EU AI Act Article 50(2): How to Mark AI-Generated Content with C2PA Before the Deadline
Article 50(2) of the EU AI Act requires providers of generative AI systems to mark synthetic audio, image, video and text so software can detect it. It has applied since 2 August 2026, and systems already on the market before then have until 2 December 2026. We read the Act, the Commission's guidelines, the code of practice and the C2PA specification, and set out what an enterprise should ask, contract for and file.
S
Sofia Reyes
Head of Compliance
Nov 1, 2026
Article 50(2) of the EU AI Act requires providers of generative AI systems to mark synthetic audio, image, video and text so software can detect it. It has applied since 2 August 2026; systems on the market before then have until 2 December 2026. The code of practice expects signed metadata, such as C2PA, plus an imperceptible watermark.
Most enterprises are not the provider. They still have work to do this month.
If you buy generation from a vendor, the marking duty is the vendor's, but the questions, contract terms and evidence are yours. If you built a generator in-house and use it under your own name, the duty may be yours outright. By our arithmetic, 2 December 2026 is 31 days from the date of this post.
Last verified: 1 November 2026, against the AI Act text on the Commission's AI Act Service Desk (EUR-Lex did not return it to our fetcher), the Commission's Article 50 guidelines and Q&A, the final code of practice and the Commission's opinion on it, and the C2PA 2.3 specification and explainer. Nothing here rests on news coverage.
Figure 1. Only one group gets the December date: providers whose generative systems were on the market before 2 August 2026. Deployer labeling had no extension.
What does Article 50(2) actually require?
Article 50(2) binds providers of AI systems, general-purpose ones included, that generate synthetic audio, image, video or text. They must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". The solution has to be effective, interoperable and reliable, with robustness as the fourth named quality, "as far as this is technically feasible", weighing "the costs of implementation and the generally acknowledged state of the art".
Two words carry the weight: marked and detectable. The Commission's Article 50 guidelines treat them as distinct elements and say, in paragraph 70, that fulfilling only one will not suffice. A mark that nobody can check is not compliance.
The duty does not apply where a system performs "an assistive function for standard editing", does not substantially alter the input or its meaning, or is authorized by law to detect, prevent, investigate or prosecute criminal offenses. Paragraph 68 of the guidelines also puts short sequences such as single words, alt text and UI labels outside the scope, along with source code (SQL, YAML and JSON configuration included), purely machine-to-machine outputs, and intermediate outputs in closed production workflows. A coding assistant's output is not something 50(2) asks anyone to watermark.
Which date applies to your systems?
Article 50 follows the general date of application in Article 113: 2 August 2026. The Digital Omnibus, Regulation (EU) 2026/1744, then added a paragraph 4 to Article 111, under which generative systems "placed on the market before 2 August 2026" must comply with Article 50(2) "by 2 December 2026". Nothing else in Article 50 moved.
So the "2 December" framing is accurate for one group only. A generator launched on or after 2 August owed marking from its first day. The Commission's Article 50 questions and answers call it a limited grace period, for older systems and for marking and detection alone, and paragraph 154 of the guidelines says outputs generated before 2 August 2026 need no retroactive marking.
Flag one wording gap to counsel: the regulation says "placed on the market", while paragraph 153 of the guidelines says "placed on the market or put into service". An in-house generator only ever put into service internally sits in that gap.
Are you the provider or the deployer?
Article 3 defines a provider as one who develops an AI system, or has it developed, and places it on the market or puts it into service "under its own name or trademark". A deployer uses an AI system "under its authority". A company licensing a vendor's image generator for its marketing team is a deployer; the vendor owes 50(2).
The line moves when you build. Paragraph 11 of the guidelines treats an organization that develops a system in-house and puts it into service for its own use, under its own name, as a provider, and says the same of a company that modifies an existing generative system, for instance with new training data, and puts it into service under its own name. Paragraph 15 adds that one company can be provider and deployer of the same output at once. Paragraph 74 lets a provider rely on marking implemented by an upstream model provider or a third party, but the duty to show compliance stays with the provider of the system. A model API wired into a branded internal image tool deserves that reading with counsel.
