EU AI Act compliance workflow for ecommerce AI product images and video ads: a pre-publish checklist for labeling, provenance metadata, and disclosure decisions
A pre-publish EU AI Act workflow for ecommerce images and video ads: check provenance, assess deepfake risk, place disclosures, and retain evidence.
Lamina Team
Product Team @ Lamina
What does the EU AI Act require for AI-made ecommerce product images and video ads?
For ecommerce creative shown in the EU, keep two jobs separate: provider-side machine-readable marking and deployer-side visible disclosure. Visible disclosure is required where the finished image, audio, or video is a covered deepfake, not simply because AI was used somewhere in production. Article 50 transparency obligations have applied since 2 August 2026. A retailer professionally using a third-party tool will usually be the deployer; the tool company will normally be the provider.
Give every final version one release owner and one decision record. That owner should identify the tool, retain the delivered file, judge the finished creative as the audience sees it, and record whether visible disclosure is required. This is a practical compliance workflow drawn from the supplied materials, not legal advice.
| Metric | Value | Source |
|---|---|---|
| Article 50 transparency obligations apply | 2 August 2026 — Article 50 marking and deepfake-labelling obligations are legal requirements; the related Commission Code of Practice is voluntary. | digital-strategy.ec.europa.euas of 2026-07-31 |
| Provider marking duty | Synthetic audio, image, video, or text outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated, subject to technical feasibility. | digital-strategy.ec.europa.euas of 2026-07-25 |
| Standard-editing boundary | Article 50(2) does not apply where AI performs standard assistive editing or does not substantially alter the input data or its semantics. | en.ai-act.ioas of 2026-08-04 |
| Deepfake disclosure trigger | Covered media is AI-generated or manipulated content resembling existing persons, objects, places, entities, or events that falsely appears authentic or truthful. | digital-strategy.ec.europa.euas of 2026-07-20 |
| Visible disclosure standard | People exposed to covered content should be able to recognise clearly and distinguishably that it was artificially generated or manipulated. | digital-strategy.ec.europa.euas of 2026-07-20 |
How should a team check an AI-made ecommerce asset before it goes live?
Run the final exported asset through a fixed eight-step gate. Run it again whenever a change could alter what the audience believes is real. This is about keeping the disclosure call from falling through the cracks between generation, editing, ad trafficking, and reposting—not dragging out production.
EU pre-publish checklist for catalogue images and video ads
1. Create an asset record
Log the campaign, SKU, intended channels, EU audience, source files, tool or vendor, generation and editing actions, date, and approving owner. Treat the retailer as a deployer where it uses an AI system professionally under its authority. Then separately determine whether it is also the provider of that system.
2. Classify the AI action
Distinguish ordinary assistive editing from synthetic generation, or from an alteration that substantially changes the input data or its meaning. Write down the reason in a short note: colour correction on an existing packshot, for example, versus generating a new lifestyle scene.
3. Preserve and test provenance data
For generated or substantially manipulated output, get vendor confirmation of its machine-readable marking approach. Retain the original delivered file and its metadata. Test the real export, CMS, product-feed, ad-platform, and social-upload path; provenance that vanishes downstream is poor evidence.
4. Screen the final creative conservatively for deepfakes
Ask two things. Does the asset resemble an existing person, object, place, entity, or event? Could it falsely seem authentic or truthful? A yes to both triggers the company’s conservative release rule: hold it for a visible-disclosure decision before publication.
5. Add disclosure where review identifies a covered deepfake
Make the disclosure clear, distinguishable, and understandable at first exposure. Put it on or immediately beside the catalogue card, product-page image or video, ad unit, and every reposted social version. The Commission’s AI-content icons can help voluntarily; they are not the only permitted format.
6. Review copy on its own track
Keep approval evidence for claims-oriented copy. Article 50(4) also covers AI-generated or manipulated public-interest text where there was no human editorial review or assumed editorial responsibility. That is a separate question from whether an ecommerce image requires deepfake disclosure.
7. Capture publication evidence
Archive the final asset, original file, metadata evidence, completed assessment, disclosure wording, and a screenshot or recording that shows the disclosure at first exposure. Include locale, channel, publication date, and approver.
8. Reopen the record after a meaningful adaptation
Review again once an asset becomes materially different in the audience’s eyes. A product-only image turned into a synthetic scene featuring a recognisable location, person, or claimed event needs a fresh assessment. Do not copy the old approval across.
Which ecommerce assets deserve the closest deepfake review?
Synthetic people, altered real products, recognisable locations, and fabricated events warrant the closest review. Each can resemble something that exists while seeming truthful. The Commission’s definition covers existing persons, objects, places, entities, and events; it does not impose blanket visible labelling on every piece of generated media.
A virtual model in a fashion ad may need escalation if viewers could read that person as a real endorser or participant. A realistic image of an actual SKU also deserves scrutiny where generation makes a finish, feature, or result appear to be an authentic product depiction when it is not. A generated background that creates no false appearance of an existing place or event is a different case. The release owner should record why the final asset passes or fails the company’s conservative screen.
Where should an AI disclosure sit in an ecommerce ad or product listing?
Place a required disclosure where someone first encounters the covered asset, in a form that is clear and distinguishable from surrounding content. Hidden metadata does not replace visible or audible disclosure where a deployer publishes a covered deepfake.
For a product listing, check the image card, product-detail gallery, autoplay video, and marketplace rendition one by one. For paid media, check the native ad unit and every placement-specific crop or cut. A footer legal notice does not substitute for disclosure where the asset is encountered.
Who is responsible for provenance metadata and visible disclosure?
The AI-system provider carries the Article 50(2) duty to ensure in-scope synthetic outputs are machine-readably marked and detectable, subject to technical feasibility. The ecommerce business publishing under its professional authority is normally the deployer responsible for visible disclosure of covered deepfakes. Put both jobs on one creative producer and you leave a gap.
Hold the vendor or platform contact accountable for confirming provenance. Hold the brand’s release owner accountable for the final-asset assessment, placement check, and archive. Procurement can require vendor evidence before onboarding. Publication approval still belongs to the team that understands the claim, placement, and audience.
An EU-facing ecommerce team using generative tools for catalogue imagery and video advertising.
Release decision
over For each final asset before publication
Disclosure evidence
over At publication and for each reposted version
Change control
over Whenever an asset is materially adapted
What should a team keep after approving an AI ecommerce asset?
Keep the final version, source file, tool and vendor record, metadata evidence, deepfake assessment, disclosure proof, locale, channel, and approver. That record shows what was published, what the audience saw first, and why the team made the call.
Tie the record to the SKU and creative version, not just to a broad campaign folder. The same handbag image can raise a different compliance question after it is cropped into an ad, positioned beside a synthetic spokesperson, or edited into a video that appears to document a real event.
Does an Article 50 disclosure clear an ecommerce product claim?
No. An Article 50 disclosure decision does not validate the underlying product claim, depiction, endorsement, or testimonial under other applicable consumer-protection and advertising law. Keep product-claim approval separate from the AI-content record.
That split matters in generated product scenes. A disclosure may tell viewers that media was artificially generated or manipulated; it does not establish that a material, fit, performance statement, or testimonial is accurate. Send those questions to the relevant legal, regulatory, and advertising-review owners before release.
