--- title: "AI Image Generation Compliance in Germany: What Companies Need to Know (2026)" description: "AI image generation in Germany requires GDPR review, IP checks, and AI Act planning before Article 50 transparency rules apply on August 2, 2026." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/ai-image-generation/" language: "en" --- ![AI image generation compliance in Germany](https://compound.law/assets/images/compliance/compliance_1.webp) compliance # AI Image Generation Compliance in Germany: What Companies Need to Know (2026) 2 April 2026 Short answer German companies can usually use AI image generation for marketing, design, and internal workflows, but they should review GDPR exposure, disclosure duties under Article 50 of Regulation (EU) 2024/1689, vendor contracts, and copyright or personality-rights risk before publishing outputs. - Do not treat AI image generation as an AI Act-only question; GDPR and IP risks are often the immediate issue. - Plan for Article 50 transparency controls before August 2, 2026, especially for realistic or manipulative synthetic content. - Use prompt rules, approval workflows, provenance metadata, and vendor due diligence to reduce business risk. AI image generation is generally lawful for German companies, but it should be handled as a **combined GDPR, IP, and AI Act compliance question**, not just a creative-tool decision. If your team uses tools such as Midjourney, DALL-E, or Stable Diffusion, you should review personal-data use, disclosure and provenance controls, vendor terms, and publication approval before the image goes live. If you need the broader legal framework first, start with our [EU AI Act compliance checklist for German tech companies](https://compound.law/en-DE/news/eu-ai-act-compliance-checklist-german-tech-companies/). ## What Businesses Should Check First The fastest way to assess **AI image generation compliance in Germany** is to separate the legal issues by risk type: | Issue | Typical trigger | What companies should do | | ---------------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | GDPR | Prompts, uploads, or outputs contain identifiable people or business data | Check legal basis, provider terms, transfers, retention, and security | | AI Act transparency | Synthetic images may mislead users or qualify as deepfakes | Prepare disclosure, provenance, and publication controls | | Copyright and related rights | Prompts imitate protected works, logos, styles, or reference materials | Add review for source materials, claims handling, and brand-safe use | | Employment and governance | Employees use image tools in regulated or monitored workflows | Implement policy, training, approval steps, and where relevant works council review | For tool-specific issues, see our pages on [Midjourney](https://compound.law/en-DE/tools/midjourney/), [DALL-E](https://compound.law/en-DE/tools/dall-e/), and [Stable Diffusion](https://compound.law/en-DE/tools/stable-diffusion/). ## EU AI Act: What Actually Matters for AI Image Generation Many businesses overstate the AI Act risk and understate the operational risk. Most image-generation use cases are **not high-risk AI systems** under Regulation (EU) 2024/1689, but they can still trigger **Article 50 transparency obligations**. The key timing point is important: 1. The AI Act entered into force on **August 1, 2024**. 2. The first obligations, including bans on prohibited practices and AI literacy duties, started to apply on **February 2, 2025**. 3. GPAI-model obligations started to apply on **August 2, 2025**. 4. The AI Act transparency rules, including the rules most relevant for synthetic content, are scheduled to apply on **August 2, 2026**. For AI image generation, the practical questions are usually: - Is the output likely to be perceived as authentic or documentary? - Could the image manipulate viewers in a sensitive business context? - Are you creating or publishing synthetic depictions of real people? - Can your provider preserve machine-readable provenance or other detectable markers? That is why governance matters now even before the August 2, 2026 date. ## GDPR Risk Often Starts Earlier Than AI Act Risk For German companies, **GDPR** is often the first legal framework that bites. If staff upload headshots, customer photos, screenshots, ID documents, or internal material into an image tool, they may already be processing **personal data**. That creates immediate questions: - What is your legal basis under the GDPR? - Is the provider acting as a processor, an independent controller, or under mixed roles? - Are prompts, reference files, or outputs stored outside the EEA? - Does the provider reuse customer content for model improvement? - Do you need a **data protection impact assessment** because the workflow creates a high risk for individuals? The December 18, 2024 EDPB opinion on AI models reinforced that personal-data use for AI development and deployment still has to satisfy core GDPR principles, including lawful basis and a defensible assessment of whether data is truly anonymous. **Practical rule:** do not place personal data into image-generation prompts unless your legal team has already approved that workflow. ## Copyright, Brand, and Personality Rights Are the Business Risk Layer Companies often ask whether the generated image itself can be owned. In practice, the bigger question is whether the workflow creates **infringement or claims risk**. Typical red flags include: - prompts asking for output in the style of a known artist - use of copyrighted reference images without permission - synthetic depictions of real people without a consent and publicity-rights check - generated images that reproduce logos, product packaging, or protected designs - customer-facing campaigns that imply a real event, person, or endorsement that never existed Since August 2, 2025, the AI Act has also imposed copyright-related obligations on **providers of GPAI models**. That does not eliminate user-side risk. Businesses still need contract review, vendor diligence, and internal publication controls. ## Disclosure, Watermarking, and Provenance Controls When businesses think about **AI image generation disclosure**, they usually focus on a visible label. That can help, but it is not the whole control stack. A practical compliance setup usually includes: 1. A rule for when visible disclosure is mandatory. 2. Metadata or provenance preservation where technically feasible. 3. A review step for realistic human faces, political content, regulated claims, and crisis communications. 