RecruitmentAds.com

Guide

EU AI Act Article 50 and AI-generated recruitment ads

The platform's automatic AI label does not discharge your Article 50(4) duty. Here is what each platform actually does, and what an employer or agency still owes on top of it.

Niels Geominy14 min readLaw checked 5 August 2026

The short answer

No. Meta's AI info tag, LinkedIn's Content Credentials icon, TikTok's AIGC label and YouTube's altered-content disclosure are platform policy, not compliance with Article 50(4). The Commission says a deployer cannot rely on machine-readable marking to meet its own labelling duty.

On top of that, none of them will actually appear on an AI-avatar job ad. Automatic labels fire when the platform reads a C2PA or IPTC manifest, and no mainstream synthetic-presenter tool writes one.

Article 50 has applied since 2 August 2026 and was not delayed by the Digital Omnibus. The four-month grace period that was granted runs to 2 December 2026, is provider-side, covers machine-readable marking only, and does not touch the deployer duty.

So the visible label is yours to add: on the asset, from the first frame, in a place a candidate cannot miss.

What actually changed on 2 August 2026

Article 50 of the AI Act became applicable on 2 August 2026. It was not delayed. That single fact invalidates most of what is currently published about AI-generated advertising in the EU, because the Digital Omnibus on AI did delay something, and it is routinely reported as having delayed everything. The Omnibus is Regulation (EU) 2026/1744, adopted 8 July 2026, published in the Official Journal on 24 July 2026, in force since 27 July 2026.

What it deferred was the high-risk regime. Annex III moved from 2 August 2026 to 2 December 2027, and Annex I embedded products to 2 August 2028. These are fixed calendar dates; the conditional, standards-readiness trigger the Commission originally proposed was dropped in negotiation. Annex III point 4 is the employment entry, which is why so much recruitment-technology content built its 2026 urgency on the wrong provision.

Article 50 sits outside that structure entirely. It attaches to a functional category (systems that interact with people, generate synthetic content, infer emotions, or produce deep fakes) rather than to a risk classification. That is precisely why the deferral missed it.

The one grace period, and its exact boundaries

A new Article 111(4) gives generative systems that were already on the market before 2 August 2026 until 2 December 2026 to comply. Read the scope carefully, because three limits all apply at once:

  • It is provider-side. It relieves the vendor of the generation tool, not the employer or agency using it.
  • It covers the Article 50(2) machine-readable marking duty only. The Commission's guidelines add that a system which is partly interactive and partly generative gets the extension for marking alone; the Article 50(1) duty to make clear a person is dealing with an AI bound it from 2 August regardless.
  • It applies to legacy systems only. Anything placed on the market on or after 2 August 2026 had no transition at all.

The Article 50(4) deployer disclosure duty has no grace period. If you are an employer or an agency running AI-generated creative in the EU, you have been obliged since 2 August 2026. There is nothing to wait for.

One related point on retroactivity, because it is the first question finance asks: content generated before 2 August 2026 does not have to be marked or labelled retroactively. Text generated before that date but published on or after it does. Holders of pre-existing unlabelled deep fakes are encouraged, not required, to label them, and the Commission expressly does not expect disproportionate efforts such as auditing back catalogues or reprinting packaging.

Two obligations, two different parties

Almost every confusion in this area comes from collapsing two duties that the AI Act keeps rigidly apart.

Article 50(2) is the provider's duty. Providers of systems generating synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, effective and robust so far as technically feasible. Recital 133 lists the acceptable techniques: watermarks, metadata identification, cryptographic provenance, logging, fingerprints, or combinations. Providers are not required to maintain a full provenance chain, which means C2PA-style provenance is sufficient but not mandatory. A separate detection duty runs alongside it: the provider must give people exposed to the content a way to check, producing human-readable results.

Article 50(4) is the deployer's duty. Deployers of a system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. Article 50(5) then governs how: clearly and distinguishably, at the latest at the time of first exposure, accessibly.

