On December 2, 2026, the last grace period in the EU AI Act’s transparency regime closes. From that date, every generative AI system already on the European market has to mark its output in a machine-readable format that a third party can detect as artificially generated. The disclosure rules themselves went live on August 2, 2026. The eleven weeks between now and the December deadline are the runway for systems that shipped before August to catch up.
Most teams I talk to think they are covered because they slap a visible “Made with AI” caption on the image or a footer on the chatbot. That caption matters, but it satisfies a different obligation than the one with the December clock on it. EU AI Act content marking is really two separate duties wearing one name, and conflating them is the most common way a compliance plan looks finished on a slide and fails on inspection.
Two obligations that keep getting merged into one
Article 50 of the AI Act splits along a line that maps to who you are in the supply chain, and the split is the whole game.
If you build or brand the model that generates content, you are a provider under the Act. OpenAI, Anthropic, Canva and Grammarly are the textbook examples. Your obligation is Article 50(2): the synthetic output itself must be marked in a machine-readable format and be detectable as artificially generated or manipulated. This marking is not primarily for a human reader. It is a signal a verifying machine can extract from the file.
If you take a third-party model and put it to work under your own authority, you are a deployer. Your obligation is Article 50(4): when you publish a deepfake, you label it visibly; when you publish AI-generated text on a matter of public interest, you disclose that too. This is the human-facing caption, the disclaimer, the audible warning.
The visible label and the machine-readable mark are not substitutes. A newsroom that stamps “AI-generated illustration” under an image has met a deployer duty and done nothing about the provider duty. The reverse is just as common: a model vendor that embeds clean provenance metadata still owes its customers a way to surface a human-facing disclosure. If you both build and publish, and many enterprises now do because they fine-tune and self-host, you owe both. Standing up your own open-weight model on your own hardware is exactly the move that quietly turns you into a provider (see self-hosting an open-source LLM for what that entails operationally).
What “machine-readable” actually has to mean
This is where a caption stops being enough. The Commission’s draft Code of Practice on marking and labelling AI-generated content, first published December 17, 2025 and worked through several drafts toward finalization, sets four properties a marking solution has to satisfy. A verifier reads them as a test you either pass or fail:
- Effective. The marking genuinely identifies the content as AI-generated to a party checking it, not just to your own dashboard.
- Interoperable. Any compliant verifier can read the mark. A proprietary flag only your tooling understands does not count.
- Robust. The mark survives ordinary handling: format conversion, re-encoding, a resize, a minor edit.
- Reliable. The mark is tamper-evident, so a verifier can tell whether it has been altered or forged.
Read those together and a visible watermark or a text caption fails on its own. A human-readable “AI” badge is not interoperable in the machine sense, is trivially cropped, and carries no tamper evidence. The obligation points at something more like a signed provenance record than a sticker.
C2PA is the answer the Commission is pointing at, with a catch
The Act names no single technology on purpose. But the draft Code of Practice lists C2PA Content Credentials as an example that meets all four criteria, and in practice C2PA plus the draft ISO provenance work is where the market has landed. It is already deployed by Adobe, OpenAI and Google.
Mechanically, C2PA embeds a cryptographically signed manifest inside the file. It uses a shared container format (JUMBF), a JSON-LD claim schema describing what happened to the asset, and a COSE signature with a certificate chain. A valid manifest carries a c2pa.created action signed by the generating provider, and any change to the file breaks the signature against the C2PA trust list. That is what “tamper-evident” buys you.
Here is the catch that trips up teams who think one integration closes the file. C2PA lives in metadata, and metadata gets stripped. A naive re-save, a screenshot, an upload through a platform that scrubs the container, and the signed manifest is gone. The provenance survives C2PA-aware pipelines and dies in the wild.
That is why the durable answer is two layers, not one. You pair the C2PA manifest with an invisible watermark embedded in the pixels or tokens themselves, the way Google’s SynthID does. SynthID survives re-encoding, resizing and screenshots, and lets a verifier recover a provenance lookup even after the metadata is stripped. The tradeoff is that the watermark carries only an identifier, not the full signed edit history the manifest holds. Each covers the other’s failure mode. The industry has quietly converged on this: on May 19, 2026, OpenAI joined the C2PA steering committee and committed to embedding SynthID alongside the Content Credentials it already attaches, and Google said C2PA verification and SynthID detection are coming natively to Search and Chrome. When the biggest model vendors and the biggest distribution surface align on the same pair, that is your signal for what a defensible implementation looks like.
