# EU AI Act compliance for AI persona operators

EU AI Act compliance for an AI persona in ten steps: what Article 50 asks, how to label deepfakes, why you keep watermarks, and which platform rules apply.

- Canonical: https://aiofmcity.com/guides/eu-compliance-for-ai-personas
- Topic: EU compliance (https://aiofmcity.com/topics/eu-compliance)
- Author: Gus
- Published: 2026-09-07
- Updated: 2026-10-04

---
## Key points

- EU AI Act Article 50 has applied since 2 August 2026. There is no minimum turnover, team size or audience size.
- A photorealistic AI persona counts as a deepfake in law, even when no real person is shown.
- Label at first contact: the platform label, the top of the bio, the media itself and the first DM.
- Keep C2PA manifests and watermarks in your files. Platforms read them. Most people remove them by accident with an image optimiser.
- Register your trade and sort out the VAT questions with an adviser before the first payout.

---
## Four sets of rules apply to you

If you run a photorealistic AI persona from the EU, four sets of rules apply to you at the same time. The AI Act says you have to label AI content. Each platform has its own labelling rules. Both also have rules about provenance markers, the hidden data that shows a file was made by AI. And normal national business and tax law applies too.

People usually call all of this "compliance" and treat it as one topic. But the four come from different places, have different deadlines and have different consequences. So you work through them one after another.

**This page is not legal advice and not tax advice.** It lists what applies, in order, so you know which questions to take to a lawyer for IT and media law and to a tax adviser. The fines below are high. An hour with each of them before you publish anything is money well spent.

The stages below are in the order you have to do the work. Stage 1 comes before you generate a single image.

_Diagram: What applied when, drawn to scale. The rules did not arrive at once, and the last line never stops: platform policy in this field moves quarterly._

## Stage 1: Your persona must never look under 18

Nothing in how your persona looks may suggest a person under 18.

In Germany, § 184b StGB covers sexual depictions of children, including computer-generated and AI-generated images when they look realistic. No real person has to be involved. Clearly stylised images are treated differently, but photorealistic AI images are the opposite of stylised. This niche sells photorealistic images, so this law matters here. Never publish anything that looks under 18, sexual or not.

Fanvue has the same rule. If an image looks like a person under 18, prompt text or a disclaimer does not cancel that out. What counts is the impression the image gives. What you intended and what your caption says do not count.

This means three things for you. All three are fixed rules:

- Do not build a persona that aims to look young. No "barely legal" framing, no school settings, no face LoRA trained towards a younger look.
- Before you publish anything, a person checks the actual output for the age it suggests, and you write the check down. If you are in doubt, do not publish.
- If you run a community around this, write an explicit server rule, ban immediately when someone breaks it, and do not discuss it. This is criminal law, so you risk much more than a fine if you are careless here.

This is the only stage in this guide that is not about reach, revenue or fines.

## Stage 2: Find out if you are a deployer or a provider

The AI Act gives you different rules depending on your role. Almost everyone who runs a persona is a **deployer**: you use an AI system, but you do not put one on the market. Your rule is in Article 50(4). You have to tell people that the content is artificially generated or manipulated.

You can become a **provider** without noticing. This can happen if you train a model or LoRA and release it publicly. It can also happen if you build a service on top of a generator and other people use it. Then the provider rules in Article 50(2) may apply to you. They are about putting machine-readable markings into the output in the first place. For a single person, the realistic way to cross that line is to publish a character LoRA on a model-sharing site.

> The Article 50 transparency obligations have applied since 2 August 2026. They apply regardless of company size, turnover or audience, and Article 99 sets the penalty ceiling for breaching them at up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher.
>
> — Source: Regulation (EU) 2024/1689 (AI Act), Art. 50, read 2026-09-08 — https://eur-lex.europa.eu/eli/reg/2024/1689/oj

For small businesses the lower of the two amounts is the limit:

> In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.
>
> — Source: EU AI Act Art. 99(6), read 2026-10-04 — https://eur-lex.europa.eu/eli/reg/2024/1689/oj

Content that was both generated and published before 2 August 2026 does not need a label afterwards. Everything you publish after that date does. That includes reposts of older material, because publishing something again counts as a new publication.

