Which AI Disclosure Rules Actually Apply to You?

This is a file operation performed on the asset, not a label applied at publication.

Amazon notified third-party sellers on July 22, 2026. Where a photorealistic AI-generated person appears in a listing image, product video or A+ Content, the exact keyword contains-synthetic-performer must be written into the dc:subject XMP field of the file, using a metadata editor supporting IPTC-compatible embedded metadata, before the file is added to the listing. Amazon then surfaces an indicator to customers where applicable. The requirement applies across Amazon's worldwide stores.

The keyword is exact and the field is specific.

Metadata also does not reliably survive an export: a file tagged in one application and then flattened or re-exported through another can arrive without it. If your creative passes through a retoucher, an agency, a resizing step or a DAM, the tag needs verifying on the final file, not the working file.

Amazon's published guidance carves out four cases:

• Media containing only real people, even where AI tools were used to edit them
• Media containing characters from movies, television, streaming content, documentaries, video games or other expressive works
• Media containing no people
• Media containing people who are not photorealistic

For teams running creator content onto retail surfaces, the consequence is that the disclosure decision has to be made by someone who knows how the asset was produced, before the file moves. Your PDP approval queue sits downstream of the only moment the question can be answered.

If you send product to a creator, YouTube's branded content policy applies, and the declaration duty sits with the creator.

YouTube defines branded content as content influenced by a brand partner in exchange for something of value, and names free products and benefits received later as examples. The policy applies wherever the content appears, including videos, descriptions, comments, live streams and Shorts, and YouTube states it applies to the entirety of the content rather than only the portion featuring the brand.

If you run a product seeding program, that is your program. Seeded creators receive product with no separate fee, post organically, and may not consider themselves to be in a paid relationship at all. Under this policy they have a declaration to make.

YouTube also states that where its systems detect undisclosed branded content, it may apply a label automatically and notify the creator, who may have the option to certify that the video does not contain branded content and override it. YouTube does not publish the signals its systems use or their error rate, and the override is described as something a creator may have rather than will have.

Separately, Google Ads prohibited and restricted category rules now reach branded content that is not itself an ad. Alcohol, financial services, healthcare and medicines, gambling, and elections and political content carry additional restrictions, and the creator is responsible for confirming that brand partners hold the relevant Google certification. If you are in a regulated category and you seed, that is a requirement you have pushed onto a creator who does not know it exists.

The obligation that binds you is deepfake disclosure, and you cannot satisfy it with metadata.

Article 50 of the AI Act has applied since 2 August 2026. The Commission's own guidance draws the line clearly. Providers develop AI systems and place them on the EU market, and they carry the machine-readable marking obligation under Article 50(2). Deployers use AI systems under their authority, and the Commission gives an advertising company as its example of a deployer.

Your obligation is Article 50(4): clear disclosure of deepfake content to the person exposed to it, on first exposure at the latest.

Four points that matter operationally.

The marking does not count as your disclosure. The Commission states directly that deployers cannot simply rely on the machine-readable marking embedded by the provider to fulfill their own disclosure obligation. Content Credentials, watermarking and provenance metadata are all useful. None of them is the disclosure.

Your creators may not be separate deployers. Where the deployer is a legal person, employees acting under its instruction and control are not separate deployers, and the Commission states that a legal person remains the deployer even where contractors or freelancers are involved in operating the system on its behalf and under its responsibility and control. A creator operating independently and gaining economic benefit regularly is a deployer in their own right. Which of those describes your relationship is a question for counsel, and it is the question that determines where the obligation sits.

Standard editing is carved out. The marking obligation does not apply where the AI system performs an assistive function for standard editing. That is the same line Amazon draws between a real person edited with AI and a person generated by it. Two regimes, one distinction, which is convenient for anyone building a single policy.

Not everything synthetic is a deepfake. The AI Act's definition requires three cumulative conditions: a high level of resemblance, a subject that exists or could plausibly exist, and content that would falsely appear to be authentic or truthful. The Commission's guidance allows the intended audience and deployment context to bear on the third condition. Whether a given creator ad meets all three is a judgment, not a lookup.

