---
title: "AI images in online shops: when the labelling duty applies"
description: "Article 50 of the AI Act has applied since 2 August 2026. What matters for shops is not whether an image was made with AI, but whether it counts as a deepfake — and that definition covers products too."
canonical_url: "https://nuonic.de/en/insights/ai-image-labelling-online-shops"
last_updated: "2026-11-05"
---

Since **2 August 2026**, Article 50 of the AI Act has applied — the
transparency obligation for AI-generated content. Ever since, we have been
getting the same question in shop projects: "We have product and lifestyle
images generated with AI. Do we now have to label all of them?"

The answer is neither yes nor no, and it does not hinge on whether AI was
involved. It hinges on a single definition — that of a **deep fake**. And
contrary to what the term suggests, that definition covers not only people
but explicitly also objects and places.

> **This article is expressly not legal advice.** It sorts the obligations
> from a technical and practical point of view — no more than that. We are a
> Shopware agency, not a law firm, and we may not and do not want to give
> legal advice on individual cases. Whether a specific image falls under the
> obligation is, in borderline cases, a judgement call that belongs with a
> lawyer. What we can deliver is the groundwork: which images are candidates
> at all, and what the labelling looks like technically.

## First of all: this obligation was not postponed

A widespread misconception that has persisted since the summer. The **Digital
Omnibus** — Regulation (EU) 2026/1744, published in the Official Journal on
24 July 2026 — did indeed move deadlines in the AI Act. Just not this one.

What moved were the obligations for **high-risk systems**: systems under
Annex III now apply from 2 December 2027, AI in regulated products under
Annex I from 2 August 2028. Prohibited practices, AI literacy, the
obligations for general-purpose AI models and **the Article 50 transparency
obligations keep their dates**.

So anyone who heard "the AI Act has been postponed" and concluded that image
labelling can wait is mistaken. For online shops, Article 50 is in any case
the only part of the regulation that applies routinely in day-to-day
operations — a shop does not normally operate high-risk systems.

## Provider or deployer? The role determines the duty

Article 50 assigns two different obligations to two different roles. Confuse
them and you either build too much or too little.

A **provider**, under Article 3(3), is whoever develops an AI system or has
one developed and places it on the market under their own name or trademark.
That is the image generator — not the shop.

A **deployer**, under Article 3(4), is whoever uses an AI system under their
own authority, outside a purely personal activity. That is the shop.

From which the division of labour follows:

<table>
<thead>
  <tr>
    <th>
      
    </th>
    
    <th>
      Who it applies to
    </th>
    
    <th>
      What has to be done
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Art. 50(2)
      </strong>
    </td>
    
    <td>
      Provider of the AI tool
    </td>
    
    <td>
      Mark outputs in a <strong>
        machine-readable
      </strong>
      
       format so they are detectable as artificially generated — watermarks, metadata, fingerprints
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Art. 50(4)
      </strong>
    </td>
    
    <td>
      Deployer, i.e. the shop
    </td>
    
    <td>
      <strong>
        Disclose
      </strong>
      
       that the content has been artificially generated or manipulated, where it constitutes a deep fake
    </td>
  </tr>
</tbody>
</table>

For the shop this means: the machine-readable marking in the metadata is
**not your job**. You do not have to embed watermarks or produce C2PA
signatures. Your duty is the visible disclosure to the person looking at the
image — and only where that image is a deep fake.

One caveat: anyone who integrates an image generator into their shop under
their own name and offers it to customers — a product configurator that
generates visualisations, say — can slip into the provider role. That is the
case where the question belongs with a lawyer.

## The real question: is your image a deep fake?

This is the point most articles on the topic skip. Article 50(4) does not
oblige deployers to label every AI image. It obliges them to disclose deep
fakes. And "deep fake" is defined in Article 3(60) as

> AI-generated or manipulated image, audio or video content that resembles
> existing **persons, objects, places**, entities or events and would falsely
> appear to a person to be authentic or truthful.

