Launching shortly
AI labelling and the law

Why an AI image has to say what it is.

Since 2 August 2026, the EU's AI Act requires AI-generated images to be marked so that machines can detect them, and deep fakes to carry a visible label. Switzerland has no such rule yet; China, South Korea, India and California already have theirs. This page sets out what the law asks, of whom, and how xFavilla's seal answers it.

Status: 1 November 2026. An overview, not legal advice.

01

The European Union

Article 50 of the AI Act (Regulation (EU) 2024/1689) splits the job in two. The makers of the generators mark every output so that machines can detect it. Whoever uses a generator to make a deep fake tells people so, visibly.

  • Providers · Article 50(2)

    Mark every output, machine-readably.

    OpenAI, Adobe, Google and every other provider of a generative system must mark its images in a machine-readable format and make them detectable as artificially generated or manipulated: effective, interoperable, robust and reliable. The Commission's Code of Practice asks for at least two layers: signed, time-stamped metadata and an invisible watermark, plus a free tool to detect them. Systems already on the market before 2 August 2026 have until 2 December 2026.

  • Deployers · Article 50(4)

    Label deep fakes, visibly.

    Whoever uses AI to make an image that resembles real people, products, places or events and would falsely appear authentic must disclose it: clearly, at the first exposure, perceivable without tools. Metadata or a watermark alone does not meet this duty. For an evidently artistic or fictional work, a note beside the image or in its credits is enough. No grace period.

Applies since
2 August 2026. Images made before need not be labelled after the fact.
Fines
Up to EUR 15 million or 3 % of worldwide annual turnover; for smaller companies, whichever is lower.
Switzerland
Covered wherever images are foreseeably shown in the EU, for instance posted on the open web.

Who is who when a studio makes the image

The company behind the generator is the provider. The studio that uses it, deciding whether and how AI is used, is the deployer: the duty to label a deep fake is the studio's, and it has to make sure the label reaches the screen. A client who merely commissions the work is not a deployer, the Commission says; a client who decides how AI is used may become one.

  • A deep fake, for instance

    • A realistic image of a real person doing or saying something they did not.
    • An AI product image that misleads about how the product looks or what it is like.
    • A realistic scene of an event that did not take place, presented as if it had.

  • Not a deep fake

    • Colour correction, retouching, removing passers-by, extending a background.
    • Arranging or re-scaling real products, or a real product against an AI background that does not mislead about it.
    • Scenes evidently invented, such as a sphinx above the Eiffel Tower.
02

Switzerland

No Swiss law requires AI images to be labelled today. The Federal Council wants binding rules on transparency, but has not yet published a draft, and its latest report does not mention labelling AI content.

  1. 12 February 2025

    The Federal Council decides to ratify the Council of Europe's AI Convention and to adapt Swiss law sector by sector rather than copy the EU's AI Act.

  2. March 2025

    Switzerland signs the Convention. Parliament has not ratified it yet.

  3. 28 October 2026

    Interim report: the Federal Office of Justice is drafting binding rules on transparency, data protection, non-discrimination, oversight and risk assessment. A voluntary toolkit for company AI codes is published.

  4. Spring 2027

    The consultation on the draft is planned to open. Only then will it be clear whether, and how, AI images have to be labelled.

  5. 2028 at the earliest

    Entry into force, after the dispatch to Parliament and its debate. Our estimate: there is no official date.

What applies already

  • Unfair Competition Act (UWG): an image that misleads about a product, an endorsement or a testimonial is unfair, labelled or not.
  • Data Protection Act (DSG): the Federal Data Protection Commissioner says images that falsify the face or voice of an identifiable person must always be clearly recognisable as such.
  • Personality rights (Civil Code, Art. 28) protect anyone shown; impersonating someone can be a criminal offence (Criminal Code, Art. 179decies).
  • The EU's rules for any Swiss image that is foreseeably shown in the EU.
03

Around the world

Most rules elsewhere bind the providers of generators and the platforms, not the companies that publish the images. What they ask of an image is much the same: a label people can see, and data machines can read.

  • In force since 1 Sept 2025

    China

    Labelling Measures and the mandatory standard GB 45438-2025. Content that may mislead carries a visible label, "AI-generated", at an edge or corner, at least 5 % of the shorter side high. Every file carries metadata naming the producer and a content ID. Removing or forging labels is forbidden.

  • In force since 22 Jan 2026

    South Korea

    AI Basic Act, Article 31. Services built on generative AI must indicate that their output is AI-made; output hard to tell from real must be recognisable as such, and deep fakes of real people need a visible mark. Fines wait at least a year.

  • In force since 20 Feb 2026

    India

    Amended IT Rules. Tools that generate realistic synthetic images and video must label them prominently and embed metadata with an identifier; large platforms must ask users to declare synthetic content and label it.