A recruitment marketer is a deployer. Your generation vendor is a provider. Discharging their obligation does not discharge yours, and the Commission says so in terms: deployers "cannot rely on the machine-readable marking embedded in the content by the provider under Article 50(2)", because those markings are not immediately clear and distinguishable (guidelines C(2026) 5054, para 117).

That sentence is the whole answer to the platform question, and we will come back to it.

A photorealistic presenter who is nobody at all is still a deep fake

This is the finding most commentary gets wrong, and it decides whether the obligation applies to you.

Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video content that "resembles existing persons… and would falsely appear to a person to be authentic or truthful". Read casually, "existing persons" sounds like it means a real, identifiable individual, so a wholly invented synthetic presenter would be outside the regime.

The Commission's guidelines of 20 July 2026 read it far more broadly. At para 113, it is enough that a simulated person resembles someone who "can plausibly exist", with the exclusion drawn only at content defying the laws of nature or physics. And "persons" is defined to include "realistic AI-generated human avatars or personas", alongside digital replicas of real people and personal characteristics such as image, voice and behaviour.

The Commission's own list of worked examples includes a realistic synthetic avatar of a company CEO addressing employees about the year's results. That is, structurally, the employer-brand video half this industry is currently producing.

Three further points from the same guidelines change how you assess your own creative:

  • No intention to deceive is required. The assessment is objective.
  • The audience is the reasonably foreseeable one, not an average viewer, with explicit attention to people with lower digital and AI literacy. A candidate audience is broad by definition.
  • Photorealism is indicative, not determinative. This is the practical lever, and the only clean exit: a deliberately stylised or illustrated treatment can take an asset outside Article 50(4) altogether.

Minor manipulation stays out. Background edits, lighting, colour correction and cosmetic adjustments have only a minor impact, and the guidelines expressly include background replacement for clearly aesthetic purposes in product advertising. Composite scenes that change how people are represented do not benefit from that.

The artistic carve-out will not rescue a job ad

Article 50(4) softens the disclosure where content is evidently artistic, creative, satirical or fictional: the disclosure must then be given in a way that does not hamper enjoyment of the work. It is widely over-read.

The guidelines say these categories are interpreted strictly, that content whose nature is exclusively informative or commercial and recognisable as such is excluded, and that where characters mix, the informative character prevails. Advertisements might qualify in specific situations, but not as a class. A vacancy advertisement is commercial and informative at the same time. Assume the full label applies.

Does the platform's automatic AI label discharge your obligation?

This is the question everyone in recruitment marketing actually has, and it has two independent answers, both of which are no.

The legal answer is para 117: a deployer cannot lean on provider-side marking, because the label has to be understandable and perceivable by people without any specific technical tools. A platform tag derived from embedded metadata is exactly the thing the Commission ruled out. Add para 142 to 143, which say a disclosure is not clear and distinguishable where it can be easily overlooked under normal conditions (naming menus and terms of use as examples), and platform labels that live behind a three-dot menu or in an expanded description fail on placement as well as on principle.

The engineering answer is worse, and almost nobody has checked it: the label will not appear at all.

Automatic platform labelling is not detection. It is manifest reading. Meta labels an ad because the file carries C2PA or IPTC provenance saying it is synthetic. If the file carries nothing, nothing happens. And no mainstream AI-avatar tool embeds C2PA: Synthesia, HeyGen, D-ID, Colossyan, Elai and Argil are all absent from the conformance list, as are Midjourney, Runway, Stability AI, ElevenLabs and Canva. A synthetic employee testimonial made in any of them ships with no cryptographic provenance whatsoever. There is no manifest for LinkedIn or Meta to read, so no automatic label is generated.

Which means the reassuring mental model ("the platform will flag it, so we're covered") is wrong twice over. It would not be sufficient if it fired, and it does not fire.

Platform labels against Article 50(4), one by one

Every one of these mechanisms is real, and every one of them is a platform rule with a platform remedy. None of them is the disclosure Article 50(4) asks you for. The last column is what is left for you to do after the platform has done everything it does.

