EU AI Act: what labeling AI-generated images means for ecommerce teams

Your product images almost certainly passed through a model this year. A background got removed, a studio shot got dropped into a living room, a lifestyle image got generated from a prompt because the photo shoot for that variant never happened. None of that was controversial in 2025. Since August 02, 2026, Article 50 of the EU AI Act attaches transparency obligations to it.

The question landing on ecommerce teams is not whether to disclose. It is narrower and more practical: which of your images are in scope, who is responsible for marking them, and whether the marking is still there by the time the image reaches a shopper.

What Article 50 actually requires

Article 50 is not one rule. It is two, and they attach to different parties.

• Machine-readable marking applies to providers. A system that generates synthetic image content has to mark its output in a machine-readable format, so the image is detectable as artificially generated or manipulated. This is a property of the file, not of the page it appears on.

• Visible disclosure applies to deployers. This is the label a person can see. It is strictly required for deepfakes, meaning content resembling real people, places or events that would otherwise read as authentic. For an ordinary AI-generated product image that is not pretending to be a real event, the strict visible-label duty does not apply the same way, though visible disclosure is encouraged.

Two consequences follow, and both get missed. A visible “AI-generated” badge in your storefront does not satisfy the machine-readable obligation, because a badge is markup and the obligation is about the file. And the two duties can sit with two different organizations for the same image: the model provider marks at source, while the merchant publishing it is the deployer.

The regulation is deliberately technology-neutral. It names no standard in its operative articles and describes the marking only in functional terms: machine-readable, effective, interoperable, robust, reliable. That is a design choice, not a gap, and it means the answer to “are we compliant?” will not come from a single vendor checkbox.

Provider or deployer: sort this before you build anything

Most of the confusion in ecommerce teams right now is a classification problem wearing a technical costume. Before any implementation discussion, sort your images into three groups:

1. Images a system generated from a prompt. Fully synthetic output. The model provider carries the Article 50(2) marking duty. Your platform’s job is to not destroy the marking.

2. Images a system edited. Background removal, environment placement, AI lighting and shadow. This is “manipulated” content, and it is the least settled of the three. Whether the editing model marks its output at all is a question worth putting in writing to whoever supplies it.

3. Images your team uploaded. If the file was generated somewhere else and brought in, the duty travelled with it. Your platform did not create the image, but it is the surface where the disclosure has to appear.

Get this wrong in the obvious direction and you label nothing. Get it wrong in the other direction and you badge your entire catalog as machine-made, which is its own commercial problem.

Why no single marking method is enough

The Commission’s Code of Practice, published June 10, 2026, endorses a layered approach rather than one technique: cryptographically signed content credentials in the file’s metadata, following the open C2PA standard, plus an imperceptible watermark embedded in the pixels, plus optional fingerprinting or logging.

The reasoning is that each layer fails differently. Metadata is precise and readable but fragile: a screenshot strips it, a re-upload strips it, a careless format conversion strips it. A watermark survives most of that but degrades under heavy manipulation and carries less information. Neither is sufficient on its own, which is why the guidance stacks them.

The Commission has also published a set of official, free-to-use icons for visible marking. If you are designing a storefront disclosure, start there rather than inventing a badge.

The part platform teams underestimate: surviving the pipeline

Here is the failure mode that matters most for anyone running a commerce platform. Applying the marking is the easy half. Keeping it is the hard half.

An image in a commerce system does not get published. A derivative of it does. Thumbnails, responsive sizes, WebP or AVIF conversion, compression, CDN transforms, and per-channel variants each produce a new file, and each step is an opportunity to silently drop the metadata that made the original compliant. The original in your media library can be perfectly marked while every file a shopper actually loads is not.

Two related traps:

• Provenance chains break at handoffs. An image generated by one model and then edited by another can end up asserting a human edit in its credentials while a watermark still identifies it as AI-generated. The two layers disagree, which is worse than either being absent.

• An internal database flag is not compliance. A field in your admin marking an asset as AI-generated is useful for governance and does nothing for Article 50 on its own. The marking has to be in the file, and the disclosure has to be in the storefront.

If you take one requirement into your next technical conversation, make it this one: marking must be preserved through every derivative variant, and someone has to test that it is.

How Shopware is approaching AI image labeling

For merchants, the goal should be simple: using AI-generated and AI-edited imagery should not mean having to manage every technical transparency requirement manually. Shopware is currently working on an approach that makes it easier for merchants to identify and label AI-generated images where needed. As part of this work, we are reviewing how images created or edited with Shopware’s AI image capabilities – including Image Generation and the Image Editor – carry machine-readable markings and how those markings behave throughout the media workflow.

Shopware’s Image Editor lets you transform product images with AI, with extended usage available through Shopware Intelligence+.

We are also looking at how Shopware can support merchants with images generated outside the platform, where the responsibility for appropriate disclosure may sit with the merchant. This work is still ongoing. As the product approach becomes more concrete, we will share further details on how Shopware will support AI image transparency across generation, editing, media management, and the storefront.

What to do before your next campaign

None of this requires a compliance program. It requires four answers, and most teams can get them in a week.

1. Inventory your image sources. Which tools in your stack generate or edit images, and for which surfaces. Include the ones marketing adopted without telling IT.

2. Ask each supplier what it embeds. Content credentials, watermark, both, neither. Get it in writing. “We use AI responsibly” is not an answer to this question.

3. Test one image end to end. Generate it, publish it, then inspect the file the storefront actually serves at three breakpoints. If the marking is gone, you have found your gap, and it is in your pipeline rather than your model.

4. Decide your visible-disclosure posture deliberately. The strict duty is narrow. Your position on voluntary disclosure is a brand and trust decision, and it is better made by marketing and legal together than discovered in a support ticket.

This is not a fringe workload. In June 2025 alone, 541 unique Shopware shops generated 1.16 million AI interactions (Shopware company data). Whatever your platform is, the volume of machine-touched content in your catalog is already past the point where this can be handled by hand.

Frequently asked questions about the EU AI Act

^{This article summarizes publicly available regulatory material for orientation. It is not legal advice. Confirm your own obligations with qualified counsel.}