaning models that are not real people, contain no personal data. A photograph of an identifiable person or account data sits outside that statement and goes through the privacy review. Article 50(6) leaves other Union and national transparency duties in place.

Will the images have the metadata Article 50 requires for compliance?

Article 50(2) requires a machine-readable mark and detectability. It does not name C2PA, EXIF, IPTC, or a visible watermark. A file can lose its metadata and still carry a mark in the image. The provider's job is that mark. The deployer's job, where Article 50(4) applies, is a disclosure a person can perceive.

The Code of Practice on Transparency of AI-generated Content is the voluntary text for Article 50(2), (4), and (5). Section 1 covers provider marking and detection. Section 2 covers deployer labelling of deepfakes and of certain AI-generated text. The 10 June 2026 announcement calls it the Code of Practice on marking and labelling of AI-generated content. Adherence is voluntary. The Commission and the AI Board have called the code an adequate voluntary tool. Article 50 stays binding, and the code does not replace the regulation or the Article 50 guidelines.

What marking do images AIORA delivers carry, and how can a retailer check it?

Images AIORA delivers carry a SynthID watermark embedded in the image itself, which is designed to withstand common edits such as resizing and compression, and does not depend on file metadata. AIORA generates with Google and OpenAI models. Detection can be checked with each provider's tools: gemini.google.com for Google images, and openai.com/verify for OpenAI images. That is AIORA's statement about the files it delivers.

The providers describe those signals with limits. Google DeepMind says SynthID embeds an invisible watermark in the image at creation, designed to stand up to cropping, filters, and lossy compression. Gemini's help page says the watermark will usually survive rescaling, recoloring, or compression, and that many alterations can leave it undetectable. Metadata is a separate layer. Gemini, at gemini.google.com, currently recognizes watermarks from Google AI tools.

OpenAI says images from ChatGPT, Codex, or the OpenAI API include SynthID and C2PA Content Credentials. SynthID sits in the media because metadata can be stripped by resizing, format changes, or screenshots, and it is designed to stand up to cropping, filters, and lossy compression. openai.com/verify looks for both. OpenAI says a missing signal can mean the metadata was removed, the watermark degraded, or the file predates those signals. A detected signal indicates OpenAI origin. It does not judge accuracy or lawful use.

When do the Article 50 transparency obligations apply?

Article 113 of the consolidated text of 27 July 2026 applies the regulation from 2 August 2026. Earlier dates cover prohibitions, governance, and general-purpose models. Later dates, 2 December 2027 and 2 August 2028, cover the high-risk rules in Chapter III. Article 50 is on the 2 August 2026 date. The code of practice page says the same. The act as first published is at its ELI.

Article 111 adds a narrower step. Providers of systems that generate synthetic audio, image, video, or text, already on the market before 2 August 2026, comply with Article 50(2) by 2 December 2026. The AI Act Service Desk FAQ states the same split: transparency obligations are enforceable from 2 August 2026, and the December date is the provider's marking deadline for systems already placed on the market. Read both dates with counsel before a launch plan treats them as one.

What can a retailer put on a product page if a disclosure is required?

Where counsel decides Article 50(4) applies, the disclosure says the content was artificially generated or manipulated, clearly and distinguishably, when the person first sees it. The regulation does not prescribe the sentence. Practical options:

• A line in the product template, beside the gallery: "Image generated with AI" or "Model image generated with AI."
• The same fact in the caption, the alt text, or the marketplace field that travels with the file.
• The optional EU icons for labelling AI-generated content. The Commission published them for deployers as part of Section 2 of the code, and says use is optional and does not itself establish compliance.

Article 50(4) also covers text published to inform the public on matters of public interest. The Commission's questions and answers give examples such as politics, justice, public health, and consumer safety. A garment description is a different kind of text, so ask counsel to read any generated copy on its own. The AI Act Service Desk takes those questions. Campaign pages raise the same image question in another layout. The campaign and editorial guide covers where a photographed frame still leads.

What should a retailer check before a season of AI images goes live?

Walk this with e-commerce, studio, and legal. Published production covers 10,000+ SKUs, a 90% lower cost per image, and €1.5 million in annual savings, so a label you use has to live in the template.

1. Name the roles. In a standard deployment AIORA is the provider and the retailer is the deployer.
2. Ask counsel to classify each image type: synthetic on-model, still-life of the real product, campaign frames, and any real person. Article 3(60) is the test.
3. Ask how Article 50(2) marking works and which detector reads it. Confirm whether an Article 47 declaration applies before you wait on one.
4. Keep retention, location, and subprocessors on the GDPR track.
5. Spot-check the delivered file and the file you publish. Google images at gemini.google.com. OpenAI images at openai.com/verify.
6. If counsel wants a disclosure, put it where the shopper and any feed see the image, on mobile and desktop.
7. Record the image types, the label, where it appears, who approved it, and the date. Reuse that record next season.

Where are the primary sources for this guide?

• Regulation (EU) 2024/1689, consolidated text of 27 July 2026, for Articles 3, 6, 11, 16, 47, 50, 111, and 113, and Annex III. The act as published: ELI.
• AI Act Service Desk, the Article 50 page, and the FAQ on application dates.
• Commission guidelines on Article 50 (20 July 2026) and the Commission questions and answers.
• Code of Practice, the 10 June 2026 news release, and the EU icons.
• Regulation (EU) 2016/679 for the personal-data definition. Google DeepMind on SynthID, Gemini verification, OpenAI on provenance, and openai.com/verify.

Related

• AI content production for seasonal collections
• AI campaign and editorial imagery for fashion
• AI fashion photography for luxury brands
• AI fashion photography