Agency checklist for Article 50

Agencies shipping cuts to EU audiences need a production checklist, not another pack of paste-ready lines. Name who is the deployer, place a perceivable mark at first exposure, choose an official EU icon if you are going to use one, keep a human-review log for public-interest text, and put the duty in the client contract. The disclosure template is the copy. This page is the job bag.

The Commission's FAQ (last updated 24 July 2026) is the source for deployer, first exposure, human review, and the professional-use line. Bird & Bird's insight on the guidelines adopted 20 July 2026 is the source for who holds the duty in a client–agency chain. Paul, Weiss (4 August 2026) is the source for the three EU icons and for documented workflows on the editorial exception. Morgan Lewis (12 August 2026) is the source for the 2 August start with no deployer grace.

Name the deployer before you name the model

The FAQ: deployers are natural or legal persons using AI systems under their authority, excluding personal, non-professional activities. Where the deployer is a legal person, employees acting under its instructions are not separate deployers. The legal person remains the deployer even if contractors or freelancers operate the system on its behalf, under its responsibility and control.

Bird & Bird adds the agency fact the FAQ compresses. Authority means assuming responsibility for the decision to deploy the system and the manner of its actual use, including its outputs. Technical control over the tool is not required. A company that merely commissions a creative agency to produce an advertisement, without taking decisions or exercising control over whether and how the agency uses AI, is not a deployer: the obligation sits with the agency. The labelling duty follows decision-making control over AI use, not ownership of the campaign.

Put that on the job at kickoff, in writing.

Checklist — who is the deployer on this job?

Did the client decide that AI would be used, pick the system, or approve a specific generate as the hero? If yes, the client is in the deployer column, or you are both, and the contract has to say who applies the label the audience will see.
Did the client send a brief ("we need a UGC-style testimonial") and leave the toolchain to you? If yes, you are the deployer on Bird & Bird's reading. Do not wait for their legal team to discover that at delivery.
Are the people prompting employees of the agency? They are not separate deployers. The agency is.
Are you white-labelling a generator under your own name for the client to prompt? You may have stepped into provider territory. That is a counsel question, not a checklist tick. Flag it; do not bury it in a model name.

Provider or deployer is the sorting essay. The checklist only needs a named party on the call sheet. "We used Veo 3.1" is not a named party.

Personal, non-professional use is outside the Act. An agency invoice is the opposite of that exit. Regular economic benefit is already true the moment you are the agency.

If the cut will not be used in the EU, the territorial question is still not "we are not an EU shop." Duty follows the audience. Article 50 if you are not in the EU is that page. On this checklist, write the foreseeable audience into the brief: EU, not EU, or globally accessible internet. Bird & Bird records that the final guidelines treat posting deepfakes on the globally accessible internet as use in the EU, without needing a geo-targeted media plan.

First-exposure placement on the cut

The FAQ: disclose deepfake content to a natural person upon first exposure at the latest, in a clear and distinguishable manner, understandable and perceivable, visible or audible, without specific technical tools or dedicated extra actions. Machine-readable marking is not a substitute.

Checklist — will a person perceive the disclosure at first hit?

On video: a line or official icon on the picture from the first frame, held long enough to read, not covered by a platform UI chrome. Or an audible line on the open.
On image: the mark on the file, not only in a caption that a share-sheet strips.
On audio: an audible disclaimer. An icon the listener never sees fails this row.
Not only in an expanded description, a "more options" menu, or a hashtag.
Not only in C2PA / Content Credentials. Platforms re-encode. Manifests die.
If the foreseeable watch starts mid-file (a podcast chapter, a cutdown, a timestamp link), the mark has to live where that watch starts, not only at 00:00 of a master the viewer never sees.

Paul, Weiss (4 August 2026): information cannot be buried in terms or menus, and a single up-front notice may not suffice where people may not see the start. Bird & Bird adds a production-chain expectation: deployers in complex production and distribution chains should take proportionate measures so the label they applied is displayed at the point of first exposure — contractual conditions with distribution partners, interface settings.

That last sentence is the agency row. If the client uploads, your overlay still has to survive their crop. If a media network re-wraps the file, the contract has to tell them not to pad the disclosure off. If you deliver a clean master and a labelled master, write which one is for EU placement.

Standard assistive editing is exempt. Colour, crop, denoise, captions on a real recording: this row does not fire. A photoreal person who was never filmed: it does. Evidently artistic, satirical, or fictional work may use quieter placement so the disclosure does not spoil the work. Informative or commercial work may not borrow that quieter placement. The artistic carve-out is the boundary. On the checklist, default to first-frame visible. Quiet the placement only when someone has written "evidently fictional" on the brief and meant it.

Do not paste the template's lines into this page. Go to the template when you need the words. Here you only confirm the words will be perceivable.

