What changes on 2 December 2026 for AI images in your store?

On 2 December 2026 a deadline from the EU AI Act (Regulation (EU) 2024/1689) ends. It concerns the providers of older AI systems and only the machine-readable marking in the file, not the visible label in your store. This guide shows what exactly happens on that day, why nothing changes in your obligation as a merchant, and what is worth doing before and after the date. To see what Article 50 requires overall, read the guide on it.

What happens on 2 December 2026?

The Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026) added a new paragraph 4 to Article 111 of the AI Act (Article 1 point 39(b)). It reads:

“Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.”

This sets three limits:

• Who: only providers, meaning whoever develops an AI system or has it developed and places it on the market under their own name (Article 3(3)), such as the makers of image generators.
• What: only the machine-readable marking under Article 50(2).
• Which systems: only those placed on the market before 2 August 2026. Recital 38 of the Omnibus calls this a transitional period of four months. Systems newly placed on the market from 2 August 2026 do not get the extra time. In its guidelines of 20 July 2026, the Commission describes a targeted grandfathering rule only for the marking and detection obligations under Article 50(2) (para. 153).

On the same day, two prohibitions that the Omnibus added to Article 5 of the AI Act start to apply: for AI systems that generate intimate images of identifiable people without their consent, and for systems that generate child sexual abuse material (Article 113, third paragraph, point (a), as amended by Article 1 point 40(a)). They have nothing to do with labelling product images.

Does your obligation change?

No. If you use a ready-made AI tool for store images, you are a deployer (Article 3(4) AI Act). As a deployer, Article 50(4) requires you to disclose that an image has been artificially generated or manipulated if it is a deepfake: an AI image that resembles existing persons, objects, places, entities or events and would falsely appear to be authentic (Article 3(60)). This has applied since 2 August 2026; the information must be clear and distinguishable and provided at the latest at the time of first exposure (Article 50(5)).

The Omnibus did not change that. Of Article 50, it only replaced paragraph 7 (Article 1 point 20, codes of practice); paragraphs 1 to 6 and the deepfake definition are unchanged. It contains no transition period for deployers: Article 111(4) names only providers and only Article 50(2), and the new dates of application in Article 113 do not concern Article 50.

A marker in the file does not take the disclosure off your hands either. Under para. 117 of the guidelines, you cannot rely on the provider’s machine-readable marking, because it is not immediately clear and distinguishable for people. The label belongs visibly on the image.

What does “machine-readable marking” mean?

Article 50(2) requires providers to ensure that the outputs of their system are “marked in a machine-readable format and detectable as artificially generated or manipulated”. The guidelines read two linked elements into this: a mark that software can extract without human intervention, and a means of detection that lets the origin be established (paras. 69 to 71). As techniques they name, among others, watermarks, metadata, cryptographic provenance methods, logging and fingerprints (para. 73). In image files, what you will mostly come across in practice is a C2PA manifest (Content Credentials) and the IPTC value DigitalSourceType.

Two limits are in the law itself. The technical solutions only have to be effective, interoperable, robust and reliable “as far as this is technically feasible”. And the obligation does not apply to the extent a system performs an assistive function for standard editing or does not substantially alter the input data; the guidelines list examples such as minor colour corrections, removing dust spots and deleting backgrounds that are visible in the original file (para. 92). So even after 2 December 2026, not every image edited with AI will carry a marker.

For you, the marking remains the provider’s job. The only exception is if you develop an AI system yourself or have it developed and put it into service under your own name; then you are a provider to that extent (Article 3(3)).

Which tools already mark today?

The state before the deadline is shown by a measurement on this website’s test bench on 1 September 2026. Each image came from the tool’s official download button, in its native format:

A gap before 2 December 2026 is no finding about the provider: for older systems the transition period is still running. Whether and how providers catch up will only show in a new measurement. The test bench is repeated quarterly, with the next run after 2 December 2026; until then, the values of 1 September 2026 apply. Method and individual values are in the guide Which AI image generators write provenance evidence?

Does the marker reach your store?

A marker only helps as long as it is in the file. Three points decide this, as measured on the test bench:

1. Export path: The same generation carried a C2PA manifest as a native PNG and no marker as a JPEG downloaded from the web interface. A screenshot of a marked file kept no provenance data (1 September 2026).
2. Upload: The original stored in Shopify kept all 34 of 34 markers on 1 September 2026.
3. Delivery: The copies Shopify delivers to visitors are re-encoded. On 30 September 2026, 6 of 38 images with a marker still carried it on the copy; markers that sat only in the C2PA manifest survived on no copy (0 of 31).

According to the guidelines, actors who only disseminate content, such as platforms or hosting services, are not deployers. They are encouraged to preserve the marking without being responsible for it under the AI Act (paras. 16, 98). For you this means: check the original, not the image on the product page. A marker that is found is evidence that AI was involved. A missing marker is no statement, neither about whether the image is real nor about whether it needs a label.

What should you do before and after 2 December?

1. Check your labels now, not in December: realistic AI images have needed the visible label since 2 August 2026. Which ones they are is covered in the guide Which images in your store need an AI label?
2. Keep the originals as they come out of the tool, in their native format. Screenshots and format conversion delete the evidence.
3. Classify images without a marker yourself: whether an image needs a label depends on its content, not on the marker. A file you already have does not change on 2 December 2026; whatever sits in your media library without a marker today will sit there just the same afterwards.
4. Classify older images: under para. 154 of the guidelines, deepfakes generated before 2 August 2026 do not need to be labelled retroactively; the Commission encourages it without expecting disproportionate effort. Record the creation and publication dates. More in the guide Do AI images from before 2 August 2026 need a label?
5. After 2 December 2026, check new images on the original, for example in the free AI image checker: up to 20 images per run, read in your browser, no upload.
6. With many images in your store: an app such as Easy AI Act Image Labels reads the markers on the originals in the Shopify media library and proposes a label; with Unlimited, an automation (off by default) checks new images once a day. You still classify images without a marker yourself, and the decision on every image stays with you.

What applies in Austria and in Switzerland?

Austria: The AI Act applies directly in Austria, including Article 111(4) as amended by the Omnibus. The AI Service Desk at RTR describes the transitional rule in the same way in its FAQ: for systems placed on the market before 2 August 2026, the machine-readable marking under Article 50(2) only applies from 2 December 2026 (retrieved 1 October 2026). On older images, RTR takes a stricter view than the Commission: if content generated before 2 August 2026 is only published or first used on or after that date, the disclosure obligation applies in its view; it recommends documenting the time of creation and publication. As of 30 September 2026, Austria has not designated a market surveillance authority for the AI Act; RTR informs and advises. More in the guide Labelling AI images in Austria.

Switzerland: For a store established in Switzerland, the AI Act does not apply directly, only where the output of the AI system is used in the Union (Article 2(1)(c)). Under para. 13 of the guidelines, that is the case where the store itself foresees dissemination and use in the EU, meaning it directs or authorises it; the guidelines also mention posting deepfakes on the globally accessible internet. Whether that already covers every purely Swiss store is open. Where the regulation applies, the visible disclosure has applied since 2 August 2026 just as for a store in the EU, and 2 December 2026 brings no deadline of its own here either. Swiss law itself, according to the legal baseline analysis of the Federal Office of Justice of 31 August 2024, in principle contains no labelling obligation for AI-generated content. More in the guide Labelling AI images as a Swiss shop.

What Article 50 asks of your store overall is covered in the guide Do I have to label AI images in my online store?