Do you have to label tattoo designs when you use AI? What the EU AI Act actually requires

What actually applies since 2 August 2026

The transparency obligations in Article 50 of the AI Act have applied since 2 August 2026. Nowhere in them is there a rule saying "every motif that involved AI needs a label". The sentence currently doing the rounds in studio groups and Instagram stories simply is not in the law.

Article 50 contains four distinct obligations addressed to different parties. Paragraphs 1 and 2 target providers, meaning Midjourney, OpenAI or Adobe. They have to disclose when someone is interacting with an AI and mark their outputs in a machine-readable format. That has nothing to do with you.

Paragraphs 3 and 4 target deployers, and that is you the moment you post professionally. Paragraph 3 covers emotion recognition and biometric categorisation, so nothing that happens in a studio. That leaves paragraph 4, which has two cases: if you use AI to generate or manipulate a deepfake, you have to disclose it. And if you publish AI-generated text to inform the public on matters of public interest, so politics, public security, health policy. A flash caption or a booking reply is practically never covered.

That reduces the whole question to two filters. First: are you a deployer at all? Second: is what you post a deepfake in the legal sense? Only if both answers are yes do you have to label anything.

Where these statements come from

The basis is the regulation itself, supplemented by the European Commission's guidelines on Article 50 of 20 July 2026. Across roughly 50 pages they set out definitions, test criteria and both positive and negative examples, some of them strikingly close to what artists actually post.

One thing matters for context: those guidelines are explicitly non-binding. The Commission states itself that any authoritative interpretation of the AI Act can only be given by the Court of Justice of the European Union. So they show how authorities are likely to apply the law, not how a court will ultimately rule. This article explains the legal situation and does not replace legal advice in a borderline case.

First filter: are you even covered?

A deployer is anyone using an AI system under their own authority. Excluded are natural persons who use it for a purely personal, non-professional activity.

The Commission reads "professional" broadly: any activity through which someone gains an economic benefit on a regular basis, or that forms part of a business, trade, occupational or freelance activity, counts. Both elements have to be met for the exception to apply. For you that means:

The last two rows are there on purpose. Platforms that merely disseminate third-party AI content are not deployers according to the Commission. Neither is someone who hands a production over entirely without deciding on the AI usage. But the moment you say "make this look better with AI", you are back in scope.

Second filter: is your image a deepfake?

Under Article 3(60) of the AI Act, a deepfake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to be authentic or truthful.

Four criteria, all of which have to be met together. If one is missing, there is no obligation under Article 50:

1. Resemblance, and it has to be appreciable. It does not need to be identical.
2. Existence: what is depicted exists, could plausibly exist, or could plausibly have existed. Anything breaking the laws of nature drops out. The Commission's examples are humans flying without mechanical aids, dragons, and elephants driving cars.
3. Category: person, object, place, entity or event. This is where it gets interesting for us, more on that below.
4. False appearance of authenticity: someone could believe this is a real photo or a real video.

For tattoo designs, the whole thing turns on criteria 1 to 3. A drawn template, a flash sheet, a stylised neo-traditional motif, a demon, a dragon: none of it resembles an existing person or an existing object. So it never enters the deepfake definition in the first place. It makes no difference whether the initial idea came from Midjourney, whether it took ten prompts, or whether half the linework was generated.

Two details missing from most checklists doing the rounds. First, the Commission reads "objects" broadly, explicitly including artworks and consumer goods. "Events" explicitly cover the depiction of professional or consumer services. An image showing a tattoo session or a finished tattoo on a body is exactly that kind of service depiction.

Second, the fourth criterion is not judged against a hypothetical average viewer, but against the reasonably foreseeable composition of your audience. Where it is reasonable to expect that younger people, older people, or people with less experience spotting AI images will see it, it is enough that those people could be misled. An open Instagram account is exactly that case. Conversely, you do not have to account for third parties spreading your image somewhere you would never have anticipated.

Photorealism makes it more likely that something counts as a deepfake, but on its own it is not decisive. The test is always whether the content can mislead in its specific context.

The case most people underestimate

There is one example in the guidelines that fits tattoo work more precisely than anything else: an AI-generated product image in advertising that affects the audience's perception and misleads them about the product's actual appearance, characteristics or use is a deepfake. The Commission explicitly names the case where a product is made to look more appealing or of higher quality than in real life.

Translated to your business: a photorealistic mockup showing a tattoo cleaner, sharper or finer than you can execute it in skin is precisely this case. Not because AI is evil, but because the client expects a result that will not arrive.

What stays unproblematic is spelled out too. Minor interventions do not turn an image into a deepfake: colour correction, lighting, noise reduction, compression, removing passers-by from the background, replacing or extending backgrounds for purely aesthetic reasons, rescaling images. A real product against an AI-generated background is named by the Commission as an explicit non-deepfake, as long as the ad does not mislead about the product itself.

So your genuine healing photo in front of a generated background is fine. A generated "result" that never happened is not.