  • California since 2 Aug 2026

    United States

    No federal labelling law. California's AI Transparency Act makes generators embed a permanent disclosure (provider, system, date, an ID, created or altered) and offer a free verification tool; large platforms must show it from 2027. New York requires ads to disclose synthetic performers since June 2026.

  • From 1 March 2027

    Japan

    AI images and video about elections that could be mistaken for real must be marked as such. Beyond that, no labelling duty.

  • No duty

    UK, Canada, Australia

    No binding duty to label AI images. Their rules on misleading advertising apply, and the UK has made non-consensual sexual deep fakes a crime.

04

On the image, and in it

Two kinds of label for two kinds of reader. People need to see that an image is AI-made; machines need to read it, even after the image has been copied, re-saved and stripped of its data.

A sealed AI image: a father and his small daughter at a sunlit kitchen table, she explaining something with both hands; the xFavilla mark in the bottom left corner.
The first image xFavilla sealed: the featured image of Mechane's "Permission to Exist". The mark sits bottom left (1); the other three layers are invisible. See its register entry.
  1. 1
    On the image

    A visible label

    Required in the EU for deep fakes, in China for content that may mislead. The EU's Code of Practice wants the letters "AI" as the label's main element, immediately visible and in the image itself, for instance top right; its official icons read "AI generated" and "AI modified". A logo alone does not say "AI".

  2. 2
    In the file

    Signed metadata

    A record of how the image was made, digitally signed and time-stamped so that any change shows. The open standard is C2PA, known as Content Credentials; its source type says "generated" or "modified". The Code's first layer; California, China and India require metadata too.

  3. 3
    In the pixels

    An invisible watermark

    A code hidden in the pixels themselves. It survives re-saving, resizing and the platforms that strip metadata, which most do. The Code's second layer.

  4. 4
    Outside the file

    A register

    Where the watermark leads: an entry for each image, kept by whoever sealed it and readable by anyone. The Code accepts logging and fingerprints as a supplement, never on their own.

For a client publishing AI images

What you have to put on an image, and in it

  • On the image: nothing, unless it is a deep fake shown in the EU. Then the label "AI", visible from the first view, in the image or, for an evidently artistic work, beside it.
  • In the file: nothing of your own. The metadata is the generator's duty, and the studio's seal adds its own. Keep both: publish the delivered files without stripping them where your systems allow.
  • Where it is shown: make sure the label reaches the screen wherever a deep fake appears, including through agencies and platforms that publish it for you.
  • Always: no image that misleads about your product, no endorsement that never happened, and the consent of anyone recognisable in it.
05

What the law asks, what xFavilla does

Most of what the law asks of an image it asks of the generators, not of a studio. xFavilla seals every image it delivers to the providers' standard anyway, and adds the visible label where an image needs one.

RequirementWhat the law asksxFavilla
Visible labelEU: deep fakes, with "AI" clearly visible at the first exposure. China: content that may mislead. Korea: deep fakes of real people.The mark in the corner of every image. Where an image counts as a deep fake, the EU's "AI" label goes with it.
Signed metadataEU Code: signed and time-stamped. California: provider, system, date, ID. China and India: producer and identifier.Content Credentials (C2PA) signed by xFavilla: generated or modified, the model, the sources by name and hash, who directed it.
Invisible watermarkEU Code: a second layer, hard to separate from the image.An ID in the pixels (TrustMark) that survives re-saving, resizing and crops that keep 80 % of each side.
Keep existing marksEU Code: keep the markings of the material used. China: removing labels is forbidden.The generator's own record (OpenAI's, Adobe's) is kept inside the seal, never stripped.
Detection anyone can useEU: a free detection tool. California: a free verification tool.The verify page: any image, free, read in the browser; nothing is stored.
Generated or modifiedEU icons: "AI generated" or "AI modified". California: created or altered.Every seal is one or the other, in the record, the register and the verify page.
LoggingEU Code: logging or fingerprints as a supplement.A register entry for every image, with the image itself to compare.
DocumentationEU Code, for deployers: document labelling decisions and correct mistakes.Each seal records who directed and approved the image, and when; a seal can be withdrawn.

The complete seal.

The law asks the generators for two machine layers and the deployer for a visible label. Every image xFavilla delivers carries all four layers, so a client does not have to work out which rule applies in which country.

  • The mark

    In one corner, the sign that a person directed the work; with the EU's "AI" label where the image counts as a deep fake.

  • The signed record

    Content Credentials: generated or modified, from what, with which model, by whom.

  • The invisible ID

    In the pixels, where re-saving and platforms do not reach.

  • The register

    Where the ID leads, with the image to compare, readable by anyone.

Check an image

Sources

Status 1 November 2026. This page explains the law in general; it is not legal advice. Whether a particular image counts as a deep fake depends on the image and where it is shown. Some details of Chinese, Korean and Indian law are taken from official summaries and secondary sources.