Icon choice and the public-interest review log

The Commission finalised three EU icons: fully AI-generated, AI-modified, and a basic icon with an interactive second layer. Using them is optional. Labelling is not. Paul, Weiss (4 August 2026) and the FAQ's neighbouring Commission pages are the sources. User-testing favoured the basic icon paired with plain words over the icon alone.

Checklist — icon

If you use an official icon, download the Commission pack. Do not redraw it.
Fully AI-generated: the entire deepfake (or the public-interest text) is generated, no human-created elements, no editorial control beyond prompting.
Partially AI-modified: pre-existing human-made content was partially modified and the result is still a deepfake or public-interest text.
Basic icon: AI was involved, and you are pairing the mark with a text label or an interactive second layer. If you ship the second layer, it must be navigable with assistive technologies.
Signatories of the Code of Practice follow the Code's placement specifications. Everyone else may still use the icons. Using them is not a claim that you signed the Code.
Skip the icons if the placement will fail first exposure anyway. An unread mark is not a safer mark.

Public-interest text is a different artefact from a video overlay, and it is the one agencies forget because most jobs are pictures. The FAQ: deployers must clearly label AI-generated or manipulated text published to inform the public on matters of public interest, unless the text has undergone human review or editorial control. Politics, public administration, justice, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific, or cultural developments that may be a subject of public debate are the FAQ's list.

Human review, in the FAQ's words, is deliberate examination of the substance by one or more natural persons with relevant knowledge and professional judgement. Editorial control is control exercised in practice by a responsible editorial entity with authority to approve, alter, or reject the substance, including fact-checking and trustworthiness of sources. Spell-checking and grammatical correction are not review. Editorial responsibility means a person holds ultimate legal responsibility for publication.

Paul, Weiss: the editorial exception requires documented workflows, not solely assertions that review took place. A later substantive AI edit after that review removes the exception.

Checklist — public-interest text log

Is this text published, informative, and on a public-interest matter? If no, this log is not the duty. If yes, either label it or review it.
Who examined the substance (name, role, date)?
What did they check (claims, sources, not commas)?
Who had authority to reject the piece?
Did any model rewrite the substance after that sign-off? If yes, the exception is gone; label or review again.
Store the log with the job, not in a Slack thread that expires.

A product description and a chatbot reply seen only by the user who asked are, in Paul, Weiss's summary of the guidelines, outside this text duty. A news-style explainer the agency is about to post for a client is not a product description.

Article 50 is the name of the rule. The log is how you show the exception if anyone asks.

Put the duty in the contract

Bird & Bird's closing steps for anyone disseminating AI content that reaches the EU are the agency punch list: review the routes that could put the material in the EU; check you have a governance process that catches AI content before it is shared; develop rules and tools for labelling; check creative-agency and vendor contracts so AI use is flagged and labelling is owed.

Checklist — contract clauses to have before the first generate

Who is the deployer on this job, in the Article 50 sense, and who applies the perceivable label.
Foreseeable territories, including "globally accessible internet" as a default for organic social.
Which master is labelled, and a ban on distributing the unlabelled master into the EU.
A requirement that distribution partners keep the disclosure at first exposure (no cropping it off, no burying it behind a tap).
For public-interest text: who holds editorial responsibility, and a promise to keep the review log.
A vendor question for the generator: is the system inside the 2 December 2026 marking grace, and does the export carry machine-readable marking? That answer does not discharge your overlay. It tells you what the file contains.
Likeness, advertising disclosure, and platform originality stay as separate clauses. A labelled fake testimonial is still a fake testimonial.

Morgan Lewis (12 August 2026): deployer duties have applied since 2 August 2026. There is no agency grace because the edit was briefed in July. Content generated and published before 2 August is not retroactive; generated before and published after is covered. If the client is sitting on unreleased takes, publication is the date that bites.

Run the cut through the decision tree before you book the review link. If you need a studio seat to burn the line into the file as an edit step rather than a caption the client's intern will forget, sign up. The checklist is done when the named deployer, the first-exposure mark, the icon decision, the review log (if text), and the contract line are all filled. It is not done when someone pasted a hashtag.

FAQ

If the client uploads, who failed?

The deployer is the party who used the system under their authority and then put the content in front of people. If the client only commissioned the work and did not control whether or how AI was used, Bird & Bird puts the duty on the agency — including a duty to take proportionate measures so the label survives distribution. Write the upload path into the contract so a client crop cannot silently strip the mark you applied.

Do we need the EU icons on every deliverable?

No. The icons are optional. The perceivable disclosure is not. Use an official icon when it helps a viewer recognise the mark; pair it with plain words. Do not invent a fourth mark and call it the EU icon. A burned-in sentence with no icon can still pass first exposure. An icon with no first-exposure placement cannot.

What does a review log actually record?

For public-interest text claiming the human-review exception: who looked at the substance, when, what they checked, and who could reject the piece. Not a grammar pass. Not "the team saw it." Paul, Weiss is explicit that the exception wants documented workflows. If a model rewrites claims after sign-off, the log is stale and the exception is gone.