EU AI Act Article 50: what generative AI providers must do

Who Article 50 applies to, what machine-readable marking it requires, the 2 August and 2 December 2026 deadlines, and the fines — in plain language.

8 min read · Updated 27 October 2026 · Markproof

What Article 50 is

Article 50 is the transparency article of the EU AI Act (Regulation (EU) 2024/1689). It doesn't ban anything. It makes sure people can tell when they're dealing with AI. It has four main duties, split between the companies that build AI systems (providers) and the companies that use them (deployers):

This guide focuses on 50(2), the marking duty, because it's the one that needs engineering work inside your product.

Are you a provider?

Under the AI Act, a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Article 50(2) explicitly includes general-purpose AI systems.

In practice, that means a company offering an image or voice generation product under its own brand is likely a provider, even if the underlying model comes from someone else. If you only use another company's AI tool internally, you're more likely a deployer, with the lighter 50(4) duties. Where you sit can depend on the details, so confirm it with counsel.

What “machine-readable” marking requires

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.

The same paragraph sets the quality bar: your technical solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the type of content, the cost of implementation and the generally acknowledged state of the art.

Read together, that rules out a few common shortcuts:

• A visible caption or label alone isn't machine-readable. Software can't reliably read it, and it's trivially cropped.
• A proprietary mark only you can read isn't interoperable. Others need to be able to detect it.
• Metadata alone isn't robust. Many platforms strip it on upload.

That's why the main approaches combine an open provenance standard, C2PA Content Credentials, with an invisible watermark in the content itself. See Watermark vs C2PA for why each one covers the other's weakness.

Exceptions

The marking duty doesn't apply where the AI system:

• performs an assistive function for standard editing, or
• does not substantially alter the input data provided by the deployer, or its meaning, or
• is authorised by law to detect, prevent, investigate or prosecute criminal offences.

A tool that fixes red-eye is assistive editing. A tool that generates a new image from a prompt is not.

The deadlines

The grace period comes from the “Digital Omnibus on AI” (Regulation (EU) 2026/1744), in force since 27 July 2026. The Omnibus postponed several high-risk AI rules, but it didn't change Article 50's start date. It only added the short transition for systems that were already on sale.

The Code of Practice

On 10 June 2026 the European Commission published its final Code of Practice on marking and labelling AI-generated content. It's voluntary, but it's the clearest statement yet of what regulators will treat as good practice. Signatories commit to measures including:

• At least two layers of machine-readable marking where necessary, combining approaches such as metadata and watermarks. The Code accepts that no single technique meets all of the Act's requirements.
• Detection mechanisms that let deployers, users and competent authorities check whether content is AI-generated, and reportedly researchers, civil society and the media too.

Companies that don't sign can still comply, but they may need to show regulators how their own measures meet the same bar.

Penalties

Breaching the Article 50 transparency obligations can lead to administrative fines of up to €15,000,000 or 3% of total worldwide annual turnover for the preceding year, whichever is higher (Article 99(4)). For SMEs, including start-ups, the cap is whichever of the two is lower (Article 99(6)).

What to do now

• Confirm your role for each AI feature: provider, deployer, or both.
• List every output type your product generates: images, audio, video, text.
• Mark outputs with two layers, a C2PA manifest plus an invisible watermark, at the point of generation, before files reach users.
• Offer a way to detect the marks, such as a verification API or a public checker.
• Keep records of how and when you mark, so you can show your approach to a regulator.

Our Article 50 checklist breaks this into twelve concrete steps.

This guide is general information, not legal advice. Laws and guidance change; check the sources, and talk to a qualified lawyer about your situation.