<\/p>\n\n\n\n
European AI law already requires online stores to label deepfake images.<\/strong> Virtual models that look like real people, AI-generated faces, lifestyle scenes with synthetic characters that could pass for authentic photographs... if you are using any of these in your store without disclosing it, you are already breaking the EU AI Act. This guide explains exactly what the regulation requires, which images it applies to, and how to comply without the headache.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n The EU Artificial Intelligence Act<\/strong> (Regulation EU 2024\/1689), commonly known as the AI Act<\/strong>, is the world's first comprehensive AI law. It entered into force in August 2024 and applies in stages: some obligations are already in effect, with full enforcement reaching most businesses on 2 August 2026<\/strong>.<\/p>\n\n\n\n Do not mistake \"phased application\" for \"I can wait.\" The transparency obligations under Article 50<\/strong> (which include the labelling of AI-generated content) are already in force<\/strong>. And that is where most online stores have a compliance problem without realising it.<\/p>\n\n\n\n Spain's AI supervisory agency (AESIA) has already opened 23 preliminary investigations. The Spanish data protection authority (AEPD) has increased AI-related investigations by 340% compared to the previous year<\/strong>. Across the EU, the ecommerce sector has seen 330% more in digital compliance fines<\/strong> over the past year alone.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Because ecommerce has adopted AI faster than almost any other sector, and has done so without thinking too hard about the legal implications. Today, a significant share of the images on online stores have passed through some form of generative AI: virtual fashion models that look like real people, AI-generated lifestyle photography, product images where the human context is entirely synthetic...<\/p>\n\n\n\n When those images could pass for authentic photographs of real people, they fall within the definition of a deepfake under the AI Act and must be labelled. Today, almost none of them are.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Before you can address your obligations, you need to know which AI systems you are actually using. Many online stores use AI without being fully aware of it. Here is the most common picture:<\/p>\n\n\n\n <\/p>\n\n\n\n The key question is whether the image depicts a person (real or synthetic) in a way that could be mistaken for an authentic photograph. A product-only shot, a typographic banner, or an AI-generated background are not deepfakes. A virtual model who looks like a real person wearing your clothes is.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n The AI Act organises AI systems into four risk levels. Most ecommerce businesses operate at the limited risk<\/strong> and minimal risk<\/strong> levels, but that does not mean they have no obligations. It means their obligations are primarily around transparency<\/strong>.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Systems that are entirely banned in the EU. For ecommerce, the most relevant cases are using AI to psychologically manipulate users (subliminal techniques to push a purchase), exploiting the vulnerabilities of groups such as minors or elderly people, or real-time facial recognition in public spaces without consent. If any of your tools do this, they must be removed immediately.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n For ecommerce, this primarily affects businesses that offer instalment payments or buy-now-pay-later with AI-based credit scoring<\/strong>, or fraud detection systems<\/strong> that automatically block or penalise users. These require technical documentation, human oversight, activity logging, and impact assessments.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n This is where most ecommerce sits. It covers chatbots, recommendation engines, personalised pricing, and, critically, all visual content generated or manipulated by AI that could constitute a deepfake<\/strong>. The Article 50 transparency obligations apply at this level and are already in force.<\/p>\n\n\n\n <\/p>\n\n\n\n Spam filters, basic catalogue search without profiling, spell-checkers. No formal obligations.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n This is the provision that affects ecommerce businesses most right now, and the one that is being most widely ignored.<\/p>\n\n\n\n Article 50 of the AI Act<\/strong> sets out several transparency obligations. The provision with the most direct impact on ecommerce businesses as deployers of AI is paragraph 4<\/strong>: it requires disclosure whenever content constitutes a deepfake<\/strong>, meaning images, video, or audio generated or manipulated by AI that depicts people, places, or events in a way that appears authentic but is not.<\/p>\n\n\n\n The obligation does not apply to all AI-generated or edited content. It applies specifically to content that could mislead viewers about the authenticity of what is being depicted. The central question is whether the content could pass for a real photograph or recording.<\/p>\n\n\n\n <\/p>\n\n\n\n In the context of an online store, the most common cases are the following.<\/p>\n\n\n\n AI-generated virtual fashion models.<\/strong> If you use tools like Botika or Ablo to show your garments on synthetic people who look like real human beings, those images are deepfakes under the AI Act. The consumer is looking at a \"person\" who does not exist, with an appearance designed to look like an authentic photograph.<\/p>\n\n\n\n AI-generated people in product or lifestyle imagery.