2026 is the year synthetic media stopped being a content problem and became a standing compliance obligation. It arrived as a pile-up of dates: Article 50 enforcement from 2 August 2026, a watermarking grace period ending 2 December 2026, DSA designations of ChatGPT, Reddit and Roblox on 31 August 2026, and the TAKE IT DOWN Act‘s platform duty from 19 May 2026. Together they form the 2026 AI regulatory stack, which exists because generative AI makes it hard to tell real media from synthetic. That’s the synthetic-media trust gap the rules are trying to close.
Faced with two regimes, the reflex is to ask which is stricter. That reflex leads to the wrong question, because the two laws don’t regulate the same thing.
What is EU AI Act Article 50 and what does it require of platforms and providers?
Article 50 is the EU AI Act‘s transparency article, in force since 2 August 2026. It turns “is this real?” from a trust question into a standing obligation, split by role. Providers who place an AI system on the market must mark synthetic audio, image, video or text output in a machine-readable format. Deployers who use the system must label deepfakes and AI-generated public-interest text for the people exposed to them.
So do you have to watermark AI images now? Yes, if you’re in scope, but watermarking is only one permitted technique; no single method is mandated. Article 50(2) requires marking that is effective, interoperable, robust and reliable, and no single method ticks all four boxes. Providers layer signed metadata, C2PA provenance and watermarking. The Digital Omnibus on AI gave systems placed on the market before 2 August 2026 a grace period to 2 December 2026.
There’s a second deadline in that Omnibus. High-risk Annex III obligations were pushed to 2 December 2027, while the functional bans, the transparency and watermarking rules and the new ban on nudifier apps generating non-consensual intimate imagery, stay on the 2026 schedule. That leaves a 12-month regulatory vacuum where attacker capability runs ahead of enforcement, plus an unresolved GDPR data-minimisation tension with what accurate detection wants.
The European Commission and the EU AI Office publish the transparency guidance; the Code of Practice, with around 190 signatories, is the practical route to compliance. The Digital Services Act adds a separate layer: the 31 August 2026 designations of ChatGPT, Reddit and Roblox bring systemic-risk and audit duties. The European X v Russmedia “verify-then-publish” ruling pushes platforms to check content before publication. All of this assumes detection works. Marking assumes detection works, but it fails in the field, and an absent watermark proves nothing. The US regime pulls on a different harm entirely.
What is the TAKE IT DOWN Act and what does its 48-hour takedown duty require?
The TAKE IT DOWN Act, signed 19 May 2025, is the first US federal law to criminalise publishing non-consensual intimate imagery, including AI-generated deepfakes. The platform duty took effect 19 May 2026. A “covered platform” is any website, service or app that hosts user-generated content or deals in intimate imagery.
The heart of it is a 48-hour clock, and that clock is an architecture requirement. The workflow is report, validate, remove within 48 hours, then remove or block known copies. The clock starts from a valid victim report rather than from the moment the content was posted, so compliance is decided by your ingest and matching infrastructure rather than by what your terms of service say. Hashing, StopNCII.org and NCMEC’s Take It Down service block known copies.
The FTC enforces this. It runs the TakeItDown.ftc.gov portal and has already sent warning letters to 15 major platforms. A violation is treated as an FTC rule violation, with civil penalties of $53,088 per violation, and the underlying offence is criminal, carrying up to two years for adult victims and three years for minors.
To map exposure, ask three questions: are you a covered platform, where can user-generated content surface, and do you operate in states with stricter laws. Minnesota’s HF 1606, for instance, imposes strict liability on platform owners, with penalties up to $500,000 per violation. This is moderation as platform engineering: ingest controls, hashing and a working notice-and-takedown pipeline are the compliance surface. The build-versus-buy and board-reporting questions that follow are covered in our defence-decisions piece.
Is the EU AI Act stricter than the US TAKE IT DOWN Act for synthetic media?
No. The question itself is a category error.
Article 50 is an ex-ante transparency regime: it marks and labels all synthetic content at the moment of creation, and it’s civil and administrative. The TAKE IT DOWN Act is an ex-post takedown regime, victim-initiated, covering only non-consensual intimate imagery, and carrying criminal sanction. They regulate different moments, creation versus publication, and different harms, all synthetic media versus NCII — two models of how regulation responds to unverifiable media.
Which one applies more pressure depends on what you do. If you distribute synthetic media broadly, the EU’s marking duty touches more content. If you host user-generated intimate imagery, the US criminal 48-hour duty is more onerous. Neither regime can close the detection gap, though: vendor testing reports put field accuracy at roughly 45 to 50 per cent, so marking and takedown both rest on an assumption that fails about half the time.
You’ve also got 48 states with their own sexually explicit deepfake laws, plus a live First Amendment fight. Hawaii and California laws were struck down, and X (formerly Twitter) and xAI are litigating a state platform-liability law, a test of Section 230. Australia’s eSafety Image-Based Abuse Scheme is a useful local reference point: mechanically closer to the US takedown model, but with a statutory regulator holding the removal power.
