How to Label AI Images: 4 Step Guide (EU AI Act 2026)

Updated: July 21, 2026

You want to label AI images, but you are not sure what is actually required, technically and legally, starting August 2, 2026? This guide walks you through the complete process in four numbered steps, from the visible EU icon to machine readable embedding to audit proof documentation. It is deliberately hands on: with concrete examples, typical edge cases, and an overview of which platforms strip your labeling on upload. Starting on this date, the transparency obligations under Article 50 of the AI Act take effect. If you publish AI generated images, you should have this process down by then.

Key Takeaways

• Two levels matter for compliance: a visible AI label on the image itself (not in the footer) and a machine readable marker embedded in the file.
• The deadline is August 2, 2026. The visible deployer labeling requirement (Art. 50(4)) applies from this date with no delay.
• For shops, D2C brands, and marketing teams: you are typically the deployer, and you must visibly disclose deepfakes and deceptively realistic AI images.
• Metadata alone is not enough: many platforms strip it on upload. That is why the icon burned into the pixels is the most reliable layer.
• Fine risk: up to 15 million euros or 3 % of global annual turnover.
• Done in one pass: visible EU icon, IPTC/XMP metadata, C2PA, watermark, verification, and a records register, with the free tool from KI-Kennzeichnung.

Contents

1. Who has to label AI images, and who does not?
2. Step 1: Add a visible EU icon
3. Step 2: Embed a machine readable marker
4. Step 3: Verify after upload
5. Step 4: Document your proof
6. Edge cases: retouching, stock photos, illustrative images
7. Summary & checklist
8. Frequently asked questions (FAQ)

For a detailed breakdown of the legal situation, see our overview article on the AI labeling requirement under the EU AI Act. This article is purely about practice: how to label an AI image correctly.

Who has to label AI images, and who does not?

A quick primer so you can gauge the effort correctly. The AI image labeling requirement does not apply to every publication, but in specific cases, above all to deepfakes, that is, deceptively realistic content. Whether and how it applies to you depends on your role. The AI Act distinguishes two roles here:

• Providers of an AI system, for example the operator of an image generator, must technically mark synthetic outputs so they are machine readable as AI generated. The marking must be "effective, interoperable, robust and reliable as far as this is technically feasible" (Art. 50(2)).
• Deployers, meaning companies, shops, and marketing teams that use a tool like Midjourney, DALL·E, or Nano Banana, must visibly disclose deepfakes and deceptively realistic AI images (Art. 50(4)). A lighter standard applies to works that are evidently artistic, satirical, or fictional.

For the vast majority of readers, this applies: you are a deployer. You will find the details on this distinction in the article Provider or deployer: obligations under Art. 50 AI Act. In practice, that means you are best protected if you cover both levels, the visible label and the machine readable metadata. That is exactly what this guide does.

A concrete example: A fashion shop generates a lifestyle photo with AI showing a fictional model wearing the new collection. The image looks like a real photo shoot, so there is potential for deception and the visible disclosure requirement applies. If the same shop only uses AI to remove dust from a real product photo, there is no labeling obligated deepfake. Between these two poles lie the edge cases we resolve further below.

The effort is also worth it from a liability standpoint: violations of the AI Act carry fines of up to 15 million euros or 3 % of global annual turnover (EU guidelines on transparency obligations). You can read how a fine differs from a cease and desist letter in detail under AI labeling: fines & warning letters, and on the deadline system under AI Act deadlines & fines.

A note on the deadline: The core date of August 2, 2026 is fixed. The machine readable marking for systems placed on the market before this date has been postponed to December 2, 2026 under the "Digital Omnibus" (status as of May 2026, provisional). The visible deployer labeling (paragraph 4) is not postponed and applies from August 2, 2026.

Step 1: Add a visible EU icon to the image

The first and most important layer is what your audience sees directly. A note that only appears in the legal notice or the footer of the page is not enough. The labeling must occur on the content itself and be recognizable without any technical aid.

The EU Commission provides an official but optional icon set for this purpose. It includes three motifs, each as SVG and PNG:

Using it is voluntary but recommended: a consistent, recognizable symbol builds more trust than a homemade note and signals diligence to regulators and customers alike. You can read more on choosing the right motif under EU icons for AI content.