[What Article 50 means for persona operators](https://aiofmcity.com/blog/eu-ai-act-article-50-persona-operators) goes through the text of Article 50 in detail.

## Stage 3: Your persona counts as a deepfake under the AI Act

In Article 3(60), "deepfake" means much more than it does in everyday speech. It covers AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places or events and would wrongly appear to be real.

> The Commission's guidelines of 20 July 2026 read the definition broadly: the labelling duty applies without any intent to deceive, and it applies even where no real person is depicted. Content that is clearly fantastical or physically impossible falls outside it — a photorealistic human does not.
>
> — Source: European Commission guidelines on Article 50 transparency obligations, read 2026-09-08 — https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations

So a photorealistic AI persona is a deepfake under the AI Act. Many people tell themselves "she isn't based on anyone real, so this doesn't apply to me". That is wrong. The rule applies to them too.

## Stage 4: Label your AI content everywhere people first see it

The label has to be clear, easy to tell apart from the rest, and there at the first point of contact. For each place where people meet your persona, that means:

- **Profile level.** Use the platform's own AI label where there is one. It shows up wherever the platform shows your account: in recommendations, in search and on the profile. Most first contact happens there. But the label only shows on that platform.
- **Bio.** One plain line at the top of the bio, not at the bottom. "All images on this account are AI-generated" is enough.
- **On the media.** A visible watermark or a caption on the post itself. This still works after a screenshot, after a repost and in a recommendation feed where nobody sees your bio.
- **Direct messages.** If your persona replies in DMs, say that it is AI in the first message. The person you write to may never have opened the profile.

The common mistake is to tick one box somewhere on the account and think you are done. Every piece of content that leaves the account needs its own label.

I got this wrong myself. My label was the last line of an Instagram bio, and there was nothing on the media. You can read what that missed and what I changed in [what the EU AI Act means for persona operators](https://aiofmcity.com/blog/eu-ai-act-article-50-persona-operators#failed-putting-the-ai-disclosure-as).

## Stage 5: Keep watermarks and C2PA data in your files

Generators put machine-readable markers into their files: C2PA manifests, invisible watermarks and generator metadata. The AI Act makes the generator's maker put them in. It does not ban you from removing them. Keep them anyway. Platforms read them to label your posts automatically, and your generator's terms may forbid removing them.

Most people in this niche lose the markers by accident. Many ordinary tools strip metadata by default:

- Image optimisers and compressors. They throw away everything that is not pixel data unless you tell them to keep it.
- Re-encoding steps in a batch pipeline, including most default ffmpeg commands.
- Resize and crop scripts that write a new file instead of editing the old one.
- "Clean" export presets in editors. They exist to remove metadata.

Check your pipeline once. Generate an image, run it through your full export path, and look at the metadata at the end. If the manifest is gone, find the step that removed it. Some platforms strip metadata on upload, and you cannot change that. Make sure your master files and your own export path keep it.

My own export path stripped the manifest for months before I looked at a single file. [Don't strip your watermarks](https://aiofmcity.com/blog/dont-strip-your-watermarks-provenance#failed-a-one-line-batch-convert) tells that story and shows how to check a file.

## Stage 6: Set the AI labels on Instagram and Fanvue

The platforms want the same thing as the AI Act. They just say it in different words. The [label matrix](https://aiofmcity.com/ai-label-matrix) puts all six side by side: what each label is called, where you set it and what happens without it.

