EU AI Act Article 50 for Shopify Stores: Labeling AI Product Photos for EU Customers in 2026

June 10, 2026
Shopify Tips
12 min read
EU AI Act Article 50 for Shopify Stores: Labeling AI Product Photos for EU Customers in 2026

The EU AI Act Article 50 Shopify question comes down to one thing: if you publish AI-generated images of human models that resemble a plausible real person to EU customers, you (the merchant, acting as a deployer) have to disclose that the image is a deepfake, and that obligation is enforceable from August 2, 2026. Pure product-only shots (objects, no AI people) stay outside the deepfake rule. Routine editing never triggers it.

That’s the short version. The longer version is messier, because Article 50 splits responsibility between two roles, reaches non-EU sellers, and carries a penalty most store owners have wildly mis-estimated (it’s not the scary number floating around LinkedIn). So let’s walk the whole thing, operator to operator.

We build image tooling for Shopify, so we read these rules the way a store owner reads them: what do I actually have to do to a photo before it ships to a customer in Munich or Madrid? Not the academic version. The practical one.

And one warning up front. A lot of guides flatten Article 50 into “label all AI images or pay 35 million euros.” Both halves of that sentence are wrong. Here’s why.

In this post

What does EU AI Act Article 50 actually require?

EU AI Act Article 50 sets transparency obligations for AI-generated content, and for stores selling into the EU the key one is this: when you publish a deepfake, you must clearly disclose that the content has been artificially generated or manipulated, at the latest at the moment of first exposure. For an online store, that means the customer should be able to tell the image is AI when they first see it.

Article 50 stacks two separate duties. Providers of generative AI systems have to mark their synthetic outputs in a machine-readable format that’s detectable as AI-generated (the text says this marking should be reliable and resistant to tampering, as far as is technically feasible). Deployers, the people publishing the content, have to disclose deepfakes to the audience. Most merchants are deployers, not providers. Hold that thought, because it changes what you owe.

There are exemptions. Law enforcement uses are carved out. So are artistic, satirical, and fictional works, which only need a reduced disclosure that doesn’t ruin the work itself. A product page selling a real jacket to a real buyer is none of those things, so don’t get cute trying to claim the “artistic” exemption for your lookbook.

Does the deepfake rule cover objects, not just people?

Yes, the legal definition covers more than people, but in practice the disclosure trigger for stores is still about AI humans. Article 3(60) defines a deepfake as AI-generated or manipulated image, audio, or video resembling existing persons, objects, places, entities, or events that would falsely appear authentic. Note the list: objects and events are in there, not only faces.

So why do we keep saying product-only images are generally fine? Because the test isn’t “is it AI.” The test is “does it resemble a real-world entity in a way that could mislead someone into thinking it’s authentic.” An AI-generated render of a generic ceramic mug doesn’t impersonate a specific real mug that exists in the world. It’s just a picture of the thing you sell. No false-authenticity problem, no deployer deepfake disclosure under Article 50(4).

An AI-generated human model wearing that product is the opposite case. A photorealistic face that looks like a plausible real person, presented as if a real photoshoot happened, can falsely appear authentic. That’s the line. It’s resemblance-to-a-believable-real-entity plus the potential to mislead, not photorealism on its own. We dig deeper into that exact split in our guide on AI backgrounds versus AI models in variant photos.

Image typeDeepfake disclosure (Art 50.4)?
AI-generated product, no peopleGenerally no
AI background or scene swap, real productGenerally no
AI upscale, retouch, lighting fixNo (routine editing)
AI human model resembling a plausible real personYes, disclose
AI face swap onto a real photoYes, disclose

One caveat that bites people. Even when the deepfake deployer duty doesn’t apply, the provider machine-readable marking under Article 50(2) can still attach to synthetic outputs from the AI tool itself. That’s the tool maker’s job, not yours, but it’s why “object images are totally unregulated” is too loose a statement.

