What are the AI product image compliance requirements for online sellers in 2026?

Why AI Product Images Are Suddenly a Regulated Asset

Until 2024, an AI-generated product photo was treated as a creative shortcut — a way to skip expensive studio shoots and produce lifestyle imagery at scale. By August 2026, that same image sits inside a regulatory perimeter that spans the European Union, New York State, California, Texas, and the major marketplace platforms. The shift did not happen overnight. It is the result of three converging forces: the EU AI Act's transparency obligations (effective 2 August 2026 for general-purpose AI providers), New York's two AI-disclosure statutes that took effect in May 2025, and California's AB-2013/AB-1836 disclosure regime that became enforceable in 2026. Each rule targets a slightly different actor — model providers, deployers, or sellers — but the practical effect on a merchant uploading a JPEG is the same: the image must be traceable, labeled, and, in some cases, provably non-deceptive.

Also worth reading: What are the definitive Amazon supplement listing requirements for 2026 regarding AI-generated imagery and safety compliance? · How do enterprises manage AI synthetic media DAM compliance for product images? · How should e-commerce businesses handle AI image disclosure requirements in 2026?

The core problem regulators are trying to solve is consumer deception. A buyer who sees a hyper-realistic AI model wearing a dress cannot tell whether the garment was actually worn, whether the model consented, or whether the fabric drapes the way the picture suggests. New York's law, for example, was drafted specifically to address digitally created performers in advertising. California's law focuses on sexually explicit deepfakes but extends to commercial contexts. The EU AI Act takes a different angle: it requires that outputs of generative AI systems be machine-readable and marked in a way that allows downstream users to detect manipulation. None of these laws were written with a small Etsy seller in mind, but all of them apply to one.

The EU AI Act: What Changes on 2 August 2026

The most consequential deadline for cross-border sellers is 2 August 2026, when Article 50 of the EU AI Act becomes enforceable for providers of general-purpose AI (GPAI) models. Article 50 imposes two transparency duties that cascade down to anyone using those models commercially. First, providers must ensure that AI-generated outputs are marked in a machine-readable format that allows detection of manipulation ("watermarking"). Second, deployers — which includes any business using a GPAI model to generate product imagery — must disclose that the content was AI-generated when it could otherwise be mistaken for human-authored work.

For a seller, this means that if you use Midjourney, DALL-E, Stable Diffusion, Adobe Firefly, or any comparable tool to create a product photo, the resulting image must carry a technical marker (typically a C2PA credential or a platform-native watermark) AND your listing must contain a plain-language disclosure. The EU has not prescribed a single sentence, but enforcement guidance from the European AI Office suggests wording such as "This image was generated using artificial intelligence" adjacent to the picture. Reduced requirements apply to open-source models whose weights are publicly available, but the disclosure obligation on the deployer remains.

The penalty structure is asymmetric. Providers of GPAI models face fines up to 3% of global annual turnover or €15 million, whichever is higher. Deployers — including small sellers — face the lower Member State penalty tier, typically €7.5 million or 1% of turnover, but national regulators have signaled that first-time offenders with under €2 million in revenue will likely receive warnings rather than fines during the 12-month grace period. The grace period is not codified; it is a stated enforcement priority.

United States: A Patchwork of State Laws

There is no federal AI image law in force as of August 2026, but the state-level picture is dense enough that a national seller cannot ignore it. New York enacted two statutes in 2024 that took effect in May 2025. The first requires digital replicas of performers to be disclosed in advertising; the second requires platforms to provide disclosure tools for AI-generated images of identifiable persons. California followed with AB-2013 (digital replicas of performers) and AB-1836 (prohibitions on sexually explicit non-consensual deepfakes), both enforceable in 2026. Texas passed the Texas Responsible AI Governance Act in June 2025 with broad compliance mandates that touch on disclosure for AI-generated content in commercial settings.

The practical threshold for sellers is whether the AI image depicts a recognizable person. If you generate a lifestyle photo with a synthetic model whose face is not based on a real individual, New York's performer-disclosure rule does not technically apply, but California's broader consumer-protection statutes and the EU's deployer obligation still do. If the AI image depicts a likeness of a real person — including a stock model whose face was scraped — you are in the highest-risk category and need both a disclosure and, in many cases, a signed likeness release.

Marketplace rules add a fourth layer. Amazon announced in 2024 that sellers must label AI-generated images of people in listing photos, and the policy has tightened through 2025 and 2026. Etsy requires sellers to disclose AI-generated media in listings. Shopify has not mandated disclosure but has published guidance recommending it. Violations on Amazon have resulted in listing suppression and, in repeat cases, account suspension.

What "Compliance" Actually Looks Like in a Listing

A compliant AI product image in August 2026 typically contains four elements. The first is a technical provenance marker embedded in the file — a C2PA Content Credential, a platform watermark, or a steganographic signature. Adobe, Microsoft, OpenAI, Google, and the major camera manufacturers are all shipping C2PA-compatible tooling in 2026, so this is no longer a specialist capability. The second is a visible disclosure on the listing page, usually in the image caption or a dedicated "About this image" section. The third is metadata in the product feed: a flag in the schema.org/Product structured data, or the marketplace-specific field (Amazon's "AI-generated" attribute, Etsy's disclosure checkbox). The fourth is a record-keeping file — the prompt, the model version, the date, and the operator — kept for at least 24 months to satisfy EU traceability requirements.

