Do I have to label AI images in my online store?

Since August 2, 2026, Article 50 of the EU AI Act (Regulation (EU) 2024/1689) has applied to online stores with no transition period. This guide covers your role, the image types, the form of the label, and the limits of software, with a seven-step decision path at its center.

Does this apply to me as a store operator?

The AI Act distinguishes two roles. Providers (Anbieter) develop an AI system or place it on the market under their own name. Deployers (Betreiber, Article 3(4) AI Act) use an AI system under their own authority in a professional context. If you use Midjourney, Firefly, Canva, Magnific, or the Shopify image editor for store images, you are a deployer (Commission Guidelines C(2026) 5054 of July 20, 2026, para. 12).

You cannot hand this role off to an agency as long as you decide whether and how AI is used (para. 14). You only become a provider if you train a model yourself or fine-tune an existing one with your own data and use it under your own name (para. 11). Territorially, your place of establishment counts: deployers established in the Union are covered no matter where they ship (Article 2(1)(b)); a store established in a third country (Switzerland, the UK, the US) is covered as soon as it visibly targets EU customers (Article 2(1)(c), para. 13).

What has applied since August 2, 2026, and what did the Digital Omnibus change?

Article 50 has applied since August 2, 2026. The Digital Omnibus (Regulation (EU) 2026/1744 of July 8, 2026, in force since July 27, 2026) mainly postponed high-risk deadlines; Article 50(1) to (6) and the deepfake definition in Article 3(60) were left unchanged. What is new is Article 111(4): providers of AI systems placed on the market before August 2, 2026 have until December 2, 2026 to comply with Article 50(2). It applies to providers only, and only to the machine-readable marking; your visible disclosure has no grace period.

What do I have to do as a store, and what does the provider of my AI tool have to do?

Article 50 contains two separate obligations with two separate addressees:

So writing C2PA metadata is not your job. And a marker inside the file does not satisfy your obligation, because viewers cannot see it clearly and distinguish it (para. 117); there has to be something visible on the image itself.

What does “looks real” mean?

Article 50(4) applies to deepfakes within the meaning of Article 3(60) AI Act. The guidelines name four cumulative criteria (para. 113): an appreciable resemblance to the simulated subject; the subject exists, could plausibly exist, or could have existed; it is a person, object, place, entity, or event (“objects” includes consumer goods, “persons” includes realistic AI avatars); and the image would falsely appear to be authentic, judged objectively by context and audience, without any intent to deceive being required.

The artistic exception is of little practical use in a store: recognizably commercial or informational content does not fall under it, and even where it applies, the obligation does not disappear but shrinks to a form that does not hamper the display or enjoyment of the work (paras. 120 to 122).

Which images do I have to label?

It is not the technology that decides but the capacity to deceive. The classification follows the example catalogs in the guidelines (paras. 113 to 116):

For existing catalogs this means: “Remove background” or “Generate background” in the Shopify image editor on a real product photo is standard editing under para. 116 and usually needs no label. If the AI changes how the product looks, the image needs at least the “AI MODIFIED” label.

For the disputed cases there is no court decision in Germany, Austria, or Switzerland as of August 31, 2026. The Wettbewerbszentrale (Germany’s Centre for Protection against Unfair Competition, AI complaints office since July 28, 2026) and the Schutzverband gegen unlauteren Wettbewerb (its Austrian counterpart, position of February 4, 2026), two of the main sources of warning letters (Abmahnungen) in their countries, take the broad reading: when in doubt, label photorealistic AI images.

What does the label have to look like?

Article 50(5) requires clear and distinguishable information at the latest at the time of first interaction or exposure, per image and to every viewer (para. 143). Notices buried in menu levels or terms of use are not enough (para. 142).

With the Code of Practice on Transparency of AI-generated Content of June 10, 2026, the European Commission provides official icons: a base icon with the abbreviation “AI” plus “AI GENERATED” (no source photo) and “AI MODIFIED” (real photo, substantially altered). They are free to use, and optional; the obligation under Article 50 is not optional (Commission page, as of August 10, 2026). For placement, the Code names a spot free of overlapping elements, for example the top right corner of the image (Sub-measure 1.2.2(a)), and a UI overlay in the store as an equivalent alternative to the burned-in icon (Sub-measure 1.2.1(c)). “For illustration purposes only” is not enough: the phrase says nothing about AI origin.