Here is how to proceed:

1. Choose the icon. Fully AI generated image? Use the "fully AI generated" icon. Only partially AI edited (e.g. background replaced)? Then use the "partially AI modified" motif.
2. Choose the placement. Put the icon in a clearly visible corner (bottom right is common). It must not be hidden by cropping, stickers, or overlays, not even when the platform later crops the image automatically.
3. Ensure contrast. Use the dark variant on a light background and the light variant on a dark one. The label must stay readable, otherwise it counts as not perceivable.
4. Optionally add text. A short addition like "AI generated" increases clarity. Vague terms like "illustrative image," "digital art," or "edited" do not count as sufficient AI labeling.

With the free web tool from KI-Kennzeichnung, you drag and drop the official EU icon onto your image and export the labeled file in seconds, without any image editing software and without your image ever landing on someone else's server. Moving content can be labeled the same way; the article Labeling AI videos describes the process for clips.

Step 2: Embed the labeling in a machine readable way

The visible icon covers disclosure toward people. For search engines, platforms, and verification tools, you also need a machine readable AI marking, information hidden inside the file. For providers this is mandatory (Art. 50(2)); for deployers it is the technically clean safeguard. In practice, three established methods handle this:

The most robust approach is the combination: IPTC/XMP as the broadly supported standard, C2PA for the tamper resistant provenance chain, and optionally a watermark as an added safeguard. That way, even if a platform removes one layer, another remains intact. The article C2PA, IPTC & watermark: machine readable labeling explains how these formats work together.

Important: you cannot reliably write metadata with standard tools. Common image editors usually do not set the correct DigitalSourceType field, and a note manually typed into a comment field does not meet the standard. A specialized tool handles this: at KI-Kennzeichnung, IPTC/XMP fields and optionally C2PA plus a watermark are embedded in one pass together with the visible label, locally in the browser and without any upload to a third party server.

Step 3: Verify whether the platform removes the labeling

Now comes the step that almost everyone overlooks, and the one that decides whether your labeling succeeds or fails. Many platforms strip metadata on upload: they recompress the image, rename it, and in the process remove EXIF, XMP, and sometimes even C2PA data. Your carefully embedded labeling might be gone afterward, while the burned in icon remains.

The general tendency by channel:

These figures are empirical observations and can change depending on format and timing, so the rule is: verify after upload, do not assume beforehand.

1. Upload a test image. Publish a labeled image on the target channel (website, shop, social media platform).
2. Download it back and verify. Download the published version and check with a C2PA viewer or the file verification feature whether the icon and metadata survived.
3. Assess the result:
   • Visible icon preserved, metadata gone → your image is still correctly labeled toward people. The visible label is burned into the pixels and survives compression. For the deployer obligation (paragraph 4), this is what counts.
   • Both preserved → optimal.
   • Icon hidden by cropping → adjust the placement and test again.

The practical rule of thumb: never rely solely on metadata if the target platform removes it. The visible EU icon burned into the image is the layer that no platform can compress away, and this is why step 1 and step 2 belong together.

A common misconception concerns social media: the automatic "made with AI" label from Instagram or TikTok is a feature of the platform's terms of service, not a substitute for the legal labeling required under Art. 50. You can read how to keep the two apart in the article Labeling AI advertising on Meta, Instagram & Ads. For product images on marketplaces, separate requirements sometimes apply, see Labeling AI product images for Amazon & eBay and more generally AI labeling in e commerce & marketing.

Step 4: Document your proof

Labeling is one half, being able to prove that you labeled is the other. In the event of a cease and desist letter or a regulatory inquiry, what counts is what you documented, not what you remember. Audit proof documentation consists of:

• Checksum (SHA-256) of the labeled file, which uniquely identifies exactly this version and proves it was not altered afterward.
• Timestamp of when the labeling occurred.
• Method used, which icon, which metadata fields, whether a watermark was applied.
• Export as CSV or a register entry for your compliance records.

This is exactly where the labeling register from KI-Kennzeichnung comes in: every labeled file is logged with a SHA-256 hash and a timestamp and can be exported as proof. For larger volumes, the batch feature processes up to 50 images at once and delivers the result as a ZIP along with a register log; the REST API lets you integrate the process directly into your publishing workflow. This is the difference from purely client side overlay tools that paint a label but keep no proof.

A documented process protects you twice: it demonstrates your diligence and makes workflows repeatable across your team. You will find a compact checklist for the entire workflow under AI labeling checklist.