Provider vs deployer: which one are you?

If you run a Shopify store and use a third-party AI image tool, you are a deployer, not a provider. The provider is whoever built and put the generative AI system on the market (the tool maker). Providers carry the machine-readable marking obligation. Deployers carry the deepfake disclosure obligation. Knowing which hat you wear tells you exactly which sentence of Article 50 applies to you.

Why does this matter so much? Because the machine-readable marking part (embedding a detectable AI signal into the file) is genuinely hard for a store owner to do, and Article 50 doesn’t put that on you. Your duty as a deployer is the human-facing one: tell the customer, clearly and at first exposure, that this image is artificially generated. That’s it. A visible label satisfies the deployer side.

Style editor for placing an AI Generated text label on a Shopify product image

And here’s the part most guides bury: there’s no Shopify-native way to add that visible AI label in bulk. Shopify has no product-image disclosure field at all, and it actively promotes AI photography through Shopify Magic. Etsy added an “I used AI” checkbox in January 2026. Shopify? Nothing. So the visible-label half is on you to solve with tooling.

Do non-EU Shopify sellers have to comply?

Yes. Article 50 applies irrespective of where you’re established, as long as the AI output is used in the EU. A Shopify store based in the US, the UK, or Australia that ships AI-imaged products to customers in the EU is in scope. Your location doesn’t get you out of it.

This extraterritorial reach is the part non-EU sellers keep missing. The EU regulates the output’s use, not your passport. If a French shopper loads your product page and sees an AI model image presented as authentic, the obligation followed the content across the border. Selling into the EU at all means the deepfake rule can apply to you.

So if you geo-segment your storefront, this is a real decision point. Some stores choose one clean global standard (disclose AI human models everywhere) rather than trying to serve a labeled version only to EU IPs. If you run grouped or linked listings across regions, our breakdown of multi-region AI disclosure for combined listings covers the EU-and-New-York overlap.

What are the penalties under Article 50?

Article 50 transparency breaches carry fines of up to 15 million euros or 3% of total worldwide annual turnover, whichever is higher. That’s the number to know. The 35 million euro / 7% figure you’ve probably seen belongs to the prohibited-practices tier (the banned AI uses), not to transparency, so don’t quote it for image labeling.

Is a small store realistically facing a 15 million euro fine for an unlabeled model photo? No, and pretending otherwise is fear-mongering. “Up to” means a ceiling, and enforcement scales to severity and the size of the business. But the ceiling tells you regulators take transparency seriously, and willful non-disclosure at scale is where exposure lives. Treat it as a reason to label, not a reason to panic.

The two deadlines: August 2 vs December 2, 2026

Article 50’s transparency obligations become enforceable on August 2, 2026, but there’s a split for the machine-readable provider marking. The deployer deepfake disclosure (50.4) has no grace period. The provider machine-readable marking (50.2) gets a transition: gen-AI systems already on the market before August 2 have until December 2, 2026 to meet it.

ObligationWhoEnforceable
Deepfake disclosure (Art 50.4)Deployer (merchant)August 2, 2026, no grace period
Machine-readable marking (Art 50.2)Provider (tool maker)August 2, 2026; Dec 2, 2026 for pre-existing systems

For a store owner the takeaway is simple. The deadline that lands on you, the deployer disclosure, hits on August 2 with no buffer. The December date is the tool makers’ problem. Don’t assume December applies to your labeling. It doesn’t.

Want the full multi-law timeline in one place? We keep a running 2026 AI image disclosure compliance calendar, and the pillar guide on disclosing AI product images ties the EU, New York, California, and FTC rules together.

How do you actually disclose an AI model photo?

The most durable visible disclosure is a clear “AI Generated” label stamped on the image itself, applied in bulk so it actually covers your catalog. Article 50 wants the disclosure clear, distinguishable, and present at first exposure. A small line of caption text buried below the fold is weaker than a label a shopper sees the instant the image loads.