<\/strong> If you use Midjourney, DALL-E, or similar tools to create lifestyle photography in which people appear to be using or interacting with your product, and those people could be mistaken for real individuals in a real situation, those images are deepfakes.<\/p>\n\n\n\n Alteration of a real person's appearance.<\/strong> If you use AI to modify the face, body, or appearance of a real person in an image (for example, making a model look younger or changing their features with Generative Fill), that manipulated image is a deepfake.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n It is just as important to know what falls outside this obligation. A product-only image without people, generated or retouched with AI, is not a deepfake. An AI-created typographic banner is not a deepfake. An AI-generated background behind a real product is not a deepfake. Removing a background with AI, or improving resolution with upscaling, is not a deepfake.<\/p>\n\n\n\n The line is the deceptive representation of people: if there is no person (real or photorealistic synthetic) in the image, the Article 50.4 obligation is not triggered.<\/p>\n\n\n\n <\/p>\n\n\n\n The AI Act provides for the use of technical marking mechanisms (watermarking) to identify deepfake content, particularly through metadata<\/strong>. This means compliance is not satisfied simply by adding a small \"AI-generated\" text somewhere on the page. The image file itself must be identifiable as AI-generated or manipulated through its metadata, following standards such as C2PA (Coalition for Content Provenance and Authenticity).<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n This is the core obstacle for most ecommerce businesses. If you have hundreds or thousands of images in your store (some supplied by manufacturers, some by agencies, some created in-house), there is no manual way to know which ones contain AI-generated or AI-altered people<\/strong>. And without knowing, you cannot label them.<\/p>\n\n\n\n That is exactly the problem AI Sentinel by Lawwwing solves.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Beyond deepfake labelling, the AI Act imposes further obligations that every ecommerce business should be aware of.<\/p>\n\n\n\n Chatbot transparency.<\/strong> If you have an AI-powered virtual assistant or customer service chatbot, you must inform users that they are speaking with an AI and not a human being. This obligation has been in force since February 2025. A clear, visible notice at the start of the conversation is sufficient, but it must be unambiguous.<\/p>\n\n\n\n Transparency in recommendations and personalised pricing.<\/strong> If your store displays AI-powered product recommendations or charges different prices based on user profiles, you must disclose this. Users have the right to know when a decision affecting them has been made or influenced by an automated system.<\/p>\n\n\n\n Updated privacy policy.<\/strong> Your privacy policy must reflect every AI system that processes personal data: what data is used, for what purpose, whether automated decisions are involved, and how users can exercise their rights in relation to those decisions.<\/p>\n\n\n\n AI literacy (Art. 4).<\/strong> Article 4 of the AI Act requires businesses to ensure that employees working with AI systems have the minimum knowledge and skills needed to use them safely and responsibly. This obligation has been in force since February 2025.<\/p>\n\n\n\n Supplier contract review.<\/strong> If you use third-party AI tools (AI-powered email marketing platforms, smart advertising tools, AI plugins for Shopify...), you must review your contracts to verify that the provider complies with the AI Act. As a deployer, you have your own obligations that do not disappear simply because you sourced the tool from a third party.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n The Article 50 deepfake labelling obligation is already in force.<\/strong> It is not a future requirement.<\/p>\n\n\n\n <\/p>\n\n\n\n Fines for breaching Article 50 (the provision covering deepfake labelling) can reach \u20ac7.5 million or 1% of global annual turnover<\/strong>. For a mid-sized store with \u20ac2 million in revenue, that is up to \u20ac20,000 in fines for failing to label images correctly.<\/p>\n\n\n\n These penalties stack on top of GDPR fines<\/strong>. If the AI system also processes personal data (for example, profiling used to serve those images), you can face fines from both regulations for the same incident.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Transparency and labelling obligations (Art. 50), already in force<\/strong><\/p>\n\n\n\n Privacy and data protection<\/strong><\/p>\n\n\n\n Team and compliance culture<\/strong><\/p>\n\n\n\n For high-risk systems (if applicable: credit scoring, fraud detection)<\/strong><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Identifying which images in your store are deepfakes under the AI Act is harder than it sounds. Images arrive from manufacturers, agencies, freelance designers, stock libraries... and increasingly from generative AI tools that your own team uses day to day. Working out which ones contain synthetic people or AI-altered faces, and distinguishing them from images that simply have a retouched background or improved resolution, is not something that can be done manually at scale.<\/p>\n\n\n\n AI Sentinel by Lawwwing solves exactly that.<\/strong><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n AI Sentinel scans every image on your website and analyses, one by one, whether they contain people generated or manipulated by AI that could constitute a deepfake under Article 50.4 of the AI Act. The output is a clear report: which images require labelling, which do not, and how to proceed to document your compliance.