Two things about that are decisive for shops.

**First: "objects" and "places" are explicitly in there.** The colloquial
notion that a deep fake is a faked video of a person is misleading here. A
photorealistic AI image of a sideboard that genuinely exists falls under the
definition just as much as an AI face does.

**Second: it is a two-stage test, and both stages have to be met.** The image
must *resemble* something existing **and** falsely *appear* authentic. An
obviously stylised illustration fails the second stage — it never pretends to
be a photograph. An image of a product that does not exist fails the first.

From this you can build a usable test question that works without legal
training: **would an average visitor take this image for a real
photograph?** If yes, and if what is depicted really exists, labelling is the
safe route.

## Four image types from everyday shop work, sorted one by one

The abstract definition helps little until it is attached to the images that
are actually sitting in the media pool. Four cases cover most shops.

### 1. Photorealistic AI product image of a real product

The product exists, the image looks like a studio shot, and it came out of an
image generator. Both stages of the test are met: it resembles an existing
object and appears to be a real photograph.

**Verdict: label it.** This is the clearest case and at the same time the
riskiest — because unfair-competition law applies on top (more on that
below).

### 2. AI post-processing of a real photo

Cut-out, background removed, dust retouched, colour cast corrected, image
upscaled. The basis is a real shot of the real product, and the AI has edited
it.

Article 50(2) expressly excludes systems that perform **an assistive function
for standard editing** or that do **not substantially alter** the input data
or its semantics. That logic also carries the assessment on the deployer
side: where nothing substantial was altered, no content arises that falsely
appears authentic — it *is* authentic, just cleaner.

**Verdict: as a rule, no labelling.** The line runs where the editing changes
the statement being made about the product. A removed speck of dust is
standard editing. A wood grain added afterwards that the actual piece of
furniture does not have is not.

### 3. Lifestyle or mood image with AI-generated people

The sofa stands in a living room that does not exist, and on it sits a person
who does not exist, both photorealistic.

Here it gets more nuanced. The person does not exist, so resembles no
existing person. The **product** depicted, however, does exist, and the scene
as a whole appears to be a real photograph.

**Verdict: label it.** We consider this the safe route, because the product —
the part of the image that drives the purchase decision — is real and the
image passes as a photograph. On top of that, photorealistic people in
advertising touch on further questions depending on the execution, from
personality rights to unfair-competition law.

### 4. Obviously illustrative graphics

Icon sets, explanatory diagrams, stylised scenes, comic looks. Nobody takes
these for a photograph.

**Verdict: no labelling under Art. 50(4).** The second stage of the test is
not met. In addition, Article 50(4) provides an exception for evidently
**artistic, creative, satirical or fictional works**, where it is enough to
disclose the existence of such content in an appropriate manner — for shop
illustrations that is usually not even needed, because they already fail the
deep fake test.

## How to label — and where the notice has to sit

Article 50(5) makes three requirements that belong together. The information
must be

- **clear and distinguishable**,
- provided **at the latest at the time of the first exposure**, and
- conform to the applicable **accessibility requirements**.

"At the latest at the first exposure" is the requirement with the most
practical consequences. It rules out the most convenient solution: a sentence
in the legal notices or the footer stating in general terms that AI is used
on the site. Whoever sees the image has to see the notice at the same moment
— so at the image, not three clicks away.

For implementation that means:

- **At or immediately beside the image.** A caption, a badge in the corner of
the image, or a line under the gallery. Not in the imprint, not in the
terms and conditions.
- **In overview views too.** If the AI image appears as a thumbnail in a
listing, in search or in a teaser, that is the first exposure — not the
product detail page.
- **Accessible.** The notice has to be available to screen reader users as
well. A burned-in pixel badge alone does not achieve that; the notice
belongs in the text flow or the alt attribute in addition. For B2C shops
the [European Accessibility Act](/en/insights/e-commerce-deadlines-2026-27)
already applies here anyway.
- **Not in the alt text alone.** The alt attribute does not reach sighted
users. It supplements visible labelling, it does not replace it.

