Why This Is Not One Law
Enterprises frequently ask which single regulation governs deepfake and synthetic content disclosure in 2026. There isn't one. Obligations come from a patchwork: the EU AI Act's Article 50 transparency provisions, California's SB 942 and AB 602, and a scattering of other US state statutes focused narrowly on political advertising or non-consensual intimate imagery. No confirmed comprehensive US federal deepfake disclosure statute is in force. This fragmentation means a global enterprise cannot rely on a single labeling policy. Instead, compliance teams must map each generative AI use case against multiple, differently scoped definitions of what counts as synthetic content.
How the EU AI Act Defines the Problem
The EU AI Act gives the clearest legal definition currently available. Article 3 defines a "deep fake" as AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, or events and would falsely appear authentic. Article 50 then imposes transparency obligations tied to that definition, phased in across 2025 and 2026. Critically, these obligations attach to both providers of generative AI systems and deployers who use those systems to produce synthetic content. This dual-role structure means an enterprise using a third-party generative AI vendor may still carry disclosure obligations as a deployer, independent of what the vendor does upstream. Enforcement follows the Act's tiered penalty regime, distinct from the higher-risk system violations that carry larger fines.
California's Narrower but Real Obligations
California's approach is more fragmented but still consequential for enterprises operating in or serving that market. SB 942, the California AI Transparency Act, requires covered generative AI providers with large user bases to offer AI-content detection tools and support provenance disclosure, with compliance phased toward 2026. AB 602 and related statutes address deepfakes in specific contexts, primarily elections and sexually explicit material, rather than generative AI outputs generally. Other US states have enacted similar narrow statutes. The practical effect is that an enterprise's disclosure obligations in California may differ meaningfully in scope and trigger conditions from its EU AI Act obligations, requiring separate compliance logic rather than a single global policy.
Where AI Agents Complicate Disclosure
Disclosure laws were largely written with direct generative AI use in mind, such as a user prompting a model to produce an image or article. AI agent architectures complicate this. When an agent chains multiple model calls or tool invocations to autonomously produce a final output, that output can still qualify as synthetic content under an applicable law's definition, triggering the same labeling obligations as direct use. The challenge is technical: enterprises need traceability that links the final content output back to the originating generative step, even when several intermediate tool calls or agent handoffs sit between them. Without this traceability, an enterprise cannot reliably determine which outputs require disclosure in the first place.
Provenance Metadata and Its Limits
The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard, Content Credentials, that attaches cryptographically signed metadata tracking a piece of content's origin and edit history. Major platform and camera manufacturers reference or support it. This makes C2PA a reasonable technical baseline for provenance disclosure, but it is not a legally mandated standard under either the EU AI Act or California statutes reviewed. Adoption remains voluntary. Enterprises should treat C2PA-compatible metadata as one useful mechanism among others, including watermarking, rather than assuming any single technical approach satisfies every jurisdiction's disclosure requirement. NIST's AI Risk Management Framework similarly identifies provenance and watermarking as risk-mitigation practices, not binding law.
Audit Readiness and Recordkeeping
Meeting disclosure obligations on paper is not the same as being able to prove it during a regulatory inquiry. Audit readiness requires retrievable records showing when, how, and by which system a piece of synthetic content was generated and labeled. This is where many enterprises fall short: inference logs are often ephemeral and discarded after processing, while disclosure compliance requires durable records tied to specific outputs. For AI agent pipelines, this means logging integration at the orchestration layer, capturing generation events as they occur rather than attempting to reconstruct them after the fact. Runtime governance and audit logging capabilities that record agent tool-call chains and generation events provide the underlying data enterprises need to answer these questions when regulators ask, without requiring a separate compliance-only logging system.
Governance Structure, Not a Compliance Silo
The most durable approach treats synthetic content disclosure as an extension of existing AI risk management rather than a standalone program. This means defining internally what constitutes synthetic content in terms consistent with applicable legal definitions, assigning clear accountability for provider versus deployer obligations, and integrating disclosure and provenance requirements into existing AI governance processes such as those aligned with the NIST AI RMF. For enterprises running AI agents with tool access and autonomous decision-making, this governance layer needs to extend to agent permissions and tool approval workflows, since an agent with broad, unreviewed tool access can generate disclosable content without a clear record of how or why.