No Label Doesn't Mean Real: What AI and Retouching Labels Cover in 2026

Two kinds of label

It helps to separate them. A machine-readable mark is a watermark or a metadata record that software can find: SynthID, or the C2PA Content Credentials attached to a file. A visible label is the badge or caption a person actually sees, such as "AI info" on Instagram. A file can carry the first without ever showing the second.

The EU AI Act asks for both, from different people. Under Article 50, which has applied since August 2, 2026, the providers of generative tools must mark their output in a machine-readable way (tools already on the market before August 2 have until December 2 to comply), and deployers who publish a deepfake must disclose that it was generated or manipulated.^2,3 The Act defines a deepfake as AI-generated or manipulated image, audio or video that resembles existing persons, objects, places, entities or events and would falsely appear real.² The Commission published a voluntary code of practice on June 10 and guidelines on July 20.³ Before the guidelines were final, the Commission's draft said AI-manipulated images showing real people in fabricated situations will most likely qualify, while routine fixes such as colour correction will not.⁴ Breaches can draw fines of up to €15 million or 3% of worldwide turnover, whichever is higher.²

Two limits matter for anyone reading their feed. Article 50 exempts tools that only assist with standard editing. And a "deployer" excludes someone using AI in the course of a personal, non-professional activity.² A stranger posting a fake for their own reasons may owe no label at all.

What platforms actually show

Meta labels images when it detects the industry-standard "AI generated" signals in C2PA or IPTC metadata. It requires people to self-disclose only for photorealistic video and realistic-sounding audio, not still images. Its own announcement concedes that "it's not yet possible to identify all AI-generated content" and that invisible markers can be stripped out.⁵ TikTok has auto-labelled uploads carrying Content Credentials since May 2024.⁶

How that holds up in practice was tested by The Washington Post in October 2025. It uploaded an AI-generated video to eight social apps. Only YouTube said anything, and that disclosure sat in the description where few would see it. None of the eight kept the video's Content Credentials or let users view them.⁷

The newest rule is at the level of the account, not the photo. On August 31, Instagram renamed its optional "AI creator" tag to "AI-generated profile," for accounts that feature an AI-generated person, and said accounts that skip it may see their reach limited.⁸ That tells you something about a persona. It tells you nothing about an individual photo posted by a human account.

Retouching has labels too, in two countries

Long before AI, two countries required labels on edited photos of people in ads. In France, since October 1, 2017, commercial photos of models whose silhouette has been slimmed or thickened by software must carry the words "photographie retouchée." The fine is €37,500, rising to 30% of the advertising spend, and TV ads are outside the rule.⁹

Norway went further. Since July 1, 2022, any advertising in which body shape, size or skin has been altered must carry a standard label, and that includes paid influencer posts. The face counts as part of the body, filters count as manipulation, and the consumer authority's guidance says removing a single pimple is enough to trigger it. The label has to cover about 7% of the image, in the top-left corner.¹⁰ The guidance says nothing about AI-generated people.

Japan has no legal duty to label AI-generated images or retouched ads in commercial or personal use. The government's AI business guidelines, revised to version 1.2 on March 31, 2026, are soft law with no penalties.¹¹ The exception is elections. An amendment to the Public Offices Election Act, passed in July 2026, will require AI-made or altered images that could be mistaken for real footage to be labelled when used in campaign materials, from March 1, 2027.¹²

Why a missing label proves nothing

Put those rules together and the unlabelled photo of a person in your feed has many innocent and not-so-innocent explanations:

• It came from a tool that marks nothing, such as an open-weight model run at home.
• Its provider is still inside the EU grace period for marking, which runs to December 2.
• It was marked, and a screenshot or re-upload removed the metadata.
• It kept an invisible watermark that the platform does not read or display.
• The person who posted it is not a "deployer" under the AI Act, or is outside the EU.
• It is retouched rather than generated, and is not an ad in France or Norway.

A label, when you see one, is real information. Its absence is the default state of most images online, and it says close to nothing. That is the same asymmetry we described for SynthID Detector's "not detected" result, now written into law.

What to do with an unlabelled photo

If a photo of a person matters to you, because you are about to share it, buy from it or believe it, check it yourself. Look for the earliest copy with a reverse image search, since the original may still carry its label or credentials. Run it through SynthID Detector, which reads marks that platforms do not display. Then look at the image itself. Maat Scan, our own service, scores photos of people from 0 to 100 for signs of AI generation or editing. The score is a statistical reference, not a verdict, and it cannot tell you whether any rule applied.

One request, from a company that makes such a tool. Editing is common, and a score is not a finding about a person. Use it to put an image in context, not to call out a creator in public.