> Since 31 August 2026 Instagram replaces the previous "AI creator" label with an "AI-generated profile" label. Accounts whose depicted identity is AI-generated and which do not carry the label receive reduced distribution, specifically less exposure on recommendation surfaces to people who do not already follow them. Using AI only as an editing or captioning tool does not bring an account into scope.
>
> — Source: Instagram Creators — AI-generated profile label, read 2026-09-08 — https://creators.instagram.com/blog/ai-generated-profile-label

Fanvue handles it differently. It does not punish a missing label with less reach. The label is a condition for being on Fanvue at all. You have to mark AI-generated media clearly and prominently (watermark, caption, bio or message). Fanvue verifies you as the person behind the account, with your own ID and not the persona's. For AI-replicated media of a real person, it wants documented consent and an identity check of that person.

The overlap helps you. If you label properly once, you meet the rules of the AI Act, Instagram and Fanvue at the same time. Labelling is a normal part of running this business. The detail for each platform is in [Instagram's AI-generated profile label](https://aiofmcity.com/blog/instagram-ai-generated-profile-label).

## Stage 7: Never train on a real person without documented consent

Do not train on photos of real people without documented permission. No celebrity LoRAs. No face datasets of unclear origin. That includes the scraped collections that get passed around in this niche with no record of where they came from.

Fanvue wants documented consent and an identity check of any person shown in AI-replicated media. Apart from platform policy, several jurisdictions (countries or states) now have laws against intimate deepfakes made without consent. Good technical work does not protect you from these laws.

If you ever work with a real model, file the consent document and the ID check together with the dataset. Do not leave them in a chat history that you will lose. The [character consistency guide](https://aiofmcity.com/guides/character-consistency) covers how to keep a dataset clean.

## Stage 8: Register your business before the first payout

Take this stage to a tax adviser. The list below is what to bring to that appointment. The answers have to come from your adviser.

- **Gewerbeanmeldung.** If you run a business from Germany, you register it at the local Gewerbeamt when you start, not when revenue appears. The fee is a low two-figure amount and differs between municipalities.
- **VAT status.** Whether the small-business rule under § 19 UStG fits you depends on the current turnover thresholds. They were revised recently. Get the current figures from your adviser and not from a blog, including this one.
- **Inbound services.** Platform fees, ad spend and tool subscriptions that you buy from companies abroad usually move the VAT liability to you as the buyer. This can apply even to small businesses, and you usually need a VAT identification number for it. Of everything on this list, this is the item people miss most often.
- **Platform payouts.** Who owes what depends on where the service counts as supplied. That depends on how the platform is set up and where it is based. Ask about your platform specifically.
- **Affiliate income.** Usually this counts as a service you supply to the merchant. How it is treated depends on where that merchant is based.
- **Direct EU consumer sales.** If you ever sell directly to consumers in other EU states, ask about the One Stop Shop procedure before the first sale.

### What did not work: Waiting for the accountant until the first payout arrived

The plan was to keep it simple: get the account working first, and deal with the paperwork once there was money to talk about.

The first payout arrived in month four. By then there were eight months of tooling subscriptions bought from foreign companies, a platform payout with an unclear place of supply, and no trade registration. Fixing it afterwards meant a back-dated registration and a set of corrected filings. The adviser's bill was several times what one planning session would have cost before anything started.

None of it was a disaster, and all of it could have been avoided. Register and ask the VAT questions before the first euro moves. Ask even when the answer turns out to be "nothing applies to you yet". That answer is also good to have in writing.

## Stage 9: Keep records if you publish AI-assisted text

Article 50(4) also covers text. It applies to AI-generated or manipulated text that is published to inform the public on matters of public interest. There is an exception: a human reviewed the text, and a person or organisation holds editorial responsibility for it. The Commission's July 2026 guidelines read that exception narrowly. A quick skim does not count as review.

If you publish articles or guides with the help of a model, put editorial responsibility on record. You need three things: a named person who reviews and approves, a dated edit history that is not squashed away, and a transparency page that says how content is produced and who is responsible for it. All three are cheap to set up before you have an archive. They are hard to rebuild afterwards.

