What Article 50 says, and who it binds

Article 50 applies on 2 August 2026, and the text of it is short. Outputs must be marked in a machine-readable format and detectable as artificially generated², which states the goal and says nothing about the build. The build is in the Code of Practice, which is more specific than its voluntary status suggests and asks for more than most teams have scoped for.

The obligation splits in two, and which side you land on decides what you owe.

Article 50(2) binds providers, so if your system generates synthetic audio, image, video or text, its outputs are in scope. Article 50(4) binds deployers, and requires anyone publishing a deepfake to disclose that the content was artificially generated or manipulated². Plenty of companies are both, and any company that uses its own platform is both by definition.

The word deepfake is doing more work in the Act than it does in conversation. Article 3(60) defines it as content that resembles existing persons, objects, places, entities or events and “would falsely appear to a person to be authentic or truthful”³. There is no requirement of intent to deceive, and no exemption where the person depicted agreed to it.

So an avatar of a consenting employee is still a deepfake, even in a video the recipient knows is synthetic. The definition turns on what the content resembles, not on anyone’s motives.

If you call someone else’s model, are you the provider?

The Code of Practice says marking techniques “may be implemented at different stages of the value chain (e.g., by the provider of the AI system itself or by an upstream model provider) and may also be provided by third parties”¹. If the model you call already watermarks what it produces, the work is happening somewhere else and you inherit the benefit.

The sentence does not end there. Relying on those solutions is permitted “without prejudice to the Signatories’ own responsibility under the AI Act and the Code to ensure that the outputs of their AI systems are suitably and compliantly marked”¹. The same construction appears again for detection.

Products fall over on that gap, and it is a reading error rather than a loophole anyone is exploiting. If the file you deliver is something you assembled, a composition of generated frames with a synthesised voice over it, no upstream model made that file and no upstream watermark is in it. The permission still applies to you. It has nothing left to cover.

Researchers at Maastricht University worked through 50 image-generation systems and found 38% carrying any machine-readable marking and 18% carrying any visible disclosure⁵. The shortfall concentrated where the reading error predicts: large end-to-end providers had built something, while smaller providers relying on APIs or open-source models “rarely implemented adequate protections”⁵. The most common thing they did find was plain metadata, which is the layer that comes off most easily.

Is C2PA enough on its own?

C2PA is the open standard most people mean when they talk about signed provenance: a tamper-evident record, attached to a file, of what made it and how. For video that travels online, it is not enough on its own. The reasoning is worth following, because it is conditional rather than dogmatic and that changes how long the answer stays true.

Measure 1.1 asks for at least one machine-readable marking technique. It then adds a condition: so long as no single technique can, under the state of the art, meet all four of Article 50(2)‘s requirements of effectiveness, interoperability, robustness and reliability, you implement “at least two layers of machine-readable marking”¹. Sub-measure 1.1.1 is digitally signed metadata and Sub-measure 1.1.2 is imperceptible watermarking. Fingerprinting sits at 1.1.3 and is optional.

Two layers, because each one covers the other’s failure. Signed metadata carries rich structured provenance and dies the moment a file is re-encoded, and Measure 3.3 requires markings to survive recompression and format change¹. A watermark lives in the pixels and comes through transcoding intact, but it carries only a few hundred bits, nowhere near enough for a provenance record. Each is insufficient alone in a different direction.

The document names single-layer exceptions for systems embedded in closed physical products and for free-form text, “given that free-form text cannot transport metadata”¹. It also leaves room to drop to a single technique later, for anyone who can demonstrate equivalent performance to market surveillance authorities. Neither exception helps a video product, but this is a rule written against the state of the art rather than a permanent one, and it is designed to move when the technology does.

The Code of Practice does not name a single technology

A number of widely-read summaries have this backwards, so it is worth being exact.

The Code prescribes outcomes and leaves the method entirely to you. It describes signed metadata and imperceptible watermarking as categories of technique, and it stops there. Across all 38 pages there is no mention of SynthID, of C2PA or Content Credentials, or of Google, Adobe, Microsoft, Meta, IPTC or ISO¹. The method is left open, which is the reason a European company can meet the requirement with an open implementation it hosts itself rather than adopting whichever proprietary system the market has drifted towards.

One caveat on that. The Commission separately publishes Guidelines on transparency of AI-generated content, a different instrument with a different status, so this is a statement about the Code of Practice and not about everything Brussels has written on the subject.