The regulation prescribes no wording — there is no mandated label as there is
for the [warranty notice](/en/insights/warranty-label-shopware-6). Common and
sufficiently clear are variants such as "AI-generated image", "Created with
AI" or "Illustrative image, AI-generated".

On 20 July 2026 the Commission published **guidelines on Article 50**, and on
10 June 2026 a **Code of Practice on Transparency of AI-generated Content**.
Its Section 2 addresses deployers and describes the labelling of deep fakes.
Signing is voluntary, and the Article 50 obligation exists regardless — the
practical value lies elsewhere: those who follow the code can evidence
compliance through it. Those who do not have to demonstrate to market
surveillance that their own approach is equivalently adequate.

## The underrated part: labelling does not cure misleading content

The AI Act governs transparency. It says nothing about whether an image has
to be accurate. That question is answered by unfair-competition law — and it
was answered long before the AI Act.

Under **Section 5 UWG**, it is unfair to engage in a misleading commercial
practice capable of causing a commercial decision that would not otherwise
have been taken. Misleading includes an untrue or deceptive statement about
the **essential characteristics of the goods**, expressly including their
**condition and quality**.

A product image is a statement about condition. If the AI image shows a wood
grain, a colour, a finish quality or a detail of what is included that the
delivered product does not have, that is misleading — **even with
"AI-generated" printed underneath**. The notice explains how the image came
about, not how it diverges from the product.

In our view that is the greater everyday risk, for a simple reason: market
surveillance for the AI Act is only now being built up. Competition
associations, trade bodies and competitors have been issuing warning letters
for years. For most shops the route to trouble runs through Section 5 UWG,
not through Article 50 — and there no label helps, only an image that is
accurate.

The practical consequence: **the closer the image sits to the
purchase-deciding detail, the less generative AI is suitable.** For mood
images, category banners and backgrounds it is unproblematic. For depicting
the specific article the customer receives, a real photograph is not only
legally safer but the better product.

## What happens in case of a breach

Article 99(4)(g) names the Article 50 transparency obligations explicitly.
The range is **up to EUR 15 million or 3 % of total worldwide annual turnover
for the preceding financial year, whichever is higher**.

For small and medium-sized enterprises including start-ups, Article 99(6)
reverses that: there the **lower** of the two values applies. That
considerably defuses the headline for smaller companies, but changes nothing
about the obligation itself.

Realistically, for an average shop the issue is not the multi-million fine
anyway, but the combination of a warning letter, a cease-and-desist
declaration and the rework on a media pool grown over years in which nobody
knows any more which image came about how.

## Implementation in Shopware 6

The actual problem is rarely displaying the notice. It is the question of
**which of the 12,000 images in the media pool are AI-generated in the first
place**. Whoever cannot answer that cannot label — and cannot evidence having
done it right either.

So implementation starts with the data, not in the theme:

1. **Record provenance on the medium.** A dedicated field on the media entity
(a custom field, say `ai_generated` with the values "photo" /
"AI-generated" / "AI-edited"). That is the basis for everything else and
the only part that cannot be guessed retroactively.
2. **Anchor it in the intake process.** Every new image gets the attribute
before it enters the pool — whether from the photo production, from the
supplier or from the generator. For supplier images the question belongs
in the onboarding questionnaire, because provenance is not controllable
there.
3. **Output in the theme.** A small component that renders the notice when
the field is set — in the product gallery, in the listing thumbnail and in
Shopping Experiences elements. Built once, it applies everywhere.
4. **Work through the back catalogue.** For legacy stock, a pragmatic cut
helps: review images from the point in time AI was in use; mark older
photo productions as photos. Metadata from some generators (C2PA
manifests) helps with the assignment but is patchy, because it is often
lost in further processing.
5. **Document it.** A short internal note on the rule you classify by and
why. That is the part that counts if it ever matters — towards market
surveillance as much as towards a warning letter.