Two dates worth knowing.

A limited grace period runs to 2 December 2026, but only for AI systems placed on the market before 2 August 2026 and only for the Article 50(2) marking obligation, which is a provider's relief rather than an advertiser's. And content generated before 2 August 2026 does not have to be labeled retroactively, though the Commission encourages it. That is a meaningful answer to the back-catalogue question in the EU, and it is narrower than it looks: it addresses generated content, not your other obligations.

You cannot disclose what you did not ask about, and every one of these rules assumes you know.

New York's statute conditions the duty on the producing business having actual knowledge that a synthetic performer appears. A reader could draw exactly the wrong conclusion from that, namely that the safest posture is to avoid finding out. Whether a deliberate absence of inquiry protects anyone is a question for counsel, and we are not going to characterize it.

The reasoning fails on its own terms regardless. Amazon's requirement is not conditioned on your knowledge; it is a file that is either tagged or not. YouTube's sits with the creator, and YouTube may label the video whatever you know. A brand organized not to know still has an untagged file on a PDP and a mislabeled video on a channel.

So capture the fact where it is knowable, from the person who knows it. A written attestation from the creator, at delivery, recorded against the asset. Not a checkbox in an approval tool three steps downstream where the only available answer is a guess.

The burden is probably lighter than it feels. CreatorIQ's 2026 creator survey, run with Influencers.club across roughly 5,000 creators, reported that 72% of creators have used AI tools but only about 5% use them to generate images or visuals. That is CreatorIQ's finding about its own survey population rather than an independent market measurement. If the direction is right, most attestations will be a single honest "no," and the workflow cost of asking is small relative to what you get, which is a record.

One thing automated checking does not do is settle this for you. Cohley's published position on what automated asset checks can and cannot evaluate is deliberately bounded, and rights and provenance sit on the wrong side of that boundary: a determination about permission or origin is a judgment about facts outside the file, not an observation about the file. Automated checks are a filter in front of your queue. They are not compliance, and they do not replace human review.

At the brief stage, the question is whether the brief asks in terms specific enough that the answer is observable rather than interpretive. The discipline that makes content requirements enforceable applies here. "No AI" is not a requirement anyone can apply consistently, because AI editing, AI backgrounds and AI-generated people are different things under every regime above.

Requirements that name the thing are answerable: whether a synthetic human likeness may appear; whether AI editing of a real person is permitted; whether AI-generated backgrounds or environments are permitted; whether synthetic voice is permitted.

At the contract stage, the topics for counsel are an attestation as to whether a synthetic performer or synthetic voice appears; a representation about which AI tools were used and for what; an obligation to make the platform-side declaration where the creator is the party who must make it, as on YouTube; and a notification duty if the answer changes after delivery.

At the delivery stage, the attestation needs to sit against the asset rather than in an email thread, because the value of a record is that it survives staff turnover and can be produced later. Brief Analysis reviews requirements before a Brief goes out, which is the cheapest moment to find that the brief never asked.

Triage by destination and by risk. Do not attempt asset-by-asset review of a back catalogue.

1. Amazon surfaces first. Narrowest population, binary requirement, and metadata presence can be checked programmatically against the files you hold.
2. Advertisements running in New York. The statute reaches advertisements and the business producing them.
3. EU-deployed content. Content generated before 2 August 2026 does not require retroactive labeling, which narrows this considerably.
4. Creator relationships that produced YouTube content. The declaration duty sits with the creator, so this is a communication task, not a file task.
5. Separate assets where a synthetic human likeness could plausibly appear from those where it could not. Most product photography and most creator video contains a real person or no person.
6. Where provenance is unknown and cannot be reconstructed, the decision is a risk decision for counsel, not a content decision.

Step 6 is the cost of solving this at publication rather than at the brief. If nobody captured the attestation at creation, it may not be recoverable, particularly where the relationship has ended.

More than the vendors in this category will admit.