What the rules make easier than expected

The reliefs are real, and they are reported far less than the obligations.

The EU publishes an icon for visual disclosure that is “publicly available for everyone to use freely”¹, so the badge is drawn for you and you do not have to design one. The disclosure is not optional and neither are the design specifications behind it, but you may ship the EU icon or an equivalent label that meets them¹. Proportionality for small and mid-sized companies, startups included, is written into the Code’s own recitals rather than left to interpretation¹. Detection has to be free, though a provider with fewer than a million monthly users may charge a reasonable fee where one user’s request volume goes past a sensible threshold¹.

If you are small, the route to know about is the third one in Measure 3.4. Cross-provider interoperability can be satisfied by “a shared provider detection solution by a consortium of Signatories”¹. You are not required to build an island.

You have to run a public detection service, and keep it free

The word “detectable” in Article 50(2) is not a property of the file. Commitment 2 turns it into a service you operate: hand it a copy of a video and it answers whether your system produced that video.

The demands inside that are easy to miss. It has to cover every marking technique you implemented rather than the one that is cheapest to check. It has to be reachable by a named list that runs from deployers and your own users through to competent authorities, researchers, civil society and media organisations. And the answer has to arrive in a form those people can use, which is an accessibility requirement rather than a turn of phrase.

You can deliver it as a public specification others implement, as software that runs locally, or as a cloud service behind an API¹.

Then the cost lands somewhere. Recovering a watermark is GPU work, so every call carries a real unit cost, and the service stays free for authorities, media, fact-checkers, researchers and civil society however much volume they bring¹. A mandatory free service with a genuine per-call cost is an unusual thing to design, and it is the strongest practical argument for the consortium route in Measure 3.4 existing at all. I mean this as a real offer, not a sign-off: if you are building toward the February 2027 date, I want to compare notes and work out whether a shared detection solution makes sense. Message me on LinkedIn.

The deadline that governs you is probably not 2 August

The AI Omnibus, which the Council cleared in July 2026, gives systems already on the market before 2 August 2026 until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2)⁷. Anything placed on the market on or after 2 August gets no transition at all.

The part that gets lost is how narrow that relief is: it covers Article 50(2) and nothing else. The chatbot disclosure in 50(1), the biometric notification in 50(3) and the deepfake disclosure duty in 50(4) all apply from 2 August 2026⁸. So a company shipping a product built before the deadline may have four extra months for its watermarking work, and no extra time whatsoever for the visible label its customers rely on. Non-compliance with the Article 50 obligations carries administrative fines of up to 15 million euro or 3% of total worldwide annual turnover, whichever is higher⁴.

The paperwork runs on other people’s calendars

No amount of engineering effort compresses this track, which is what makes it dangerous to leave until the build is done.

To have provenance records that verifiers trust without a warning, you need a signing certificate from an approved authority, and the steps are strictly sequential. Registration with the conformance program comes first, because the authorities on the trust list are bound to issue only to products already holding a conformant record⁹. Organisation validation follows that. None of the three can be run in parallel, and all of them sit in other people’s queues.

A signed record and a trusted one are different things, and the difference decides your ship date. What the Code of Practice requires is that provenance records are signed and timestamped in a secure and tamper-evident manner, not that they carry a trust-listed certificate¹. Compliance begins when your marking ships with a certificate you operate yourself, and the trust-listed one upgrades what a verifier displays from an unknown issuer to a recognised one. That distinction is the difference between shipping on time and waiting on a queue you do not control.

What we would do differently, in order

Ordered by how much time each one would have saved.

1. Start the administrative track before the engineering is finished

   It is the only part whose duration you cannot influence, and it gates the trusted certificate at the end of everything else.

2. Build the marking into the composition, not onto the output

   Stamping it on afterwards leaves a step that can be skipped, misconfigured or lost. Independent work on Article 50 argues that transparency has to be architectural to be met at all. ⁶

3. Assume no upstream mark covers anything you assemble yourself

   If you composed the file, treat it as unmarked until you have marked it.

4. Test against the verifier your audience will open the file with

   Not only against the specification. The two can disagree, and it is what gets displayed that discharges a disclosure duty.

None of this made our own outreach video worse. The visible label is not a tax on the format, and the provenance record is a thing a recipient can check, which is a better position to sell from than asking to be trusted. It is the bet our team made, and so far it has held.