What about images from before August 2, 2026?

The text of the regulation has no grandfathering for individual images. In its FAQ on Article 50 (accessed August 31, 2026) the Commission writes that content generated before August 2, 2026 does not have to be labeled retroactively, and at the same time encourages deployers to do so. That is the view of an authority, not a legal rule. For images you already had before that date you can follow this view; in a dispute you would have to show when an image was generated. Old AI images you keep showing remain covered under the text of the regulation, and the Commission recommends labeling them. If you are going through the catalog anyway, take the older images along. The legal position is uncertain as of August 31, 2026.

What happens if I do not label?

In Germany, under the KI-MIG (AI Market Surveillance and Innovation Act, signed July 22, 2026, BGBl. 2026 I No. 223), the Bundesnetzagentur (Federal Network Agency) is the market surveillance and complaints authority. Fines are possible, with a lower range for small and medium-sized enterprises (Article 99(6) AI Act); as of August 31, 2026 there are no known proceedings against stores.

The more realistic risk: Article 50(6) leaves unfair competition law untouched. In its guide (version 2, as of July 29, 2026) the Wettbewerbszentrale takes the view that violations of the AI Act can also be unfair competition under the German Unfair Competition Act (UWG) and has run an AI complaints office with an online form since July 28, 2026. And regardless of the AI Act: an AI image that shows the product differently from what is delivered is a misleading statement under Section 5 UWG, labeled or not. An AI label does not cure a misleading claim.

How do I go about it in practice?

Per image or group of images, not as a blanket rule for the store:

1. Clarify establishment and target market. Established in Germany or Austria: covered. Established in Switzerland, selling only to Switzerland: AI Act not applicable; according to the Federal Council’s baseline analysis of February 12, 2025, Swiss law generally has no labeling obligation, but deception about the product triggers Article 3(1)(b) of the Swiss Unfair Competition Act (Swiss UWG, not the German one). Established outside the EU but targeting EU customers: covered.
2. Clarify your role. Using a ready-made tool: deployer, paragraph 4 only. Trained or fine-tuned your own model: paragraph 2 as well. With agencies, the contract governs which images are AI and who applies the label.
3. Classify the image type using the table above.
4. Decide the disputed cases. When in doubt, label.
5. Cross-check against unfair competition law. Does the image show the product as delivered? If not, no label helps: the image is a misleading statement under Section 5 UWG and has to be replaced.
6. Apply the label: visible label on the image plus alt text. For images that leave the store (ads, social, marketplaces), a burned-in label, because no theme travels with them; check marketplace rules first.
7. Document. Which images are AI, which tool, which label. Non-signatories of the Code have to be able to explain their measures to the market surveillance authority (para. 148).

Can software find AI images automatically?

Only in part, and the limit lies with the generator. Many generators write a provenance marker into the file when saving (C2PA/Content Credentials, IPTC DigitalSourceType). A marker that is found is evidence of AI origin. A missing marker says nothing: the image could be a real photo, an AI image whose generator wrote no marker, or an AI image whose marker was lost in a screenshot, a format conversion, or re-encoding. In a test series run by lakör on September 1, 2026 across 47 image models from an aggregator catalog (Magnific, via API), 34 outputs carried a signed marker and 13 did not. With the Shopify image editor, the saved original carried no marker (measurement of September 1, 2026); whether Shopify sets none or loses it on save cannot be determined from the outside. Until December 2, 2026, gaps with older generators are to be expected anyway (Article 111(4), see above).

What can be checked is the marker on the original. The copies Shopify delivers in the storefront mostly no longer carry the marker, because they are re-encoded for delivery: in the measurement of September 1, 2026, 5 of 34 copies still carried a marker; in a follow-up measurement on September 10, 2026 via the image URL, 0 of 3 did; the untouched original remains reachable through the Admin API. An app like Easy AI Act Image Labels therefore reads the originals, proposes a label for each hit, and leaves the decision with you; images without a marker you have to identify and label yourself. A probability detector, by contrast, only delivers a hint and can be wrong on real product photos. What a marker shows and what it does not is covered in the detection taxonomy; which images a check cannot reach is described on the Limits page.

The label remains your decision and your responsibility as a deployer; no tool, no Code signature, and no marker takes it off your hands.