<\/p>\n\n\n\n With that information, you can act: label only what the law actually requires you to label, and stop worrying about the rest.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n In fashion, beauty, and lifestyle retail, the use of AI-generated virtual models has exploded. They cost less than a photo shoot, are available instantly, and can be adapted to any garment or aesthetic. But they represent exactly the kind of content European legislators want identified as artificial: people who look real but are not, in situations designed to appear like authentic photographs.<\/p>\n\n\n\n Article 50.4 exists precisely so that consumers know when what they are looking at is an artificial representation. In ecommerce, where images directly shape purchasing decisions and product expectations, that transparency also carries weight in terms of consumer rights<\/strong>.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n If you already use Lawwwing for GDPR compliance, cookie management, and legal texts for your store, AI Sentinel integrates into the same ecosystem. One single dashboard to manage your store's complete legal compliance: privacy, cookies, consent, and now AI content labelling as well.<\/p>\n\n\n\n Compatible with WordPress, WooCommerce, Shopify, PrestaShop, Magento, Wix, and every other platform Lawwwing already supports.<\/p>\n\n\n\nTable of contents<\/h5>\n\n\n\n
\n
What is the EU AI Act and why does it affect your online store<\/h2>\n\n\n\n
Why is ecommerce particularly exposed?<\/h3>\n\n\n\n
Which AI tools do ecommerce businesses use <\/h2>\n\n\n\n
Tool<\/th> Typical ecommerce use<\/th> Does it create or alter images of people?<\/th><\/tr><\/thead> Midjourney, DALL-E, Firefly (to create realistic people or scenes)<\/td> Virtual fashion models, AI lifestyle photography<\/td> Yes, if the result could be mistaken for a real photo<\/strong> (deepfake)<\/td><\/tr> AI virtual fashion models (Botika, Ablo)<\/td> Showing garments on AI-generated people<\/td> Yes<\/strong> (deepfake: synthetic person who looks real)<\/td><\/tr> AI face or body alteration tools<\/td> Modifying a real person's appearance in a photo<\/td> Yes<\/strong> (deepfake: manipulation of a real person's likeness)<\/td><\/tr> Midjourney, DALL-E, Firefly (for objects or abstract content)<\/td> Product shots without people, abstract banners<\/td> No (not a deepfake)<\/td><\/tr> Canva AI, Adobe Generative Fill (background or object editing)<\/td> Removing backgrounds, adding non-human elements<\/td> No (not a deepfake)<\/td><\/tr> AI image upscaling tools<\/td> Improving resolution of product photos<\/td> No (not a deepfake)<\/td><\/tr> AI-powered customer service chatbots<\/td> Support, FAQs, recommendations<\/td> No, but disclosure to users is required (Art. 50.1)<\/td><\/tr> AI product recommendation engines<\/td> \"You might also like\"<\/td> No, but transparency is required<\/td><\/tr> Dynamic or personalised pricing<\/td> Real-time price adjustments<\/td> No, but transparency is required when prices are personalised<\/td><\/tr> AI fraud detection<\/td> Automatic blocking of suspicious transactions<\/td> No, but may qualify as high risk<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Risk classification: where does your store fall<\/h2>\n\n\n\n
Unacceptable risk: prohibited since February 2025<\/h3>\n\n\n\n
High risk: full obligations from August 2026<\/h3>\n\n\n\n
Limited risk: transparency obligations (already in force)<\/h3>\n\n\n\n
Minimal risk: no specific obligations<\/h3>\n\n\n\n
Article 50 and the obligation to label deepfakes: what almost nobody is doing<\/h2>\n\n\n\n
What counts as a deepfake in ecommerce?<\/h3>\n\n\n\n
What does NOT count as a deepfake?<\/h3>\n\n\n\n
What about watermarking?<\/h3>\n\n\n\n
The real problem: you do not know which images on your store are deepfakes<\/h3>\n\n\n\n
Other AI Act obligations for online stores<\/h2>\n\n\n\n
Key dates for ecommerce businesses<\/h2>\n\n\n\n
Date<\/th> What comes into force<\/th> Already active?<\/th><\/tr><\/thead> 1 August 2024<\/strong><\/td> EU Regulation 2024\/1689 enters into force<\/td> \u2705<\/td><\/tr> 2 February 2025<\/strong><\/td> Prohibited practices (unacceptable risk) + AI Literacy (Art. 4) + Transparency obligations under Art. 50<\/strong> including deepfake labelling<\/td> \u2705 Already applies<\/td><\/tr> 2 August 2025<\/strong><\/td> Obligations for general-purpose AI models (GPAI)<\/td> \u2705<\/td><\/tr> 2 August 2026<\/strong><\/td> Full enforcement for high-risk AI systems (Annex III)<\/td> \u23f3 In 77 days<\/td><\/tr> Dec 2027 (possible)<\/strong><\/td> Potential extension for some high-risk systems via Digital Omnibus (pending approval)<\/td> \u2753 Not confirmed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Penalties: how much non-compliance can cost you<\/h2>\n\n\n\n
Type of infringement<\/th> Maximum penalty<\/th><\/tr><\/thead> Prohibited AI systems (unacceptable risk)<\/td> \u20ac35 million<\/strong> or 7% of global annual turnover<\/strong><\/td><\/tr> Non-compliance with high-risk system requirements<\/td> \u20ac15 million or 3% of global turnover<\/td><\/tr> Non-compliance with transparency obligations (Art. 50)<\/td> \u20ac7.5 million or 1% of global turnover<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n AI Act compliance checklist for ecommerce<\/h2>\n\n\n\n
\n
\n
\n
\n
AI Sentinel: automatically detect which images on your site are deepfakes and label them<\/h2>\n\n\n\n
How AI Sentinel works<\/h3>\n\n\n\n
Why this is especially critical for ecommerce<\/h3>\n\n\n\n
AI Sentinel fits into what you already have with Lawwwing<\/h3>\n\n\n\n