Meta

Paid ads (Facebook, Instagram)

What its label actually is
Auto-applied. Meta reads C2PA and IPTC provenance and files the result under the three-dot menu, in About this ad, as AI info. There is no advertiser disclosure duty for general ads.
Discharges Article 50(4)?
No, and it will not appearA label two taps deep in a menu is not clear and distinguishable at first exposure, and there is no manifest in an avatar file for Meta to read in the first place.
What you still owe
A visible label burned into or overlaid on the creative itself, present from the first frame.

Meta

Organic posts

What its label actually is
Self-declared through Meta's AI disclosure tool. Required for photorealistic video and realistic-sounding audio; Meta's own wording is that the requirement does not apply to images.
Discharges Article 50(4)?
NoIt is a platform rule with a platform remedy. Setting the toggle is evidence of good faith, not compliance with a regulation that specifies where and how the disclosure must appear.
What you still owe
Set the toggle, then label the asset anyway, including on the images Meta's own rule exempts.

LinkedIn

Sponsored and organic

What its label actually is
No self-declaration mechanism exists. The Ads Policies do not mention AI at all; the hook is the Professional Community Policies, which prohibit undisclosed synthetic media showing a person saying something they did not say. C2PA Content Credentials are displayed passively where present, including on Sponsored single-image and video ads.
Discharges Article 50(4)?
No, and it will not appearThe thinnest ruleset of any major platform, on the platform that matters most for recruitment. Passive display of Content Credentials does nothing when the file carries none.
What you still owe
Everything. LinkedIn gives you no mechanism, so the entire Article 50(4) disclosure has to live in the creative.

TikTok

Organic and paid

What its label actually is
AIGC label, applied by the creator, required for realistic-looking scenes or people. Can be satisfied by the label, a caption, a watermark or a sticker.
Discharges Article 50(4)?
NoThe closest of any platform to the right shape, because it is creator-applied and visible. It is still assessed against TikTok's rules, not against Article 50(5).
What you still owe
Apply the AIGC label, then check it survives the Article 50(5) test: visible at first exposure, and repeated where a viewer may join partway.

YouTube

Organic and paid

What its label actually is
Altered or synthetic content disclosure, set in YouTube Studio. Shown in the player for sensitive topics; otherwise it sits in the expanded description.
Discharges Article 50(4)?
NoA recruitment ad is not a sensitive topic, so the disclosure lands in the expanded description, which is exactly the kind of placement the Commission treats as easily missed.
What you still owe
Set the disclosure, and put a visible label in the video itself rather than relying on the description.

Google Ads

Search, Display, Demand Gen

What its label actually is
No general AI-disclosure requirement. The only applicable policy is Misrepresentation, which covers manipulating media to deceive. Election ads have their own altered-or-synthetic-content setting; employment ads do not.
Discharges Article 50(4)?
NoThere is nothing here to discharge anything. The absence of a platform rule is not the absence of a legal duty.
What you still owe
The full visible label, unassisted.

One thing the matrix does not say, because the research could not verify it: nothing here establishes that LinkedIn operates a restricted targeting regime for employment ads comparable to Meta’s or Google’s. That claim circulates widely in HR content. We could not substantiate it, so we do not repeat it.

What a compliant label actually looks like

Six decisions, in order. The first one is the only one that can remove the obligation rather than satisfy it.

  1. Decide whether the asset is a deep fake at all

    Photorealistic humans are in scope, including invented ones. Stylised, illustrated or obviously unreal characters fail the falsely-appear-authentic limb and fall outside Article 50(4) entirely. Choosing a non-photoreal treatment is a legitimate way out of the obligation, and the only one that survives contact.

  2. Work out whether you are the deployer

    Whoever decided to use the tool and controlled how it was used is the deployer. An employer that briefs an agency and never touches the system is not one; the agency is. An employer running the tool itself is. Both can be deployers on the same campaign, independently.

  3. Put the label on the asset, not around it

    The Code of Practice publishes a free EU icon and specifies the capitalised acronym AI as the main visual element, optionally with generated or modified. Place it where no overlay elements intrude, such as the top-right corner. Ad copy, a caption or a platform toggle is not the label.