Edge cases: retouching, illustrative images, and stock photos

Most uncertainty does not arise with obviously AI generated images but in the gray zone between them. This overview classifies typical cases:

The rule of thumb behind this: as soon as an image creates a deceptively realistic impression or content is added generatively, a disclosure requirement arises. Cosmetic corrections to a genuinely captured photo, on the other hand, do not trigger the obligation. When in doubt, labeling is the cheaper path, it costs seconds, while omitting it can cost you a cease and desist letter. A separate, stricter logic applies to the special category of deepfakes, which the article Deepfake labeling resolves. You can look up terms like IPTC, C2PA, or DigitalSourceType compactly in the AI labeling glossary. How to handle text from ChatGPT & co. alongside images is shown in Labeling AI text.

Summary: labeling AI images in four steps

1. Burn in a visible EU icon on the image (survives compression and metadata stripping).
2. Embed a machine readable marker, IPTC/XMP, optionally C2PA and a watermark.
3. Verify after upload whether the platform removes the labeling.
4. Document your proof, SHA-256 hash, timestamp, register export.

Quick checklist:

• Correct motif chosen (fully / partially / basic)?
• Icon clearly visible, high contrast, not hidden?
• IPTC/XMP field DigitalSourceType set, optionally C2PA + watermark?
• Verified after upload?
• Hash + timestamp stored in the register?

You can complete all four steps in one pass, visible label, metadata, verification, and register, for free with the tool at ki-kennzeichnen.de.

Frequently asked questions (FAQ)

Do I actually have to label AI images?

Yes, if you distribute them publicly and they create a deepfake or deceptively realistic impression, or if you fall under Art. 50(4) as a deployer. For commercial use in shop, advertising, or on your website, labeling such content is recommended, but the individual case remains decisive. Purely private, unpublished images are not covered.

From when does the labeling requirement for AI images apply?

The transparency obligations under Article 50 apply from August 2, 2026. The visible deployer labeling takes effect on this date with no delay. Only the machine readable marking for systems placed on the market before this date has been postponed to December 2, 2026 under the provisional Digital Omnibus.

How do I correctly label AI generated images?

In four steps: place a visible EU icon on the image, embed machine readable metadata (IPTC/XMP, optionally C2PA), verify after upload whether the platform removes the labeling, and document the process with a hash and timestamp. A mere note in the footer is not enough, the labeling belongs on the content.

Who is responsible, me or the provider of the AI tool?

Both, at different levels. The provider must mark the output in a machine readable way (paragraph 2); you as the deployer must ensure the visible disclosure (paragraph 4). Do not assume the generator has already handled everything, verify and add to it yourself.

Do I have to label images retouched with AI?

It depends on the degree. Small corrections (exposure, dust removal) are usually uncritical. As soon as image content is generatively added, replaced, or altered, the labeling requirement applies, then use the "partially AI modified" icon.

Is the automatic label from Instagram or TikTok enough?

No. The platform label is based on the provider's terms of service and does not fulfill the legal obligation under Art. 50 AI Act. Label your image yourself before you upload it, and treat the platform label only as an addition.

Does the labeling have to be machine readable?

For providers, yes (Art. 50(2)). For systems placed on the market before August 2, 2026, this obligation has been postponed to December 2, 2026 under the provisional Digital Omnibus status (May 2026). Regardless of that, machine readable embedding is technically sound and recommended, because it lets platforms and verification tools detect it automatically.

What happens if I do not label AI images?

Violations of the transparency obligations can carry fines of up to 15 million euros or 3 % of global annual turnover. In Germany, the risk of competition law cease and desist letters comes on top of that. Details under AI labeling: fines & warning letters.

Is there a free tool for labeling AI images?

Yes. The free web tool from KI-Kennzeichnung places the official EU icon by drag and drop, embeds IPTC/XMP metadata (optionally C2PA and a watermark), verifies files, and keeps a records register with SHA-256 and timestamp, including batch processing (up to 50 images as a ZIP) and a REST API.

Sources

• EU Commission, guidelines on transparency obligations: https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems
• EU Commission, EU icons for labeling AI generated content: https://digital-strategy.ec.europa.eu/en/policies/eu-icons-labelling-ai-generated-content
• Article 50 AI Act: https://artificialintelligenceact.eu/article/50/
• EU AI Act, implementation timeline: https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
• Sidley, EU AI Act Transparency Obligations: Preparing for Compliance by 2 August 2026: https://datamatters.sidley.com/2026/06/24/eu-ai-act-transparency-obligations-preparing-for-compliance-by-2-august-2026/
• Gibson Dunn, EU AI Act Omnibus Agreement (postponed deadlines): https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

This article does not constitute legal advice. For your specific case, please consult a lawyer.