11.1 The Regulatory Architecture: Who Is Responsible for What

Most writing about AI influencers and the EU AI Act is wrong in the same specific way. It tells you that you must embed machine-readable marks in everything you generate. That obligation is real. It is not yours.

Almost every compliance mistake an operator makes traces back to this one confusion, so it is worth more than a paragraph. Get the role split right and the rest of this part reduces to a checklist. Get it wrong and you will spend money on obligations that were never yours while missing the one that is.

Two roles, and only one of them is you

The AI Act does not regulate content. It regulates actors, and the same generated image carries different obligations depending on who produced it and who put it in front of an audience.

• A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. This is Google, OpenAI, Black Forest Labs, Runway, ElevenLabs.
• A deployer uses an AI system under its own authority, excluding personal non-professional use. This is you, every time you send a prompt.

You do not build the models. You do not offer them to anyone under your name. You are a deployer, and that single classification decides which of the clauses below you owe.

One boundary is worth naming because it is genuinely unsettled: training a LoRA on your own hardware and keeping it in-house does not make you a provider. Publishing that LoRA, or exposing it as a public service under your brand, plausibly does. That is a question for counsel, not for a book. [AS OF 2026-10]

Article 50(2): not your job, and you cannot do it anyway

Article 50(2) requires providers to mark generated output in a machine-readable format so that it can be detected as artificially generated or manipulated. In practice that means C2PA Content Credentials, SynthID-style pixel or latent watermarks, and embedded metadata. Google applies it to Imagen output. Black Forest Labs applies it to FLUX output. You do not apply it, and you could not apply it correctly if you tried.

Three consequences follow, and one of them is the reason chapter 11.5 exists:

• You cannot claim compliance with it. If a client or a platform asks how you mark outputs machine-readably, the honest answer is that marking is applied upstream by the model provider.
• You cannot rely on it. Every reupload strips metadata. The mark may survive inside the pixels, and detection at the platform layer is imperfect either way. Chapter 11.5 covers the gap between the marking obligation and the reality of reposting.
• Removing it is not an AI Act offense — but it is not free either. The Act does not criminalize third-party watermark removal. Platform rules and the ethics layer in 11.6 do.

Article 50(4): the one that is yours

This is the clause you are actually subject to, and it is short enough to state in full. A deployer of an AI system that generates or manipulates image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. The disclosure is due at the latest at the time of the first interaction or exposure, and it must be clear and visible.

The Act defines a deepfake as content resembling existing persons, objects, places, entities, or events that would falsely appear to a person to be authentic or truthful. Read that definition carefully, because it contains the two things operators most often get backwards.

First: "resembling existing persons" is narrower than "AI-generated." A face you invented from scratch fits the deepfake definition more weakly than a lookalike does. The heaviest disclosure duty lands exactly where an operator is least inclined to volunteer it — a persona built from or modeled on a real person. If your persona is a synthetic composite with no real referent, you may sit outside 50(4) as written while remaining inside every platform rule in 11.2. Say that to yourself plainly rather than using it as a reason to skip the label.

Second: the obligation attaches per asset and per surface, not per account. A line in your bio is not a disclosure if the video is served into someone's feed and they never open your profile. In practice that means the platform's own label plus a disclosure that travels with the content — in the caption, on the frame, or in the first seconds of the audio.

The artistic exception is much narrower than it sounds

The Act carves out an exception for content that is part of an evidently artistic, creative, satirical, fictional, or analogous work. Read closely, because it does not waive the obligation. It relaxes the manner: disclosure must be given in an appropriate way that does not hamper the display or enjoyment of the work.

So the question is never "do I qualify for the exception." It is "which form of disclosure preserves the work," and the answer still includes a disclosure.

This is why advertising sits far from the exception, for three stacked reasons:

1. A paid product post is not a work with an audience that came for the work.
2. "Evidently" carries the whole exception. A persona presented consistently as a real person, with no frame that signals fiction, fails that word.
3. Commercial speech has its own regime, with its own rules and its own enforcement — chapter 11.3 — and that regime has no artistic exception at all.

A test you can apply in ten seconds: if a reasonable viewer saw the content, the payment behind it, and the persona's whole account history, would they feel misled? If yes, the artistic framing does not hold.