Wrapping up
The strictness question dissolves once you separate the harms and the moments each law regulates. What survives the comparison is the detection gap, which neither law can close. The rulebook governs the obligation while the trust gap behind the compliance stack stays open.
The useful question is different: which moment and harm are you exposed to, and where does your detection stack fail? Treat the stack as an exposure-mapping and platform-engineering exercise. Map your risk surface rather than ranking the rulebook.
Frequently Asked Questions
Do I have to watermark AI-generated images now?
Yes, if you are in scope, but watermarking is only one permitted technique rather than the mandated one. Article 50(2) requires marking that is effective, interoperable, robust and reliable, so providers typically stack C2PA provenance metadata and watermarking rather than relying on a single method. The Digital Omnibus on AI granted existing systems a grace period to 2 December 2026.
What counts as synthetic content under Article 50?
Article 50 reaches audio, image, video and text generated or manipulated by an AI system, not just photorealistic deepfakes. The scope turns on whether the output is artificial, so a generated voice clone, a synthetic news article or a manipulated video all fall inside it. Media edited with conventional tools alone, without an AI system producing or altering the content, sits outside the marking duty.
What happens if a platform misses the TAKE IT DOWN Act’s 48-hour window?
A missed 48-hour window exposes a covered platform to FTC enforcement, and the clock runs from a valid victim report rather than from the moment content is posted. Regulators can act on the failure itself, so a slow or broken notice-and-takedown workflow is the real risk. The FTC has already issued warning letters to 15 major platforms, signalling active rather than theoretical enforcement.
Who counts as a “covered platform” under the TAKE IT DOWN Act?
A covered platform is any site, service or application that hosts user-generated content or deals in intimate imagery, so the definition reaches well beyond social networks. It captures forums, messaging services, apps and marketplaces where such content can surface. Because the test is broad, most operators with any user content surface should map whether they fall inside it.
Do individual creators and small businesses have obligations, or only large platforms?
Obligations attach to roles, not to size. Under Article 50, a provider placing a system on the market or a deployer using one carries the duty even if it is a single developer. Under the TAKE IT DOWN Act, the duty falls on covered platforms, so an individual is rarely the regulated party but can still face criminal liability for publishing NCII.
What are the penalties for getting it wrong under each regime?
The two regimes diverge sharply on consequences. Article 50 is a civil and administrative regime, enforced through the EU’s penalties and market surveillance rather than criminal sanction. The TAKE IT DOWN Act is criminal: publishing NCII, including AI-generated imagery, can attract prosecution, with the FTC also enforcing the platform duty. That split is exactly why a single strictness ranking does not hold.
Why does deepfake detection accuracy fall to around 45 to 50 per cent in the field?
Detection models are trained and benchmarked on curated datasets, but field conditions degrade them. Compression, re-encoding, cropping and screenshotting strip away the very signals classifiers rely on, and generative models improve faster than detectors retrain. The result is roughly 45 to 50 per cent field accuracy, which is why marking and takedown both rest on an assumption that often fails in practice.
What is C2PA and why does provenance metadata matter?
C2PA is an open provenance standard that attaches cryptographically signed information about how a piece of media was created and edited. It helps verifiers trace origin, but it is only one permitted marking technique under Article 50, and its absence proves little because metadata is easily stripped. That is why provenance is treated as necessary but insufficient, not a complete answer.
Does the TAKE IT DOWN Act only cover intimate imagery, or all deepfakes?
Its federal criminal scope is narrow: it targets non-consensual intimate imagery, including AI-generated deepfakes, rather than synthetic media generally. That is the core contrast with Article 50, which covers all synthetic content but imposes civil transparency duties. State deepfake laws fill some of the gap, though Minnesota’s HF 1606 and others vary widely.
Do the new rules apply to content created before 2026?
Generally not retroactively. Article 50 duties apply from 2 August 2026, with a grace period to 2 December 2026 for existing systems, and the TAKE IT DOWN Act platform duty begins 19 May 2026. The regulation attaches to ongoing provision and publication, so historical content is largely outside scope unless it remains hosted or distributed after those deadlines.
Can a platform be liable for synthetic media it failed to detect?
Yes, and that is the uncomfortable part. Both regimes assume detection works, but at roughly 45 to 50 per cent field accuracy a platform can be liable for content it never flagged. Marking and notice-and-takedown obligations therefore do not vanish when detection fails; they become an exposure the platform carries while the underlying trust gap stays open.
How does Australia’s eSafety scheme compare operationally to the EU and US regimes?
Australia’s Online Safety Act 2021 and eSafety Image-Based Abuse Scheme use a regulator-led takedown model. Mechanically it sits closer to the US approach, since both act after publication on victim complaints, but eSafety itself holds the removal power rather than relying on a platform clock. That gives Australian operators a third reference point beyond the EU and US regimes.
