Article 50 of the EU AI Act, the transparency article, has applied since 2 August 2026. For one of its duties, the machine-readable marking of AI-generated content in Article 50(2), the Digital Omnibus on AI added a short transition. Providers of generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to comply.
If you run an AI image feature that launched before August, you have about four weeks left. If it launched after, the grace period never applied to you. This article sets out the dates, what the final Code of Practice expects in technical terms, and a practical checklist.
The dates at a glance
| Date | What happened |
|---|---|
| 10 June 2026 | Final Code of Practice on Transparency of AI-generated Content published |
| 24 July 2026 | Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal |
| 27 July 2026 | Digital Omnibus enters into force |
| 2 August 2026 | Article 50 applies, including marking for generative systems placed on the market from this date and deepfake labelling by deployers |
| 2 December 2026 | End of the marking transition for generative systems placed on the market before 2 August 2026 |
| 2 February 2027 | Watermark-detection interoperability commitment for Code signatories |
The Omnibus also moved the high-risk deadlines: stand-alone high-risk systems listed in Annex III now apply from 2 December 2027, and AI embedded in products covered by Annex I from 2 August 2028. Those changes do not affect Article 50.
What Article 50(2) asks for
Article 50(2) applies to providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text. They must ensure that outputs are:
- marked in a machine-readable format, and
- detectable as artificially generated or manipulated.
The technical solutions must be effective, interoperable, robust and reliable as far as technically feasible. The Act allows for the specifics of each content type, the cost of implementation and the generally acknowledged state of the art.
There are exceptions. The duty does not apply where the system only performs an assistive function for standard editing, or does not substantially alter the input data or its semantics. There is also a carve-out for systems authorised by law for criminal investigations. Where "assistive" ends is fact-sensitive.
Provider or deployer?
Two roles appear in Article 50, with different duties:
- A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. Provider duties include the Article 50(2) marking.
- A deployer uses an AI system in a professional activity. Deployer duties include the Article 50(4) obligation to disclose deepfakes and AI-generated text published to inform the public.
Many products sit in a grey zone. A typical example is an image feature built on a third-party model and offered under your own brand. Whether that makes you a provider of the AI system is a question to settle with counsel. It decides whether the 2 December date is yours.
What the final Code of Practice expects
The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026. It is voluntary, and adherence is not conclusive evidence of compliance. Signatures are conditional on a positive adequacy assessment by the Commission and the AI Board. Still, it is the most concrete description so far of what "marked and detectable" means in practice.
Section 1, which applies to providers, sets out roughly the following:
- At least two marking layers for most content: digitally signed, timestamped metadata and an imperceptible watermark. A single layer is accepted for free-form text and for AI embedded in closed physical products.
- Fingerprinting or logging may be added on top, but cannot replace the two core layers.
- Detection must be available, as a public specification, downloadable software or a cloud API. Access is free by default; smaller providers may charge a reasonable fee for burdensome volumes, but regulators, researchers, media, fact-checkers and civil society always get free access.
- Preserve the marks. Providers should make efforts to keep metadata intact, prohibit intentional removal of markings in their terms, and not offer tools designed to circumvent them.
Section 2 covers deployers. Deepfakes and AI-generated text on matters of public interest must be disclosed clearly, at the latest at the first interaction or exposure. The Code adopts an EU "AI" icon as the core visual mark.
A checklist for the next four weeks
This is a technical checklist, not legal advice.
- Confirm your launch date. Was your generative system on the market before 2 August 2026? Keep the evidence.
- Map every output path. API responses, web app downloads, exports, thumbnails, emails, anything that leaves your system with generated pixels in it.
- Mark at generation time. Apply signed metadata and the watermark before the image reaches storage or a CDN, so every copy downstream starts from a marked file.
- Stop your pipeline from undoing it. Image optimization that resizes or re-encodes strips metadata and can damage watermarks. Exclude marked outputs or mark after the last transformation.
- Decide how others can detect your marks. The Code expects detection to be available to third parties.
- Update your terms to prohibit removing or altering the markings.
- Keep records: when marking started, which layers, how you tested them, and on which outputs.
- Do not chase the past. Per the Commission's FAQ, content generated before the obligations applied does not need retroactive marking.
Where the OpenCorpo Compliance API fits
The Compliance API applies three layers to an AI-generated image in one call, for €0.01 / image:
| Code of Practice layer | What the API applies |
|---|---|
| Signed, timestamped metadata | A C2PA manifest signed with OpenCorpo's certificate: AI-generated (trainedAlgorithmicMedia), generator, organization, time |
| Imperceptible watermark | An invisible watermark in the pixel data carrying the asset id |
| Optional fingerprinting | A perceptual fingerprint in your account's registry that matches resized and recompressed copies |
Our step-by-step guide has working curl, Python and Node.js code. The limits matter just as much:
- Images only. Video, audio and text are not marked by the API.
- The watermark survives metadata stripping, not re-encoding. JPEG compression, resizing and rescaled screenshots destroy it. The fingerprint covers those cases, but only against your own account's registry.
- Detection. Any C2PA tool can read the manifest. The watermark and fingerprint are checked through
POST /v1/compliance/verify, which needs an OpenCorpo API key. Plan how third parties will detect your marks with that in mind. - Signer status. Third-party validators show the signature as untrusted until OpenCorpo's certificate is on the C2PA trust list. The manifest is still read and validated.
Whether this combination meets your obligations depends on your role, your products and the outcome of the Code's adequacy assessment. That is a question for your legal team. The API gives you the technical layers to build on, and your first 3 calls are free so you can test them on your own outputs.
What the fines look like
Under Article 99(4) of the AI Act, breaching the Article 50 transparency obligations can lead to fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs, including start-ups, Article 99(6) applies whichever of the two is lower. Enforcement sits mainly with national market surveillance authorities.
Sources
- Regulation (EU) 2024/1689, the AI Act, Articles 50 and 99
- European Commission: Signing the Code of Practice on Transparency of AI-generated Content (FAQ)
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, Official Journal of 24 July 2026
Frequently asked questions
Does the 2 December 2026 grace period apply to my product?
It covers providers of generative AI systems that were placed on the market before 2 August 2026. A system first placed on the market on or after 2 August 2026 gets no grace period and has had to mark its outputs from launch. Check the dates in your own records and with counsel.
Do I need to mark images generated before the obligation applied?
According to the European Commission's FAQ on the Code of Practice, content generated before the obligations became applicable does not need to be marked or labelled retroactively.
Is C2PA mandatory under the AI Act?
No standard is named in the Act. The final Code of Practice describes digitally signed, timestamped metadata plus an imperceptible watermark as the core layers; C2PA is the most widely used format for the signed-metadata layer.
Is the Code of Practice binding?
No. It is voluntary, adherence is not conclusive evidence of compliance, and signatures are conditional on a positive adequacy assessment by the Commission and the AI Board.
What is the maximum fine for breaching Article 50?
Under Article 99(4), up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, Article 99(6) applies whichever of the two is lower.
Does Article 50(2) cover text, audio and video too?
Yes. It covers AI systems generating synthetic audio, image, video or text. The Code allows a single marking layer for free-form text. OpenCorpo's Compliance API currently marks images only.
This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for advice specific to your situation.