Deployers owe something different. Article 50(4) requires them to disclose deep fakes and AI-generated text published to inform the public on matters of public interest, unless that text "has undergone a process of human review or editorial control" and someone "holds editorial responsibility for the publication of the content".
A provider's watermark does not discharge that duty. Paragraph 117 of the guidelines says deployers cannot rely on 50(2) marking, because those marks are not immediately clear to the people who see the content. A 50(4) label must be visible or audible.
What does the code of practice ask providers to do?
The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026. It answers Article 50(7), on codes for "the detection, marking and labelling of artificially generated or manipulated content". Section 1, for providers, covers 50(2); Section 2, for deployers, covers 50(4). In an opinion of 8 July 2026 the Commission found that the code adequately covers Articles 50(2), (4) and (5), and the AI Board adopted its own assessment on 9 July. Signing is voluntary, and the opinion says adherence is not conclusive evidence of compliance.
The technical core is Measure 1.1. While no single technique meets all four quality requirements, signatories "will implement a multi-layered marking approach" with at least two machine-readable layers for audio, images, video and containerized text (text inside a PDF, Word file or HTML page):
Digitally signed metadata (Sub-measure 1.1.1) recording that the content is AI-generated or manipulated, signed and time-stamped in a tamper-evident way.
An imperceptible watermark (Sub-measure 1.1.2), embedded so that it is hard to separate from the content.
Free-form text, such as a chat reply, cannot carry metadata, so a watermark alone is enough, and text under 200 tokens is "very short" and excepted. Fingerprinting and logging are optional, and never sufficient alone.
Under Measure 2.1, signatories offer a detection solution free of charge (with a narrow fee option for providers under 1,000,000 monthly users facing heavy request volumes), always free to regulators, researchers and media. Under Measure 3.4 they commit to an interoperability solution for watermark detection by 2 February 2027. The code also notes that, at publication, established interoperability standards existed only for digitally signed metadata. That is where C2PA comes in.
Figure 2. The code's two required layers fail in different ways, which is why it asks for both. Free-form text gets the watermark layer only.
What is C2PA, and how does a manifest work?
C2PA, the Coalition for Content Provenance and Authenticity, publishes an open technical standard for recording where content came from and how it was edited; its signed records are known as Content Credentials. The specification is at version 2.3, dated December 2025.
An assertion is a statement by the signer, for example that a generative model created the image. A claim is a signed, tamper-evident structure referencing a set of assertions, and the claim signature is made with the signer's private key. Together they form a manifest, which can be embedded in the file or kept outside it. A hard binding, a cryptographic hash of the asset, ties the manifest to that exact content and exposes later modification. A soft binding, such as a watermark or fingerprint, helps find the manifest again for derived copies. The C2PA explainer says AI-generated content is identified through a digitalSourceType field.
Read against the code, a C2PA manifest fits the signed-metadata layer. It is not both layers. The code names no standard, and paragraph 73 of the guidelines says providers need not keep a full provenance chain.
C2PA documents its own limits. Asked whether provenance metadata can be removed, the explainer answers: "Yes it can." Uploading to a service that strips metadata, re-saving in a tool that ignores the manifest, or taking a screenshot leaves the pixels without the record. C2PA's answer is the durable credential, pairing the hard binding with a soft binding so the manifest can be found again in cloud storage, and the code's answer is the mandatory watermark. And provenance alone, the explainer says, cannot tell you whether content is true, accurate or factual.
Which marking technique fits which content type?
The middle column draws on Measure 3.3, which lists the processing operations the combined marking and detection solution must be tested against.
Content type
What the code expects
What it must withstand, and where it breaks
What to ask your AI vendor
Image
Signed metadata (C2PA is one option) plus a watermark
Compression, cropping, rescaling, screenshots, print-and-scan. Metadata alone is lost when stripped
Which watermark and detector? Is detection free? Does the manifest declare AI generation?
Video
Signed metadata plus a watermark
Re-compression, format changes, cropping, screen recording. A re-encode that writes no new manifest leaves the old hash unmatched
Does the watermark survive our transcoding settings? Can we test samples before 2 December?
Audio
Signed metadata plus a watermark
Noise, pitch shifting, time stretching, playback and re-recording
Is voice output marked at generation or only at export?