  4. Make it survive a scrolling candidate

    For video: at the start, at regular intervals, and at minimum after any interruption such as an ad break. First exposure is assessed per person, so a start-only label fails for anyone who joins a loop midway. For audio-only, a spoken disclaimer at the start in plain language.

  5. Check the ad is honest without the label

    Disclosure does not cure deception. If the ad only works because a viewer believes the synthetic presenter is a real employee describing a real job, the label does not save it; it documents it.

  6. Keep the record

    Which tool generated what, who approved it, which label was applied, and the role-appropriate AI-literacy briefing given to whoever operated the tool. Article 4 is now an obligation to take measures, so evidence of the measure is the compliance.

If a real person’s face or voice is driving the generation, the label is the easiest of your problems. Data-protection lawful basis and national likeness rights are stricter and more enforceable than Article 50, and a standard photo release does not cover synthetic generation. Our employee photo release form generator covers the AI-specific clauses for NL, DE, FR, the UK and the US.

A note on provenance technology, since it is being sold as the answer

Content Credentials are worth shipping, and we intend to. They are not a compliance shortcut, and the honest version of the story has to include the caveats.

The conformance programme is behind its own specification: the current spec is C2PA 2.4, and the products on the conformance list are certified against 2.2, with the overwhelming majority at the lowest assurance level. More seriously, an April 2026 security analysis co-authored by researchers from Hacker Factor, UMBC and the NSA concluded that the specifications "should not yet be relied upon for high-stakes uses", citing optional revocation checking, forgeable timestamps, validators returning contradictory verdicts on the same file, and certification based largely on self-reported compliance.

The reasonable position: provenance marking is necessary and not sufficient. It is the provider's Article 50(2) duty and it should be done properly. It is not, and was never going to be, the deployer's visible label.

The label does not make a misleading ad lawful

Two authorities converge here, and the practical consequence is larger than the labelling rule itself.

The Commission's guidelines state that labelling does not permit deep fakes that are harmful and unlawful under other Union or national law, expressly naming misleading advertising, and add at para 129 that deployers must still comply with legal regimes protecting personality rights over images and voices. The Code of Practice makes the same point about consent of depicted persons.

The UK's Advertising Standards Authority has already proved it in a decided case. In September 2025 it upheld a complaint against Midnite over an ad that carried an "ai-generated parody" disclaimer and stated the likenesses were fictional. The disclaimer did not save the ad.

Translated into recruitment: a synthetic presenter described as an employee, or a generated workplace that materially misrepresents the actual one, is an advertising problem that a compliant AI label documents rather than fixes. The single most exposed format is the AI-generated employee testimonial: a pictured person whose words appear to be their own, endorsing an employer. It is exposed under advertising law, under likeness rights, and under Article 50(4) simultaneously.

Who is the deployer: you, your agency, or both

Role allocation under Article 50 is unusually clear, and it produces some counter-intuitive results.

  • The agency that operates the tool is a deployer. The guidelines give an advertising company as their example of a corporate deployer, and note that using contractors or freelancers does not shift the role.
  • An employer that merely commissions an agency is not a deployer, where it takes no decisions and exercises no control over whether and how the agency uses AI in production. That is a real allocation of liability, and it is worth putting in the contract deliberately rather than discovering it later.
  • An employer that runs the tool itself is a deployer, and if it builds the system in-house it is provider and deployer at once, owing both the marking duty and the labelling duty.
  • Both can be deployers on the same campaign, independently, where both make deployment decisions.
  • The ad platform is not your deployer. A platform merely disseminating third-party content does not take on the deployer role, though it becomes one when it uses AI for its own purposes, which the guidelines say expressly includes creating visuals for its own marketing material.

Note what this does not say. It does not make the platform responsible for your label. Delegating production to an agency moves the duty; it does not dissolve it.

Does this reach US and UK employers?