The disclosure language does not need to be legalistic. "AI-generated image" or "Created with AI" is sufficient in most jurisdictions. What is not sufficient is burying the disclosure in a terms-of-service link or using a tooltip that disappears on hover. Regulators in both the EU and California have signaled that disclosures must be "clear and conspicuous" — meaning visible before the consumer clicks, in the same visual field as the image.

Comparison of Major Regulatory Regimes

The table makes the asymmetry visible. The EU is the only regime that mandates a technical watermark, and it is also the only one that explicitly covers non-human subjects (a synthetic handbag on a synthetic table). New York and California focus on likeness rights. Texas is the broadest in commercial scope. Amazon's policy is the narrowest in subject matter but the fastest in enforcement.

Practical Steps for Sellers

The first step is an audit. Pull every product image currently live across your storefronts and tag each one as human-shot, AI-generated, AI-edited, or hybrid. AI-edited — where a real photo was retouched with generative fill or background replacement — is a gray zone that most regulators treat as AI-generated for disclosure purposes, but Amazon has historically been more lenient on edits than on fully synthetic images. The second step is to choose a provenance standard. C2PA is the de facto choice in 2026 because it is supported by Adobe, Microsoft, OpenAI, Google, and the major camera makers, and because the EU AI Office has signaled that C2PA-compliant markers will be presumed to satisfy Article 50. The third step is to update your listing templates to include a disclosure line and a structured-data flag. The fourth step is to retain prompt logs and model version records for at least 24 months. The fifth step is to train any staff or contractors who generate imagery on the disclosure rules — the deployer is liable, not the model.

For sellers operating only in the United States, the EU rules do not apply directly, but if you sell into the EU through Amazon EU, eBay EU, or your own Shopify store with EU shipping, you are a deployer under Article 50 and the rules apply. Geo-blocking the EU is the only way to avoid them, and most sellers find that uneconomical.

Common Mistakes That Trigger Enforcement

The most frequent error is assuming that AI-edited images are exempt. A product photo with a generative-fill background swap is still AI-generated for disclosure purposes under the EU AI Act and under Amazon's policy. The second most frequent error is disclosing only in the image metadata, where consumers cannot see it. The third is using a real person's likeness without a release — even if the likeness was generated by AI, training-data provenance claims have been used successfully in litigation. The fourth is failing to update disclosures when a model is retrained or replaced; the EU requires that the disclosure reflect the specific system version. The fifth is treating the marketplace's checkbox as sufficient — Amazon's attribute is necessary but not sufficient for EU compliance, which requires the technical marker.

A subtler mistake is over-disclosing in a way that suggests the product itself is fake. "AI-generated image" is accurate; "this product may not look like the picture" is a confession of weakness that no seller needs to make. The disclosure should be neutral and factual.

When to Act and What It Costs

The EU deadline is 2 August 2026, and the practical compliance window for sellers is the second quarter of 2026. Acting in Q1 2026 allows time to audit, retrain staff, and update templates without rushing. Acting in Q3 2026 means accepting some enforcement risk during the grace period. Acting in 2027 means the grace period is over and penalties are being assessed.

The direct cost of compliance is low. C2PA signing is free in Adobe products and in the open-source c2patool. Disclosure text is free. Structured-data flags are free. The indirect cost is the time spent auditing and updating listings, which for a 1,000-SKU catalog typically runs 40–80 hours of work, or $2,000–$6,000 if outsourced to a commerce operations freelancer. Enterprise sellers with 100,000+ SKUs should budget $25,000–$75,000 for a compliance project, including legal review.

The cost of non-compliance is asymmetric. A single listing suppression on Amazon can cost thousands in lost revenue per day. An EU enforcement action against a small seller is likely to be a warning in 2026, but a fine in 2027. A New York or California private right of action can cost $10,000–$100,000 in settlement even when the seller is blameless, because the cost of defense exceeds the cost of settlement.

The Limits of the Current Rules

It is worth being honest about what these rules do not do. They do not require disclosure of AI-generated text descriptions, only images and (under the EU) audio and video. They do not require disclosure of AI-assisted pricing or AI-recommended search results. They do not address AI-generated reviews, which remain a separate enforcement priority for the FTC and for marketplace trust teams. They do not require sellers to prove that an image is not AI-generated — the disclosure obligation runs in one direction only. And they do not, as of August 2026, create a private right of action under the EU AI Act; enforcement is regulator-led.

The rules are also uneven in their treatment of open-source models. The EU has carved out reduced requirements for models whose weights are publicly available and whose outputs are not monetized, but a seller using an open-source model to generate commercial imagery is still a deployer and still subject to the disclosure obligation. The open-source carve-out is for the model provider, not the user.

Finally, the rules are evolving. The EU AI Act is subject to amendment; the August 2026 deadline itself was the result of a 2025 deferral. U.S. federal legislation has been proposed but not enacted. Sellers should treat the current rules as a floor, not a ceiling, and build compliance processes that can absorb tightening without re-architecting their content pipelines.