Article 50(1): the chatbot clause

Providers of AI systems intended to interact directly with natural persons must ensure users are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed person. The obligation sits with the provider, but the surface it applies to is yours: your automated DM replies.

A persona that answers fans in character, at length, in a voice that reads as human, is the textbook scenario this clause was written for. "Obvious" is the operative word, and a photoreal generated face plus fluent conversational replies does not read as obvious to most users.

The rule that satisfies it and costs you nothing: the first message of every new conversation carries the disclosure, in the persona's voice, and that message stays in the conversation log rather than living only in a profile bio nobody opens. Chapter 11.3 gives the wording.

Penalties

Non-compliance with the transparency obligations falls under the Act's second-highest penalty tier: up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs and startups, the lower of the two applies. [AS OF 2026-10]

Two honest observations about that number. For a solo operator, 3% of revenue is a small sum, which is exactly why it is the wrong thing to focus on. The real cost of an enforcement action against a one-person business is the action itself: the named decision, the platform consequences, and the fact that it becomes the example. Enforcement runs through national market surveillance authorities, and as of this writing there is no publicly reported action against an individual persona operator. [UNVERIFIED] That absence is not a strategy — the first case will be selected to be instructive.

Reach beyond the EU

The Act applies to providers and deployers established in third countries where the output produced by the system is used in the Union. A US or UK operator with EU followers is therefore plausibly in scope for the content those followers see.

The operational rule is simpler than the legal one: if EU users see it, assume EU rules apply, and disclose. The cost of over-disclosing is one line of text. The cost of under-disclosing is the section above.

What the AI Act does not cover

This is the part that saves you from expensive mistakes in both directions. The AI Act is the newest and loudest layer of the stack, and it is rarely the layer that ends an account. It does not govern:

• Publicity and likeness rights. Using a real person's face, or a recognizable derivative of it, is a separate legal question with its own remedies. Chapter 11.4, and 11.7 for Poland and the EU.
• Personal data. Faces are personal data. Chat logs are personal data. Chapters 11.4 and 11.7.
• Copyright. What you may train on, and what you own in the output, is copyright law plus each vendor's terms. Chapter 11.4.
• Advertising and consumer law. The FTC's endorsement rules and EU consumer rules bite harder and faster than a market surveillance authority. Chapter 11.3.
• Platform rules. Instagram, TikTok, and YouTube are private contracts. They can remove your reach, your account, and your income this afternoon, with no court and no appeal to a regulator. Chapter 11.2.

Over-complying with the AI Act while ignoring those five is the most common shape of failure in this part of the field.

Where this goes wrong

Concluding the role split means you have no duty. It means you have a different duty. The deployer clause, 50(4), is the one that reaches you, and it applies per asset.

Copying a checklist written for a model vendor. Half of what circulates as "AI Act compliance" describes provider obligations. Applying it costs you money and teaches you the wrong mental model.

Reading the artistic exception as an exemption. It relaxes form, not existence.

Treating a profile label as universal disclosure. Content travels; bios do not.

Assuming the timeline is final. The high-risk obligations were proposed for delay into 2027 and 2028. The transparency layer that applies to generated content was not part of that proposal — and that is the part that matters to you. Chapter 12.5 sets up the quarterly check so you notice the next change before it costs you. [AS OF 2026-10]

Confusing "no enforcement yet" with "compliant." Those are different sentences, and only one of them is a fact.

The gate

You have this chapter when you can answer all six without looking anything up:

1. Are you a provider or a deployer, and why?
2. Which of your creations constitute a deepfake under the Act's definition?
3. For each one, what form of disclosure survives the surface it is published on?
4. Which clause covers your DM chatbot, and where does the disclosure appear in the flow?
5. Which five layers of law and policy sit outside the AI Act, and which chapter covers each?
6. Who disclosed last, and where is that recorded?

If question six has no answer, you do not have a process — you have good intentions plus a deadline. Chapter 11.5 builds the register that answers it.

What you leave with

A role classification, the clauses that apply to generated content and which of them are yours, a working definition of a deepfake, and the map of what this part covers versus what belongs to the other legal layers. The register that turns all of it into evidence comes in 11.5; the disclosure text you paste into your posts comes in 11.3.