Yes, on the Commission's reading, and the reasoning is output-based rather than establishment-based. Article 2(1)(c) catches providers and deployers established in a third country where the output produced by the AI system is used in the Union.

For deployers the guidelines are broad: the transparency obligations apply where the deployer itself foresees dissemination and use of the outputs in the Union, "including by posting deep fakes on the globally accessible internet". The limit is content reaching EU audiences through channels that are unforeseeable and outside the deployer's control: a VPN viewer of a geo-fenced US campaign, for instance.

A US employer deliberately advertising to candidates in the EU is squarely in scope. A UK agency producing an ad for a Dutch client is in scope, and the client may separately be a deployer or not, depending on the commissioning question above. Whether a single incidental EU viewer of a globally accessible post is enough is genuinely contested: the operative article says the output "is used" in the Union while Recital 22 says "intended to be used", no court has construed either, and practitioners disagree. Geo-fencing is a meaningful mitigation. Labelling by default is cheaper than the argument.

The Netherlands: new advertising rules, and an unanswered question underneath them

Dutch recruiters have a second layer, and its applicability to job advertising is genuinely open.

Stichting Reclame Code published rules on AI-generated content on 29 July 2026, in force from 2 August 2026, the same day as Article 50, and built on it. Self-regulation, enforced by the Reclame Code Commissie, with reputational rather than financial consequences.

The unanswered question is whether they reach a job ad at all. The Nederlandse Reclame Code applies to reclame, and the definitional hook for recruitment advertising is thin: the only plausible route is the limb covering the soliciting of services. Whether a vacancy advertisement is reclame in that sense is, as far as we can establish, untested. No decision resolves it.

So the honest Dutch position is: the AI Act binds you either way; the Reclame Code layer may or may not, and nobody can currently tell you which. If you are labelling to the Code of Practice specification anyway, the question is academic. If you were relying on the Reclame Code's silence, it is not.

One structural point that matters more than either. The Netherlands has no implementing law in force. The Uitvoeringswet AI-verordening went through internet consultation in spring 2026 and to the Raad van State in July 2026, but has not been enacted, and no market surveillance authority has been designated. Germany is the opposite case: its implementing act took effect on 29 July 2026, with the Bundesnetzagentur as central market surveillance authority and single point of contact, residually, with sectoral regulators retaining their own competences.

The obligation binds everywhere. The apparatus to fine you does not yet exist everywhere. The Commission's own register of national market surveillance authorities has not been updated since September 2025, and the European Parliament's research service reported eight single contact points out of twenty-seven as of March 2026. For a business operating across NL, DE and the UK, that asymmetry is the operative headline, and it is temporary.

Penalties

Breach of Article 50 sits in the Article 99(4) tier: up to 15 million euro or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups the rule inverts: whichever of the two is lower. Adherence to an adequate code of practice is an express mitigating factor in setting a fine, which is the concrete commercial argument for following the Code of Practice specification rather than inventing your own label.

Worth separating from the headline: Article 50 compliance does not imply lawfulness. The guidelines say a system meeting Article 50 can still be prohibited under Article 5 or classified high-risk. The obligations stack; they do not net off.

What is genuinely contested

Four things in this area are unsettled. Anyone telling you otherwise has not read the guidelines closely.

  • Whether "deep fake" really covers wholly invented photoreal people. The Commission says yes, expansively. That reading arguably writes "existing" out of Article 3(60), and no court has tested it. If a national authority or the Court of Justice narrows it to identifiable real people, the burden on synthetic-presenter products drops sharply. Until then: label, because the Commission says so.
  • Where employer branding ends and a vacancy-specific ad begins. The draft high-risk guidance puts branding outside Annex III point 4 where it does not in practice relate to a vacancy. Real campaigns live in the middle (an always-on brand film linking to a vacancies page, a role-family campaign), and no guidance addresses the middle. The guidelines on this point are also still draft.
  • Whether passive EU viewing triggers third-country scope. Covered above. Operative text and recital pull in different directions and there is no case law.
  • Whether AI-generated imagery in a job ad can itself be discriminatory. EU case law establishes that an employer's public statements about who it would hire can be discrimination with no victim and no vacancy. Imagery is a statement. No regulator, court or guidance anywhere has made that connection, and none has addressed whether synthetic diversity is a misleading representation. It is the clearest white space in the field, and it will not stay empty.

