EU AI Act and AI Music: Who Must Disclose

Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video content “that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful”. Both halves matter: it has to resemble something that exists, and it has to be capable of being mistaken for the real thing.

A song generated from your own prompt, sung by a voice that belongs to nobody, resembles no existing person. Synthetic is not the test — if it were, the clause would say synthetic content, which is what 50(2) says and 50(4) does not. A recognisable singer's cloned voice is the other case, and the one the clause exists for. Platforms already prohibit it on impersonation grounds: SoundCloud's guidance says AI content “must also not intentionally mislead listeners about its authenticity, origin, or the identity of the creator”.

One softening is worth knowing, because it is the difference between a credit line and a warning banner. Where a deep fake forms part of an evidently artistic, creative, satirical or fictional work, the Commission's FAQ says the obligation is “limited to the disclosure of the deepfake content in an appropriate manner that does not hamper the display or enjoyment of the work”. A line in the credits does the job.

Suno meets Article 50(2) with Content Credentials. Its own page states that “when a song is downloaded from Suno, we attach metadata identifying it as AI-generated content made with Suno”, built on C2PA, and it runs a tool that checks any file or public link for them — framed there as a response to “new AI transparency laws” coming into effect, without naming the Regulation.

One limitation on the same page matters for a back catalogue: this “only apply to new songs that are downloaded on Suno going forward”. Nothing is added retroactively, so for older material the file in your folder and the file you would download today are not the same object.

Separately, Suno said on 6 August 2026 that it would use audio watermarking and fingerprinting to prevent misuse on other streaming platforms. TechCrunch reported it was unclear which system Suno would adopt and that the company declined to detail the download policy announced alongside it. Nothing published since confirms the watermark shipped, which is why the table separates live from stated intent. The watermark research on sunowatermark.com tracks that question, and our page on Suno watermarking and download limits covers what the August announcement changed in practice.

Worth saying plainly, because the subject invites the opposite reading: a provenance credential is a disclosure mechanism the law obliges the generator to attach, and this page is not an argument for stripping it. Deezer's classifier works from the audio and never reads it anyway.

An artist who reads Article 50 correctly and concludes they owe nothing is right, and still has four or five disclosure decisions to make: the platforms wrote their own rules and did not wait for Brussels. SoundCloud is the only one that cites the Act — its creator guidance, updated 1 October 2026, says creators subject to the Article 50(4) requirements “are encouraged to disclose that their covered content is 'AI-generated or manipulated' within their track description”. Note the conditional.

Apple Music and YouTube differ again, and both are covered on AI music on Apple Music and AI music on YouTube. The distributor picture, read at source and dated, sits on platforms that accept AI music: six accept AI music openly, TuneCore's framework is the restrictive one, and what readers report is a release flagged by automated screening, not an AI ban.

That screening is a separate gate. Article 50 is about provenance; a distributor's intake check is about whether the audio sounds like a release it can deliver, which is where artifact cleanup belongs and where tools like Undetectr operate. The limits, stated plainly: no processing chain changes a provider's marking duty, strips a Deezer tag, or alters how a platform labels a release.

TIDAL is the row with money attached, and it reads as a warning: a platform can accept a track, label it, keep streaming it and decline to pay. Which is the argument for streaming not being the whole plan. Paid sync placements in TV, film, games and ads are where the real money in this niche gets discussed, and played.fm runs a sync-pitching route alongside a storefront where you keep 100% — neither depending on a streaming service's view of how a track was made.

Article 99 sets three tiers. Prohibited practices under Article 5 carry up to €35 million or 7% of worldwide annual turnover. The middle tier — where Article 50 sits, alongside the provider and deployer obligations in Articles 16 and 26 — carries up to €15 million or 3% of worldwide annual turnover.

Two things get left out whenever that number is quoted at artists. First, the percentage applies “if the offender is an undertaking” — operators with turnover, not individuals with a Spotify page. Second, Article 99(6) caps fines for SMEs and start-ups at whichever of the amount and the percentage is lower, the opposite of the rule for large undertakings.

And enforcement needs an obligation to enforce. A hobbyist is outside scope; a commercial releaser of original AI music has no marking duty and no deep fake to disclose. The realistic exposure is not a fine but a platform decision — a tag, a demonetisation, a rejected delivery, a takedown on impersonation grounds — which is why AI music removed from streaming is a more useful read on risk than the Regulation.

None of this is legal advice, and national enforcement practice here is barely two months old. This page is a map of the questions, not a substitute for someone qualified answering them.