Home / Answers / Deepfake disclosure evidence (Art. 50(4))
EU AI Act · Article 50(4) · Deepfakes
What evidence should I keep for deepfake & AI-content disclosure under Article 50(4)?
What Article 50(4) requires
Article 50(4) places the obligation on deployers, and covers two cases:
- Deepfakes — where an AI system generates or manipulates image, audio, or video that appreciably resembles real people, objects, or events and would falsely appear authentic, the deployer must disclose that it is artificially generated or manipulated.
- Public-interest text — where AI-generated or manipulated text is published to inform the public on matters of public interest, the deployer must disclose it is AI-generated — unless the content underwent human review or editorial control and a natural or legal person holds editorial responsibility.
There is a limited carve-out: where the content is part of an evidently artistic, creative, satirical, or fictional work, disclosure is limited to a manner that does not hamper the display or enjoyment of the work. The obligations apply from 2 August 2026.
Why proving the disclosure matters more here
Deepfakes and public-interest content are exactly the material that gets challenged, shared out of context, taken down, or litigated. When that happens, “we disclosed it” is worth little without independent proof. A tamper-evident receipt gives you a record that survives the dispute:
| Property | Screenshot / self-written log | Tamper-evident receipt |
|---|---|---|
| Independently checkable | No — requires trusting you | Yes — anyone can verify |
| Tamper-evident | No — editable in place | Yes — any change is detectable |
| Timestamp you can't backdate | No — system clock | Yes — cryptographically anchored |
How to produce the evidence
- Capture the event. At the moment the disclosure, marking, or label is applied, record the exact text or marking, the output's content hash, and the context.
- Fingerprint it. The SDK computes the SHA-256 fingerprint locally — the content never leaves your systems (hash-only, GDPR- and confidentiality-clean).
- Anchor it. Fingerprints are folded into daily RFC-9162 Merkle roots and anchored to the public chain via a public-ledger transaction.
- Verify it — anytime, by anyone. Re-check the receipt against the public chain with the open-source verifier, no account required.
Because the receipt format is an open IETF Internet-Draft implementing the SCITT architecture, the evidence you hold today keeps verifying even if any single vendor disappears.
Keep a receipt for each published deepfake or public-interest AI text that binds the content’s fingerprint to the disclosure and the publication time. See the general Article 50 evidence guide for how 50(1), 50(2), and 50(4) fit together.
Frequently asked questions
Who has to disclose — the provider or the deployer?
Article 50(4) is a deployer obligation: the organization that uses the AI system to generate or manipulate the deepfake or the public-interest text discloses it. (Article 50(2)'s marking obligation, by contrast, sits with the provider of the generative system.)
What about the artistic or satirical exception?
Where the content is part of an evidently artistic, creative, satirical, fictional or analogous work, the disclosure obligation is limited to disclosing the existence of the generated or manipulated content in a manner that does not hamper the display or enjoyment of the work. LedgerProof does not decide whether the exception applies — it produces verifiable evidence of whatever disclosure you did make.
Does this store the deepfake itself?
No. LedgerProof anchors only the SHA-256 fingerprint of the content and the disclosure record. The media or text never leaves your systems — hash-only, GDPR- and confidentiality-clean.
When does the obligation apply?
Article 50 transparency obligations apply from 2 August 2026. Anchoring evidence at publication from now on means the proof already exists if the content is later contested or taken down.
Last updated 1 August 2026 · LedgerProof