You have two technical layers, and the honest answer is you want both. A visible watermark is durable and obvious but can be cropped and affects how the image looks. Embedded metadata (C2PA Content Credentials, or IPTC DigitalSourceType) is invisible but trivially stripped, and Shopify’s CDN strips EXIF/IPTC on compression anyway, which guts the metadata-only route. So metadata alone is fragile on Shopify. We cover the tradeoff in our breakdown of watermarking in Photoshop versus an app and the bulk watermarking guide.

For the visible layer, Viking Watermark by Aegis is a straightforward fit. It stamps a text watermark (you set the text, so “AI Generated” works) onto images and applies that template by single image, by collection, by tag, by product status, or to everything at once. Auto-watermark applies your template to new uploads, which matters because AI tools generate in batches. It’s new on the App Store, and you can read more at vikingwatermark.com.

Applying an AI Generated label in bulk by collection tag or product status in Viking Watermark

Be honest about what a visible label does and doesn’t do. It covers the deployer visible-disclosure side (and the New York conspicuous-disclosure standard). It does not embed C2PA or IPTC metadata, so it is not the Article 50(2) provider marking, and that part isn’t your job as a deployer anyway. One Google caveat: Merchant Center wants AI metadata but disallows watermarks or logos over the product on feed images, so keep your primary/feed image clean (or use Viking’s one-click rollback to restore the clean original before a feed sync) and label your secondary shots. We get into the SEO side in do watermarks hurt Shopify SEO and Google Shopping.

If your AI models show up as variant images or inside grouped galleries, the labeling has to follow them there too. For variant-level photos see our note on labeling AI-generated variant images, and for linked products see disclosure on combined-listing AI model photos. A clean storefront also matters for theft, which is why we wrote about stopping image theft on Shopify.

Try Viking Watermark free

FAQ

Does EU AI Act Article 50 require me to label AI product images on Shopify?

Only when the image is a deepfake, meaning it resembles a plausible real entity (typically an AI human model) and could falsely appear authentic. Pure product-only images and routine edits are generally outside the deployer deepfake disclosure.

Do AI-generated product images without people need disclosure?

Generally no. An AI render of an object, an AI background, or an upscale doesn’t impersonate a specific real-world entity, so it doesn’t meet the deepfake test for deployer disclosure. The provider’s machine-readable marking can still apply to the tool’s output, but that’s the tool maker’s duty, not yours.

Does Article 50 apply to non-EU Shopify stores?

Yes. It applies irrespective of where you’re established as long as the AI output is used in the EU. A non-EU store shipping AI-imaged products to EU customers is in scope.

What’s the penalty under Article 50?

Up to 15 million euros or 3% of total worldwide annual turnover, whichever is higher. The 35 million euro / 7% figure is for prohibited AI practices, not transparency, so don’t apply it to image disclosure.

When does it take effect, August 2 or December 2, 2026?

Transparency obligations are enforceable August 2, 2026. The deployer deepfake disclosure has no grace period. Only the provider machine-readable marking gets a transition to December 2, 2026 for systems already on the market.

Is a visible “AI Generated” watermark enough to comply?

For the deployer disclosure, a clear visible label shown at first exposure satisfies the human-facing duty. It does not provide the machine-readable provider marking, but that obligation sits with the AI tool maker, not the merchant.

Does Shopify have a built-in AI disclosure field?

No. Shopify has no product-image AI-disclosure feature and promotes AI photography through Shopify Magic. Unlike Etsy’s January 2026 “I used AI” checkbox, you have to add any visible label yourself, in bulk, with tooling.

This is general information, not legal advice. AI disclosure rules are new and still being interpreted; consult a qualified attorney for your specific situation.

August 2 is closer than the December headlines make it look. If you ship AI model photos into the EU, the deployer disclosure is the deadline that’s actually yours.

Co-Founder at Craftshift

You may also like