Almost all of the effort sits in steps 1, 2 and 4. Step 3 is an afternoon.

<faq-section :items="[{"question":"Do all AI-generated images in an online shop have to be labelled?","answer":"No. The obligation under Article 50(4) of the AI Act applies to deployers only for deep fakes. What matters is whether the image resembles something that exists and would falsely appear to be a real photograph. Photorealistic product and lifestyle images usually meet that test, obviously stylised illustrations do not."},{"question":"Does an AI product image count as a deep fake even without a person in it?","answer":"Yes, quite possibly. The definition in Article 3(60) names not only persons but also objects, places, entities and events. A photorealistic image of a product that really exists and looks like a genuine photograph therefore falls under the definition, even though no person appears anywhere in it."},{"question":"Does a shop have to add watermarks or metadata to AI images?","answer":"No. That machine-readable marking is the job of the provider of the AI tool under Article 50(2), meaning the image generator. The shop is a deployer and owes the visible disclosure to humans. Anyone offering a generator under their own name can additionally end up in the provider role."},{"question":"Where does the notice about an AI image have to appear?","answer":"At the image itself or immediately beside it. Article 50(5) requires the information to be clear, distinguishable and provided at the latest at the time of first exposure. A blanket sentence in the footer or the legal notices is therefore not enough. If the image appears in a listing, the notice belongs there too."},{"question":"Is labelling enough if the AI image differs from the real product?","answer":"No. The AI Act governs transparency about how content came about, not its factual accuracy. If an image shows features the delivered product does not have, that remains a misleading statement about its condition under Section 5 UWG — regardless of whether an AI notice sits underneath it."}]" background="default" label="FAQ">

Common questions about labelling AI images in online shops.

</faq-section>

## The full picture: Compliance 2026/27 in the whitepaper

The AI transparency obligation is one of nine rules now hitting online shops
between 2026 and 2027 — and it is the only one that does not come from
classic e-commerce law, which is why it is missing from so many project
plans.

<whitepaper-teaser slug="e-commerce-compliance-2026-27">



</whitepaper-teaser>

## Checklist

Five points you can work through without a legal department:

1. **Inventory:** which images in the shop are AI-generated, AI-edited or
real photographs? If nobody can answer that, that is the first finding.
2. **Classification:** run the two stages per image type — does it resemble
something existing, and would it be taken for a real photograph?
3. **Provenance field:** add a field to the media entity and make it binding
in the image workflow, supplier images included.
4. **Output:** notice at the image, in the gallery and in the listing —
visible and accessible, not only in the alt text.
5. **The UWG test:** does the image show the product as it will be delivered?
If not, no label helps — then you need a different image.

If you would rather not work through this on the side: we do the inventory
analysis and the technical implementation in Shopware as part of
[consulting](/en/services/consulting) or directly in
[development](/en/services/development). [Get in touch](/en/contact) — a
conversation with the people who also build it.

## Sources and further reading

- [AI Act (EU) 2024/1689, Article 50 — Transparency obligations](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50)
- [AI Act (EU) 2024/1689, Article 3 — Definitions (No 60 deep fake)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3)
- [AI Act (EU) 2024/1689, Article 99 — Penalties](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99)
- [European Commission: Guidelines on transparency obligations under Article 50](https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations)
- [European Commission: Code of Practice on Transparency of AI-generated Content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content)
- [Section 5 UWG — misleading commercial practices](https://www.gesetze-im-internet.de/uwg_2004/__5.html)

## Keep reading

- [E-commerce deadlines 2026/27: every date at a glance](/en/insights/e-commerce-deadlines-2026-27)
- [Warranty label 2026: the EmpCo duty and Shopware 6 implementation](/en/insights/warranty-label-shopware-6)
- [AI in software development: what agency size has to do with it](/en/insights/ai-software-development-agency-size)
- [Consulting: decisions on a data basis](/en/services/consulting)