This reaches you even if you are not in Europe
The turnover-based penalty is the tell that this is not a European-companies-only rule. Non-compliance with Article 50 sits in the AI Act’s middle enforcement tier: administrative fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher. “Worldwide turnover” is not a phrase you write for a rule you intend to apply only to firms inside the bloc. If your model or your content reaches users in the Union, you are in scope regardless of where you are headquartered. A US SaaS company serving European customers is exactly the profile the drafters had in mind.
Enforcement powers went live on August 2, 2026, and national market-surveillance authorities can act. No fines have landed yet, and I would treat any “first fine” figure circulating online with suspicion until a named regulator confirms it. But “no fines yet” is a poor thing to build a plan on when the marking clock runs out December 2 and the ceiling is 3% of global revenue.
The exemptions are real and narrower than you want
Article 50 carves out genuine exceptions, and I have watched teams over-read every one of them. The marking and disclosure duties ease for:
- Assistive editing that does not substantially alter the input: grammar and spelling correction, minor touch-ups.
- AI-generated text that a human has reviewed and taken editorial responsibility for before publication. Editorial responsibility is the operative phrase, not a rubber stamp.
- Artistic, satirical or clearly fictional work, where disclosure happens in a manner that does not spoil the piece.
- Law enforcement uses tied to detecting and investigating crime.
None of these is a general escape hatch. “A person glanced at it” is not editorial responsibility. “It is creative” does not exempt a photorealistic deepfake of a real public figure. Build your compliance plan on the marking obligation applying, and treat the exemptions as documented, deliberate exceptions for specific pipelines, not as the default posture.
A practitioner sequence that survives an inspection
Running compliance work in an IT operations shop for two decades taught me that the plans that hold up are the ones with an owner, an artifact, and a way to prove the control works. Article 50 is no different. The sequence I would run:
Inventory first. List every system that generates text, image, audio or video reaching EU users, and tag each one as provider-obligation, deployer-obligation, or both. Fine-tuned and self-hosted models go in the provider column even if the base weights came from someone else. You cannot mark what you have not enumerated.
Sample your current output. Pull real generated assets and inspect them for existing marking. Most homegrown pipelines mark nothing. Vendor outputs may already carry C2PA, and the major image models increasingly attach Content Credentials by default; confirm it rather than assume it, and confirm it survives your own downstream processing.
Instrument the output pipeline, not the UI. The mark has to be attached where content is generated and has to ride through your CDN, your image resizer, your CMS. Get CA-recognized signing certificates for C2PA, and add an invisible watermark layer so the provenance survives metadata stripping. A mark that only exists in the browser tab is not a mark.
Give verifiers a path. Document the marking mechanism in your system card and expose a way for a third party to check it. Interoperability is a legal criterion, so an internal-only checker does not satisfy it.
Wire the deployer disclosures separately. Chatbot and voice-agent “you are talking to an AI” notices at first interaction, visible deepfake labels, public-interest text disclosures. These are the human-facing controls, and they are a different work item from the machine-readable mark. Agentic systems that act on a user’s behalf make this sharper, because the line between assistant and autonomous actor blurs (the same containment thinking that governs AI browser and agent security applies here).
Keep an audit trail. Who owns each control, when it was verified, what a sample check returned. When a market-surveillance authority asks, “show me,” the answer is a log, not a memory.
What is still moving
Two things are not fully settled, and honest planning names them. The standardized EU label, the visible “AI” mark the Commission has floated, is still being defined through the Code of Practice, so build for the machine-readable obligation now and leave room for a specified human-facing badge later. And the Code of Practice is voluntary: following it is the cleanest way to demonstrate compliance, but it is presumption of conformity, not the black-letter requirement itself. The requirement is Article 50. The Code is the safe harbor.
The larger pattern is worth sitting with. For a year the AI transparency conversation has been about who gets to write the safety rules and which lab concedes what in a system card. Article 50 is the first place that conversation turns into a dated engineering task with a turnover-based penalty attached. The frontier-model debates set the tone; a signed manifest and a pixel-level watermark on every asset you ship into Europe is what actually clears the bar. December 2 is when the second thing starts to matter more than the first.