The defensible posture while it is unsettled: treat the demographic composition of generated imagery as a deliberate, documented editorial decision. A record showing a human chose the representation and can say why is defensible. A record showing the output is whatever the model produced is not, and neither is one showing diversity was synthesised to misrepresent the workforce. Both failure modes are evidentially bad, in opposite directions.

What you are probably not: high-risk

Since it comes up in every procurement conversation: generating the creative asset for a job ad is almost certainly not a high-risk activity under Annex III point 4.

The Commission's draft classification guidance explains that placing targeted job advertisements sits in that point because algorithmic tailoring determines who becomes aware of a vacancy. The mischief is targeting and distribution, not creative generation. The guidance also puts employer-branding and generic company advertising outside the point where it does not in practice relate to a vacancy, and its worked example on AI-generated job descriptions draws the line cleanly: exempt as a narrow procedural task where a human supplies the qualification criteria, high-risk the moment the AI generates those criteria itself.

The high-risk actor in the job-ad chain is the ad platform, from 2 December 2027. The line to watch on your own side is a tool that starts scoring candidates, screening CVs or building audiences, at which point the analysis changes completely, and this page stops being the right one. Our companion guide to the EU AI Act in recruitment walks the high-risk classification question end to end.

Common questions

What is Article 50 of the EU AI Act?
Article 50 is the AI Act's transparency regime. It sits outside the risk tiers and attaches to what a system does rather than how risky it is: systems that talk to people, generate synthetic audio, image, video or text, detect emotions, or produce deep fakes. It has four operative duties. Article 50(1) requires providers to make it clear a person is dealing with an AI. Article 50(2) requires providers of generative systems to mark outputs in a machine-readable format. Article 50(3) covers emotion recognition and biometric categorisation. Article 50(4) requires deployers to disclose, visibly, that a deep fake is artificially generated or manipulated. It applies from 2 August 2026.
What is Article 50 of the AI Act omnibus?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It did not delay Article 50. It deferred the Annex III high-risk regime from 2 August 2026 to 2 December 2027 and the Annex I embedded-product regime to 2 August 2028, and it inserted a narrow transitional period to 2 December 2026 for the Article 50(2) machine-readable marking duty, available only to generative systems already on the market before 2 August 2026. Most articles published before July 2026 either miss the deferral or wrongly extend it to Article 50.
What are the Article 50 transparency obligations?
Two of the four matter for recruitment advertising, and they fall on different parties. The provider of the generative tool must mark outputs in a machine-readable format that is effective, interoperable, robust and reliable so far as technically feasible, and must make a detection route available to people exposed to the content. The deployer (the employer or agency that decided to use the tool and controlled how) must disclose visibly that the content is artificially generated or manipulated, in a clear and distinguishable manner at the latest at the time of first exposure. Neither substitutes for the other.
Do you have to disclose AI-generated content?
In the EU, if it contains a photorealistic depiction of a person, yes, and the duty is on you as deployer. If it is AI-written ad copy or a stylised illustration, no visible label is required of you: text is not image, audio or video for Article 50(4) purposes, and the second subparagraph on AI-generated text is limited to material published to inform the public on matters of public interest, which a vacancy is not. The provider's machine-readable marking duty still applies to those outputs.
Does AI have to be labeled?
In the EU, generative output has to be machine-readably marked by the provider, and photorealistic synthetic depictions of people have to be visibly labelled by the deployer. Those are different obligations with different addressees. Outside the EU there is no general labelling statute; what exists is platform policy plus advertising-standards law, and a growing set of narrow national and US state rules. If your ad is seen in the EU, the EU rule reaches you regardless of where you sit.
What are the rules for labeling AI content?