Containerized text (PDF, Word, HTML)
Signed metadata plus a watermark
Copying text out of the file leaves the metadata behind
Which export formats carry metadata? Is the text watermarked too?
Free-form text (chat)
Watermark only; under 200 tokens excepted
Paraphrasing, translation cycles, homoglyphs. Detection may be limited to verified experts
What is the token threshold, and who can use the detector?
Source code
Outside Article 50(2)
Not applicable
Nothing under 50(2)
Measure 1.2 adds something buyers should know. Signatories will prohibit, in their acceptable use policy or terms, the intentional removal of or tampering with metadata markings. Your own CMS image optimizer may strip that metadata without anyone deciding to. Test before assuming the mark reaches the public.
What should an enterprise do before 2 December?
Inventory every AI generator in use. Image tools, voice services, chatbots drafting customer emails, and generators staff adopted unasked.
Name the provider for each one. Vendor-supplied and unmodified: the vendor. Built or fine-tuned in-house and used under your name: probably you. Write the reasoning down.
Ask each vendor in writing. Which date applies, which marking layers are live, which detector is offered, and whether it signed the code. Our AI vendor security questionnaire helps because it already scores vendors by domain, so these four questions slot in as one more.
Put it in the contract. A warranty that outputs are marked as Article 50(2) requires, notice if marking changes, and access to detection.
Test it yourself. Push sample outputs through your real publishing path and run the vendor's detector on what comes out.
File the evidence. Vendor answers, clauses, dated test results, and your 50(4) labeling rule.
Step six stalls when nobody owns it. Our CISO guide to AI security is useful here because its operating model assigns owners across security, legal and marketing, and its framework crosswalk gives these records a home.
Figure 3. The provider decision in step 2 changes every later step: a deployer collects vendor evidence, a provider builds the marking itself.
What can software do for Article 50(2), and what can't it?
AccuroAI does not mark, watermark, label or detect AI-generated content. It cannot satisfy 50(2) for a provider or 50(4) for a deployer, and no tool makes a company compliant with the AI Act.
It helps around the marking. Step one is a discovery problem: AccuroAI discovers 1,400+ AI tools on managed devices, with the signed-in account and plan, so the generators teams actually use are listed, not just approved ones. A generator that has not passed vendor review can be blocked by policy until it has. Audit evidence is mapped to 8 frameworks, the EU AI Act among them, which gives the step-six file a place to live. More on the workforce AI governance page.
To start that inventory, see it on your own devices: a 72-hour pilot maps the AI already in use before any policy is enforced, image and voice generators included. Start a free pilot.
FAQ
Is 2 December 2026 the Article 50 deadline?
Only for one duty and one group. Article 50 applies from 2 August 2026. Providers of generative systems placed on the market before that date have until 2 December 2026 for the Article 50(2) marking duty, under Article 111(4). Newer systems, and every deployer duty, got no extension.
Does C2PA alone satisfy Article 50(2)?
Not under the code of practice. A C2PA manifest fits the signed-metadata layer, but the code also expects an imperceptible watermark for images, audio, video and containerized text, because metadata can be stripped. The law names no technique; the code is the route the Commission assessed as adequate.
We only use vendor AI tools. Do we owe anything?
Not the 50(2) marking, which is the vendor's. You owe 50(4) visible disclosure for deep fakes and for AI-written public-interest text without editorial review, and the vendor's watermark does not count toward it. Ask vendors for written answers on marking anyway, and keep them on file.
Do AI-generated code and chatbot one-liners need marking?
Source code is outside Article 50(2) according to paragraph 68 of the Commission's guidelines, as are short sequences such as single words and UI labels. Under the code, free-form text under 200 tokens counts as very short and is excepted from watermarking.
How do we know whether a vendor signed the code?
The Commission's code of practice page links to a list of signatories and reported about 190 by the end of July 2026. Signing is voluntary, so ask directly too, and remember that the Commission says adherence is not conclusive evidence of compliance.
This is not legal advice; whether a system makes you a provider is a question for counsel. For the full split of Article 50 duties, see our Article 50 transparency checklist, and for the dates the Digital Omnibus moved, the Omnibus timeline.
Sources
AI Act, Article 50, consolidated as at 27 July 2026, Commission AI Act Service Desk