4. A record of which tool, model, prompt class, and source materials were used. This matters most where synthetic content could distort trust. Marketing illustrations may be low risk. A realistic executive portrait, product-use photo, or event image that never existed is different. If your company also creates synthetic motion content, compare this with our [AI video generation guide](https://compound.law/en-DE/compliance/ai-video-generation/). ## A Practical Safeguards Checklist for German Companies If you use AI image generation at scale, your baseline control set should usually include the following: ### 1. Restrict what employees may upload Prohibit personal data, customer files, confidential source material, and third-party reference images unless there is a documented approval path. ### 2. Approve tools centrally Do not let every team choose its own model. Legal, privacy, and security should approve a small set of providers and contract terms. ### 3. Define publication rules Decide when AI-generated images can be used in marketing, investor materials, recruiting, or product documentation and when human review is mandatory. ### 4. Preserve evidence Keep prompt templates, source files, and publication records long enough to investigate a complaint or prove what happened. ### 5. Train staff The AI Act already expects sufficient **AI literacy**. For image tools, training should cover misleading content, personal-data use, IP risk, and escalation paths. ### 6. Coordinate with HR and the works council where relevant If image-generation workflows affect employees, branding of staff, or monitored internal systems, German labor-law issues can arise alongside privacy review. ## Where Current Pages Usually Miss Search Intent Search results for this topic now lean toward **decision-ready guidance**, not abstract summaries. Businesses usually want to know: - whether they can use AI-generated images in advertising - whether realistic synthetic content needs disclosure - whether prompts or uploads create GDPR exposure - how to reduce copyright and training-data risk - which approvals should exist before publication That means a useful page should answer operational questions directly, use concrete dates, and explain what legal teams should implement next. ## When to Get Specific Legal Advice Generic guidance stops being enough when your use case involves real people, regulated sectors, sensitive data, investor communications, healthcare, employment, or large-scale public campaigns. At that point, the question is not whether AI image generation is allowed in principle, but whether your specific workflow is defensible. Compound Law advises companies in Germany on **AI Act, GDPR, commercial contracts, employment law, and IP issues** connected to generative AI. If you want to review a specific image-generation workflow, vendor stack, or disclosure setup, [contact us](https://compound.law/en-DE/#booking). ## FAQ ### What is AI image generation compliance in Germany? It is the legal and operational review of how a company creates, approves, and publishes AI-generated images in Germany. In practice, that means combining EU AI Act planning with GDPR, IP, contract, and governance controls. ### How does the AI Act affect AI-generated images? The AI Act mainly matters through **Article 50 transparency obligations** for synthetic content and through GPAI-related provider obligations. For most businesses, the operational challenge is preparing disclosure and provenance controls before the relevant transparency rules apply on **August 2, 2026**. ### Do we need a GDPR assessment for image-generation tools? Yes if the workflow touches personal data. That can include prompts naming individuals, uploaded photographs, reference material, or outputs that depict identifiable people. The assessment should cover legal basis, provider role, transfers, retention, and security. ### Can we use AI-generated images in advertising? Often yes, but only with guardrails. Review whether the image could mislead consumers, imply a real person or event, reuse protected materials, or create consumer-protection or unfair-competition risk. Realistic campaign content should go through an approval workflow. ## Related Compliance Guides [![EU AI Act training obligation and Article 4 AI literacy in Germany](https://compound.law/assets/images/compliance/compliance_2.webp)](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [compliance](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) ### [EU AI Act Training Obligation: What Article 4 Requires](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [EU AI Act training obligation under Article 4: who it covers in Germany, what AI literacy measures to implement, and how to document compliance.](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions Usually yes, but legality depends on the workflow. The practical analysis usually covers GDPR, contract terms, copyright and personality rights, plus EU AI Act transparency planning. The AI Act is already in force, but the transparency rules in Article 50 are scheduled to apply from August 2, 2026. Companies should prepare before then if they publish realistic or deceptive synthetic content. Yes if prompts, uploads, reference images, or generated outputs contain personal data. Companies should check legal basis, vendor role allocation, international transfers, and whether a DPIA is needed. For many businesses, the main risk is not the AI Act alone but a combination of misleading synthetic content, personal-data misuse, and infringement of third-party IP, brand assets, or likeness rights. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "AI Image Generation Compliance in Germany: What Companies Need to Know (2026)", "description": "AI image generation in Germany requires GDPR review, IP checks, and AI Act planning before Article 50 transparency rules apply on August 2, 2026.", "image": "https://compound.law/assets/images/compliance/compliance_1.webp", "datePublished": "2026-04-02T00:00:00.000Z", "dateModified": "2026-04-02T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/ai-image-generation/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "AI Image Generation Compliance in Germany: What Companies Need to Know", "item": "https://compound.law/en-DE/compliance/ai-image-generation/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is AI image generation legal for companies in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Usually yes, but legality depends on the workflow. The practical analysis usually covers GDPR, contract terms, copyright and personality rights, plus EU AI Act transparency planning." } }, { "@type": "Question", "name": "When do AI Act transparency rules matter for AI-generated images?", "acceptedAnswer": { "@type": "Answer", "text": "The AI Act is already in force, but the transparency rules in Article 50 are scheduled to apply from August 2, 2026. Companies should prepare before then if they publish realistic or deceptive synthetic content." } }, { "@type": "Question", "name": "Does GDPR apply when teams use Midjourney, DALL-E, or similar tools?", "acceptedAnswer": { "@type": "Answer", "text": "Yes if prompts, uploads, reference images, or generated outputs contain personal data. Companies should check legal basis, vendor role allocation, international transfers, and whether a DPIA is needed." } }, { "@type": "Question", "name": "What is the biggest legal risk with AI-generated marketing images?", "acceptedAnswer": { "@type": "Answer", "text": "For many businesses, the main risk is not the AI Act alone but a combination of misleading synthetic content, personal-data misuse, and infringement of third-party IP, brand assets, or likeness rights." } } ] } ] ```