For a deployer under Article 50(4) and (5): the disclosure must be understandable and perceivable by people without technical tools, clear and distinguishable, and given at the latest at first exposure. The Code of Practice on Transparency of AI-generated Content, published 10 June 2026, gives the concrete specification: a free EU icon in its Annex 1, the capitalised acronym AI as the main visual element, placement where no overlay elements intrude such as the top-right corner, and for video a label at the start, at regular intervals and after interruptions. Disclosures hidden in menus, in terms of use or in an expanded description do not qualify.
What is the 30% rule in AI?
There isn't one. No provision of the AI Act, the Commission's Article 50 guidelines or the Code of Practice sets a percentage threshold of AI involvement at which labelling starts. The question circulates widely and has no legal basis. The Article 50(2) exemptions are qualitative, not quantitative: assistive functions for standard editing that do not generate new content, and edits that do not substantially alter input data or its semantics. Cropping, colour correction, sharpening, rescaling and background blurring are named as exempt; face replacement, voice synthesis and inserting or removing people are named as not exempt, at any percentage.
Is it legal to use AI for advertising?
Yes. Nothing in the AI Act prohibits generating advertising creative, and generating a job ad is not a high-risk activity under Annex III. The obligations are transparency obligations. What is separately constrained is using a real person's likeness, which needs a lawful basis and a likeness release that survives the AI use, and making claims the ad cannot support, which advertising law reaches with or without a label.
Are you allowed to use AI-generated images for commercial use?
Yes, subject to your generation tool's licence and to the rules on what the image depicts. In an EU-facing job ad, a photorealistic person in that image triggers the deployer disclosure duty even if the person is invented, and a person built from a real employee's face triggers data-protection and national likeness rights in addition. A stylised or illustrated treatment avoids the disclosure duty and most of the likeness problem at once.
How does the EU AI Act affect recruitment practices?
Less than most recruitment-tech commentary claims, and sooner. The high-risk regime for employment (Annex III point 4) was deferred to 2 December 2027, and the Commission's draft guidance puts the mischief in algorithmic targeting of who sees a vacancy rather than in generating the creative, with employer-branding content that does not relate to a concrete vacancy outside the point altogether. What binds today is Article 50 transparency, plus the Article 5 prohibition on inferring emotions in the workplace, which the Commission's guidance extends to candidates during selection and hiring.
Who needs to comply with the EU AI Act?
For Article 50: providers who place generative systems on the EU market, deployers established or located in the EU, and providers and deployers in third countries where the output is used in the Union. The Commission reads third-country deployer scope broadly, including posting deep fakes on the globally accessible internet where EU dissemination is foreseen, with an exception only for audiences reached through channels that are unforeseeable and outside your control. A US or UK employer advertising to candidates in the EU is in scope.
What is a disclaimer for AI-generated content, and is one enough?
A disclaimer is a line of text; the AI Act asks for a label. The two fail in different ways. A disclaimer in ad copy, a caption or a description is easily missed at first exposure and so does not satisfy Article 50(5). And a disclaimer does not make a misleading ad lawful: the UK's Advertising Standards Authority upheld a complaint against Midnite in September 2025 even though the ad carried an ai-generated parody disclaimer, and the Commission's guidelines say the same, that labelling does not permit deep fakes that are unlawful as misleading advertising.

Sources

Primary law and regulator guidance only. Where this page says something is contested or untested, that is a statement about the state of the sources, not a hedge.

This is not legal advice. It is a working summary for people who have to ship recruitment creative this quarter, written on 5 August 2026, in an area that is moving fast. Have your own counsel check anything you intend to rely on.

Labelled by default, not by memory

RecruitmentAds Studio turns a job post into on-brand video and static ads for Meta and LinkedIn, and it bakes the official EU AI-labelling icons into the output itself: the Commission’s Article 50 icons ship inside the video and the statics, sized per placement, rather than as a step someone has to remember on a deadline.

See how it works
Guide: what the EU AI Act makes high-risk in recruitmentFree tool: employee photo release formRecruitment ad tools, compared