Since August, the AI labeling requirement is in effect — what this means for your website

What actually applies

Article 50 of the AI Regulation distinguishes two roles. Providers of AI systems must mark their outputs in a machine-readable way. However, for most website operators, the second role is relevant: that of the operator according to paragraph 4. Anyone using generative AI professionally to create content must disclose in two case groups.

First, for realistically appearing image, audio, and video content. The regulation refers to deepfakes and clearly means much more than just fake politician videos: It concerns AI-generated or manipulated content that creates the impression of being real. A photorealistic product image created from the image generator falls under this. A noticeably comic-like illustration usually does not.

Second, for texts on matters of public interest. There is an exception here, which almost always applies in practice: If the text has been editorially reviewed and a named person takes responsibility for it, the obligation is waived. It is crucial that you can also prove this review if in doubt.

Purely internal content and merely sharing or quoting foreign AI content are not covered. And one point that brings much relief: Content created before August 2, 2026, does not need to be retroactively marked. The decisive factor for images is the time of creation, not the time of publication.

Regarding the fine framework, since the question will surely arise: It ranges up to 15 million euros or three percent of global annual turnover. However, this is not a realistic scenario for medium-sized companies. More practically relevant is that the competition authority has announced it will pursue violations under competition law. Legal warnings typically come faster than administrative procedures — a pattern many will recognise from implementing the GDPR.

Three persistent misunderstandings

“Every AI image must be marked.” This simplification circulates through many contributions and is simply false. The obligation ties to the realistic, authentic impression. A symbolic image in an illustrative style does not create this impression. However, for photorealistic advertising, you should not rely on the exception.

“A note in the imprint is sufficient.” Explicitly not. The disclosure must occur at the latest with the first contact with the content, clearly identifiable and without special technical means. A sentence in the imprint, in the terms and conditions, or at the end of a long text does not fulfill that. The note belongs with the content, not at the bottom of the page.

“Everything has been postponed.” The operator's obligations according to paragraph 4 have not. They have been valid unchanged since August 2, 2026. What has been discussed regarding postponements in recent months concerned other parts of the regulation.

A fourth point comes up less frequently but is technically important: An invisible marking in the image file is not sufficient for the operator's obligation. Metadata is helpful, and the regulation promotes them elsewhere — they do not replace visible labeling.

The official EU symbols

The European Commission has been providing three symbols since June 2026: one for “AI was involved,” one for fully AI-generated content, and one for AI-edited mixed forms. They are available in black and white, each also semi-transparent, as SVG and PNG.

The three icons in their black version. They also come in white, and both at 50 % transparency — which one fits depends on the picture underneath.

The use is free of charge and without attribution obligation — and voluntary. The symbols alone do not make a website automatically compliant with the law. We still recommend them: They are uniform across Europe, and recognition is precisely the point of marking. A home-made symbol must first be deciphered by your visitor.

More practically important than the choice of the symbol is the placement. It belongs directly with the content — that is, on the image, not in the caption three paragraphs down and certainly not in a footer.

Implementation in TYPO3 — more than just a little image in the corner

Those approaching this for the first time usually underestimate it. “We’re putting an icon on the image” sounds like an hour of work. Four things turn it into a project.

First, the inventory. For a grown website, there are quickly several hundred images in the file list. Which of them are AI-generated? Without a place where this status is maintained, no one can reliably answer this — and certainly not a second time in six months.

Second, the evidence. If you decide not to mark an image because it is comic-like or was created before the cut-off date, this decision is just as worthy of documentation as the opposite. In doubt, you want to be able to show that you have reviewed it.

Third, the accessibility of the marking itself. A symbol that exists only as an image without a text alternative in the markup is not present for screen reader users — the disclosure does not count for them. A symbol with insufficient contrast on a light image background likewise. And a collapsible detail level must be operable with the keyboard. Since the BFSG, this has been mandatory for many websites anyway; how accessibility and AI in TYPO3 fit together is on the corresponding service page.

Fourth, a technical detail that is often overlooked: TYPO3 by default removes all profiles when scaling images. This means that every derived variant loses its provenance data — and the machine-readable marking does not survive the first call in the frontend. We have measured this: With the standard configuration, the XMP package is gone after scaling, whether using ImageMagick or GraphicsMagick.

The second part of the measurement was even more interesting. If the removal is disabled, GraphicsMagick does pass on the C2PA signature — but it is then invalid because the image data has changed due to scaling. The derived file then claims to have been manipulated. Therefore, copying a signature unchanged is not just useless but a false statement about the file.

For these four points, we developed nt_aimark. The extension supplements the file metadata with a tab for “AI Transparency” — where your editorial team is already working. Upon upload, it reads existing provenance data: Content Credentials according to C2PA, the IPTC indication for the digital source, and known signatures in the EXIF fields. The result appears as an option.

That it remains a suggestion is a conscious decision. “This content is AI-generated” is a claim about content, and that should be made by a person, not by an automation. Automatically marking an image as AI-generated when it is not would be the worse mistake.

In the frontend, this results in an accessible marking with the official symbols, with a text alternative, collapsible detail level, and without layout shift. The contrast is measured by the extension against the actual image section behind the symbol; where this is not clear, the symbol gets an opaque area. A backend module shows what has been reviewed and what is open — and every status change is logged.

What to do now

Four steps, in this order.

1. Inventory. Get an overview of where AI was involved on your website — in images, in texts, in translations. Without this foundation, you are discussing in the fog.

2. Assessment. Go through the cases and decide for each content: obligatory marking or not, and why. Often, the result is more positive than feared. Document both, including the decision against a marking.

3. Technical implementation. Only now does it concern symbols and templates. Anyone reversing the order ends up marking too much or the wrong thing.

4. Ongoing maintenance. The next content is sure to come, and regulation is not standing still either — the next stage follows on February 2, 2027. Those who maintain the status while uploading will have no need for catch-up later — under ongoing TYPO3 maintenance it is one movement of the hand; afterwards it is a project.

Conclusion: Transparency is not just a compliance issue

It would be a shame to see the marking obligation only as a bothersome requirement. The percentage of people who look closely at where an image comes from is growing — and openly stating where AI was involved is not off-putting but rather confident to this target group. Those who work cleanly can show that without hesitation.

And the most honest sentence in conclusion: Sometimes the result of an inventory is that you don’t have to do much. We will tell you that as well — just ask.

This article reflects the status as of August 2026 and does not constitute legal advice. Whether a specific content is subject to marking obligation is a case-by-case decision. For legal evaluations, please seek legal advice.