## Stage 10: Re-check the rules every three months

Every legal and platform rule on this page has a source and the date it was checked, because any of them can change. Set a reminder every three months and re-read, in this order: the platform policies you depend on, any new Commission guidance on Article 50, and your own labels on a random sample of recent posts.

Keep dated notes of what each rule said when you checked it. A rule can change, and something you published under the old version can become a problem. With the notes you can show what applied at the time and explain the mistake. Without them you cannot.

## All ten stages in one list

1. Check the age impression before you publish, every time, with no exceptions.
2. Know whether you are a deployer or, because you publish models, also a provider.
3. Your photorealistic persona is a deepfake under Article 3(60). Treat it as one.
4. Label at first contact in every place: platform label, top of the bio, on the media, first DM.
5. Keep the provenance metadata, so platforms can read it. Check your export path to make sure you are not stripping it by accident.
6. Set the platform labels. The same labelling meets the rules of the AI Act, Instagram and Fanvue at once.
7. No real people without documented consent and an ID check, both filed with the dataset.
8. Register the trade and ask the VAT questions before the first payout, with an adviser.
9. A named person with editorial responsibility and a dated history for any AI-assisted text you publish.
10. Re-check every three months and keep dated notes.

## This page is not legal or tax advice

This page is not legal advice and it is not tax advice. It is how one operator reads the rules for this activity, put in order. The legal and platform rules it cites have a source and a check date, so you can verify them yourself.

The highest AI Act fine for breaking the transparency rules is EUR 15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized businesses, including one-person businesses, the lower of the two is the limit (Article 99(6)). The labelling rule itself has no minimum turnover. Compare that with the cost of one consultation with a lawyer for IT and media law and one with a tax adviser.

This page also covers only the EU, on purpose. Part of any real audience is outside the EU. None of the ten stages above covers that part. For it, read [Do I have to disclose AI content in the US?](https://aiofmcity.com/blog/do-i-have-to-disclose-ai-content-us).

## Frequently asked

### Does the EU AI Act apply to a one-person AI persona account?

Yes. Article 50 has applied since 2 August 2026. Its labelling rules apply to the deployer, which is the person who uses the AI system. There is no minimum turnover, team size or audience size. If you post photorealistic generated images of a person on your own, the rules apply to you.

### Is an AI persona a deepfake under EU law?

Yes, if it looks real. Under the Article 3(60) definition, photorealistic AI-generated images of a person count as deepfakes. That is true even when no real person is shown and even when you do not want to deceive anyone. Content that is clearly fantasy or physically impossible does not count. Personas in this niche are photorealistic, so you have to label them.

### Where exactly does the AI disclosure have to appear?

At first contact, and in a way people can clearly see. In practice that means three places: the profile label the platform gives you, a visible line in the bio, and a mark on the image or video itself. Metadata alone is not enough. A note at the bottom of the bio is not enough either, because someone who sees a single reel never opens it.

### Can I remove watermarks or metadata from generated images?

The AI Act does not ban it. It makes the generator's maker put machine-readable markers into the file, such as C2PA data and watermarks. Keep them anyway. Platforms read them to label your posts automatically, and your generator's terms may forbid removing them. Most people lose them by accident, because an image optimiser or a re-encode step throws the metadata away by default.

### Do I need a Gewerbeanmeldung before the first payout?

If you run this as a business from Germany, register the trade when you start, not when the money arrives. You also need to decide how VAT applies to platform payouts and affiliate income before the first invoice or payout, not afterwards. Take both questions to a tax adviser. None of this is tax advice.

### What are the penalties for getting Article 50 wrong?

Under the AI Act, fines for breaking the transparency rules can go up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized businesses, including one-person businesses, the lower of the two is the limit (Article 99(6)). A single person will realistically never get a fine near that maximum. But the rule has no minimum turnover, so it applies to you too. A platform will also act against your account long before a regulator does.