The regulatory map media leaders actually need to know

# The regulatory mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → media leaders actually need to know

A streaming platform's marketing team generates a promotional trailer using an AI voice clone of a deceased actor, licenses a synthetic background score, and schedules the release for a Tuesday morning across the EU, the US, and California specifically. By Tuesday afternoon, three different regulatory regimes have an opinion about that trailer, and only one of them is fully in force. Knowing which one matters most is the job.

This lesson maps the three regulatory layers colliding on every AI-touched media release in 2026: the EU's binding law, the US federal proposal that isn't law yet, and the patchwork of US state laws that already are.

Layer 1: The EU AI Act, transparency obligations

The EU AI Act is the world's first comprehensive AI law, adopted in 2024 with obligations phasing in through 2027. For media, the operative piece is Article 50: transparency obligations for AI-generated content.

What it requires, as of 2026:

• Deployers (companies putting AI systems to use, like a streaming platform) must disclose when content is a "deepfake": AI-generated or manipulated image, audio, or video that resembles real people, places, or events.
• Providers (the companies building the underlying AI model, like a text-to-video model vendor) must ensure outputs are machine-readable as AI-generated, typically through watermarking or metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). tagging.
• Disclosure must be "clear and distinguishable," not buried in terms of service.

Exemptions exist for obviously artistic, creative, or satirical works, but even then a "appropriate" disclosure that doesn't hamper the work's enjoyment is still expected.

This binds any platform serving EU users, regardless of where the company is headquartered. This is the classic "Brussels effect": a rule written for one market that becomes the de facto global floor because it's cheaper to build one compliant pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète → than two.

Penalty exposure: fines up to 15 million euros or 3% of global annual turnover for transparency violations (the AI Act's tiered penalty structure reserves the harshest tier, up to 35 million euros or 7% of turnover, for prohibited-practice violations, not transparency).

Layer 2: US federal rules, mostly still proposals

Here's where confusion costs real money. The Federal Communications Commission (FCC), the US agency regulating broadcast and telecom, proposed a rule in 2024 requiring on-air disclosure when political ads use AI-generated content. As of early 2026, this rule has not been finalized. It remains a Notice of Proposed Rulemaking (NPRM), the FCC's formal proposal stage before a rule takes legal effect.

Separately, the FTC (Federal Trade Commission) has used its existing authority over "unfair or deceptive practices" to act against AI-generated endorsements and fake reviews, but this is enforcement under old law, not a new AI-specific statute.

There is no single binding US federal law mandating AI content disclosure comparable to the EU AI Act. Congress has floated bills (the NO FAKES Act addressing voice and likeness cloning, among others) but as of 2026 none has passed into federal law.

The practical trap: teams see "FCC deepfake rule" in a headline and assume it's binding today. For most content pipelines, it isn't yet. Legal and compliance teams should distinguish "proposed" from "in force" before building anything into a release checklist.

Layer 3: State-level deepfake laws, already binding

While federal action stalls, US states have moved fast. By 2026, more than 20 states have enacted deepfake-related laws, concentrated in three categories:

1. Election deepfakes: laws in states like California and Texas restrict distributing AI-manipulated political content close to an election without disclosure.

2. Non-consensual intimate imagery: nearly all states with deepfake laws criminalize AI-generated sexual content depicting real people without consent.

3. Right of publicity / digital replicas: California's AB 1836 (2024) restricts using digital replicas of deceased performers without estate consent; Tennessee's ELVIS Act (2024) does similar work for voice cloning.

This is the layer that actually touched our opening scenario. A voice clone of a deceased actor in a US-distributed trailer runs straight into state-level digital replica law, not the EU AI Act and not any FCC rule.

Quick reference: what binds what

| Rule | Status in 2026 | Binds |

|---|---|---|

| EU AI Act Art. 50 | Binding, phasing in | Any platform serving EU users |

| FCC synthetic media disclosure | Proposed, not final | Nobody yet |

| FTC deceptive practices | Binding (existing law) | US advertising, endorsements |

| State deepfake/publicity laws | Binding, varies by state | Content distributed in that state |

Where the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète → actually breaks

MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → this onto a real production and distribution workflow:

1. Generation: an AI tool creates or modifies footage, voice, or music.

2. Review: legal/compliance checks rights, likeness consent, disclosure obligations.

3. Tagging: metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). or watermark applied (required under EU AI Act Art. 50 for providers).

4. Distribution: content ships to EU, US national, and specific state audiences simultaneously.

The failure point is almost always step 2 to step 3: teams generate first and ask "do we need to disclose this" after the asset is already in the release pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète →, when it's expensive to retrofit a watermark or add a disclosure banner.

A simple technical practice that avoids this: bake a disclosure metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). check into the content management system (CMS) itself, so nothing routes to publishing without a flag.

# Pseudocode: pre-publish gate for AI-generated media assets
def check_release(asset):
    if asset.contains_ai_generated_likeness:
        require(asset.consent_on_file)         # state publicity laws
        require(asset.disclosure_label)         # EU AI Act Art. 50
    if asset.target_regions.includes("EU"):
        require(asset.machine_readable_tag)      # provider obligation
    if asset.is_political and asset.target_regions.includes("US"):
        flag_for_legal_review("FCC rule pending, state law may apply")
    return asset.compliant

This isn't production code, it's the logic a governance team should be able to state in one paragraph before an engineer builds it.

Model risk underneath the legal risk

Regulatory exposure is the visible layer. Underneath it sits model risk: the chance the AI system itself produces a wrong, biased, or unsafe output that triggers the legal exposure in the first place.

Three risks recur across media AI deployments:

• Likeness drift: a voice or face clone model trained on one actor's data generalizes in ways that resemble a different real person, creating unintended right-of-publicity exposure.
• Provenance loss: content gets re-edited, clipped, or re-uploaded by users or partners, stripping the watermark or metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). tag required for disclosure.
• Disclosure fatigue: over-labeling everything "may contain AI" erodes the "clear and distinguishable" standard regulators actually want, since audiences stop noticing labels.

The Coalition for Content Provenance and Authenticity (C2PA) standard, backed by Adobe, Microsoft, and major camera and publishing companies, is the leading technical answer to provenance loss: it embeds tamper-evident metadata about how content was created or edited. It's voluntary today but increasingly treated as the de facto way to satisfy EU AI Act tagging obligations.