YouTube does not publish the accuracy of its automated branded-content detection, the signals it uses, or how a creator contests a label beyond stating they may have the option to override. Its published policy addresses content going forward and does not describe back-catalogue treatment.

Amazon states it will display an indicator "where applicable" without fully specifying what makes it applicable, and has published no grace period or penalty specific to missing AI metadata. Its general image policies already permit removal of non-compliant images and suppression of listings.

No enforcement action under New York GBL §396-b has been identified as of September 2026. The statute exempts the advertising medium itself, along with audio advertisements, cases where AI is used solely for language translation of a human performer, and advertising for expressive works where the use is consistent with the work.

In the EU, Article 50 enforcement sits mainly with national market surveillance authorities, which means practice may differ by member state before it converges.

And this is not an exhaustive list. It is the set verified as of September 2026 for these destinations. Other jurisdictions and other platforms have their own.

Do brands have to disclose AI-generated ads?

It depends on the destination and on what the AI generated. There is no general US federal requirement to disclose AI use in advertising. Specific duties apply: Amazon requires metadata on media containing photorealistic AI-generated people, New York requires in-ad disclosure of a synthetic performer where the advertiser has actual knowledge, and in the EU a deployer must disclose deepfake content. AI used for standard editing of real footage generally sits outside these.

Does the FTC require AI disclosure?

The FTC's endorsement rules at 16 CFR Part 255 require disclosure of material connections between an advertiser and an endorser. That is a rule about the commercial relationship, not about whether AI was used. It applies to creator content regardless of how the content was made.

What does the EU AI Act require for advertising content?

Article 50 has applied since 2 August 2026. For a brand, the relevant obligation is as a deployer: clear disclosure of deepfake content on first exposure at the latest. The machine-readable marking obligation under Article 50(2) falls on providers of AI systems, not on advertisers, and a deployer cannot rely on that marking to satisfy its own disclosure duty.

Does California's AB 853 apply to my brand?

Almost certainly not directly. AB 853 amended the California AI Transparency Act and moved its operative date to 2 August 2026. Its obligations fall on providers of large generative AI systems and, from 1 January 2027, on large online platforms, GenAI hosting platforms, web browsers and capture-device manufacturers. A consumer brand running creator advertising is not a covered entity.

Who is responsible if a creator uses AI without telling the brand?

That depends on the regime and on the relationship. Under the EU AI Act, a legal person remains the deployer even where contractors or freelancers operate the system on its behalf and under its control, while a creator acting independently for regular economic benefit is a deployer in their own right. New York's statute conditions the advertiser's duty on actual knowledge. Amazon's requirement is not conditioned on knowledge at all. Which of these describes your situation is a question for counsel, and it is the reason the attestation belongs in the agreement.

Should a creator brief ask about AI use?

Yes, and specifically rather than generally. "No AI" cannot be applied consistently because AI editing, AI-generated environments and AI-generated people are treated differently under every regime above. Ask whether a synthetic human likeness may appear, whether AI editing of a real person is permitted, and whether synthetic voice is permitted.

Is AI-assisted editing the same as AI-generated content?

Not under these rules. Amazon's requirement excludes media containing only real people even where AI tools were used to edit them. The EU's marking obligation does not apply where the AI system performs an assistive function for standard editing. The line that matters is whether a person was generated, not whether AI touched the file.

Does using a creator platform make me compliant?

No. No platform can make a brand compliant, and any vendor suggesting otherwise is describing something that does not exist. Disclosure obligations attach to the advertiser and, in some cases, to the creator. A platform can help you ask the question, capture the answer and keep the record. The obligation remains yours.

• AI-generated UGC vs real creators
• Write non-negotiables AI can actually check
• How to write creator content requirements that actually work
• Brief Analysis
• AI Asset Analysis
• Product Seeding
• Retail
• Ecommerce
• How the Cohley platform works

The first question is not which assets are non-compliant. It is whether your current workflow could produce the record if you were asked for it. If the answer is no, that is a brief-stage change rather than an audit. Talk to us about creator content governance.