AI as tool, AI as author

On the art regime, which many read as a free pass: yes, deepfakes forming part of evidently artistic, creative, satirical or fictional works get an attenuated obligation. Disclosure may then be designed so it does not hamper enjoyment of the work.

But the Commission reads this narrowly. Content whose nature is unclear or ambiguous drops out. So does content that is exclusively informative or commercial and recognisable as such. And where a piece mixes several characters, the informative character prevails and full labelling applies. A promotional post for flash that is for sale is commercial. So do not lean on the art exception there. Lean on the fact that a drawn flash does not clear the deepfake threshold to begin with.

One more thing: the invisible mark that Midjourney or DALL·E embeds in an image does not replace your disclosure. The Commission makes clear that deployers specifically cannot rely on it, because people cannot see that marking without specialist tools.

What this means for you as an artist

There are official icons, and they cost nothing. In June 2026 the EU published an icon set alongside the Code of Practice, in three variants: AI was involved, fully AI-generated, partially AI-modified. In black and white, also semi-transparent, as SVG and PNG. Using them is voluntary, the labelling duty itself is not. The icon should sit directly in the image and stay visible when the content is reshared or downloaded.

What the disclosure has to look like. Clear and distinguishable, at the latest on first exposure to the content. According to the Commission, anything easily overlooked does not qualify: buried in terms and conditions, hidden under menu layers, tucked into the small print. A note at the end of a long caption that only appears after "show more" is exactly that kind of borderline case.

The fines are not what the panic posts claim. Breaches of Article 50 carry up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. That sentence is correct, but it does not apply to you. Article 99(6) flips the rule for small and medium-sized enterprises: there the lower of the two figures applies. At 60,000 euros annual turnover that is a maximum of 1,800 euros, not 15 million. On top of that, penalties have to be proportionate and take into account the economic viability of small operations. Warnings are explicitly on the table.

Who supervises this in Germany. The AI market surveillance act (KI-MIG) took effect on 29 July 2026. The Bundesnetzagentur is the central market surveillance authority, single point of contact and complaints body. Any affected person can lodge a complaint. In practice that means the likeliest trigger is not an authority scrolling your profile, but a disappointed client or a competitor.

Old posts. Content generated before 2 August 2026 does not need retroactive labelling. The Commission encourages it but explicitly does not expect disproportionate effort such as auditing entire archives.

Client photos are their own topic. The moment you place an AI mockup on a real person's photo, GDPR and personality rights come into play regardless of the AI Act. A label does not cure a missing consent. The Commission says this outright: labelling does not make unlawful content lawful.

And the part no law governs. Clients book you for your hand, not your prompts. Anyone quietly selling AI designs as their own sketches does not have a compliance problem, they have a trust problem. That fits what we describe in "Why people book a tattoo": a large share of clients decide on trust, not on technology. In the design approval on tatme.com you can record whether a draft involved AI assistance. Not a legal requirement, but it settles the discussion before it starts.

What does not work

Labelling everything that touched AI. If you mark every motif even though you reworked it by hand, you dilute the label. Your followers will tune them out eventually. Then the honest disclosure on the mockup that actually needs one buys you nothing.

Relying on the provider's marking. Nobody sees file metadata on Instagram, and the Commission explicitly says it does not discharge your duty.

Stretching the art exception. "It's art" carries exactly as far as the artistic character is obvious to the audience. On a pure promotional post it is not.

Thinking only about Instagram. Every professional publication is covered: website, artist page, newsletter, TikTok. Not published means no deployer duty. An AI moodboard that never leaves the studio is not an Article 50 case.

Panic compliance from Facebook groups. The lists in circulation mix up provider and deployer duties and draw the wrong conclusions from the transitional period until 2 December 2026. That period covers only the technical marking by providers of systems placed on the market before 2 August 2026. There is no grace period for your labelling.

One thing you can do this week

Go through your last twenty posts and sort them into exactly two piles: images showing something real (skin, faces, finished tattoos on bodies, actual studio scenes), and images that are obviously drawn.

The second pile is done, nothing to do there. For the first pile, ask one question per image: does this show a result that never existed, or one that looks better than what I actually tattoo?

If you end up with more than one or two images, you do not have a labelling problem. You have an expectations problem in your enquiries, and that costs you more than any fine.

Sources

1. Regulation (EU) 2024/1689 (AI Act), Article 50: Transparency obligations, ai-act-service-desk.ec.europa.eu
2. European Commission: Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, C(2026) 5054 final, 20 July 2026, ai-act-service-desk.ec.europa.eu
3. European Commission: Transparency obligations under Article 50 of the AI Act (FAQ), digital-strategy.ec.europa.eu
4. European Commission: EU Icons for labelling AI-generated content, digital-strategy.ec.europa.eu
5. European Commission: Code of Practice on Transparency of AI-generated Content, 10 June 2026, digital-strategy.ec.europa.eu
6. Regulation (EU) 2024/1689, Article 99: Penalties, ai-act-service-desk.ec.europa.eu
7. German AI market surveillance act (KI-MIG), in force since 29 July 2026, gesetze-im-internet.de