A Guide to the EU AI Act

The EU AI Act is mandating sweeping requirements for all providers of AI-generated or AI-modified content, to label content with digitally-signed metadata (1.1.1) and imperceptible watermarking (1.1.2), starting on 2 August 2026. The penalty cap for non-compliance is the higher of EUR 15,000,000 or 3% of worldwide annual gross revenue. This is a guide for AI providers and deployers on how to navigate the new legislation.

#The EU AI Act

Over the past few years, governments around the world have introduced regulations on AI-generated and AI-modified content. On 13 June 2024, the EU passed the EU AI Act (Regulation 2024/1689), which in Article 50(2) requires providers of AI systems that generate synthetic audio, image, video, or text to ensure their outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated.” The technical solutions must be “effective, interoperable, robust and reliable.”

The associated penalty for non-compliance, per Article 99, is the higher of EUR 15,000,000 or 3% of worldwide annual gross revenue. For any company that uses AI in the content production workflow, this is a massive regulatory risk.

The official Code of Practice was published on 10 June 2026, and includes commitments for both providers and deployers of AIGC systems to adhere to. By signing the Code of Practice, providers and deployers can demonstrate compliance with Article 50 of the EU AI Act.

#Who

The Act assigns obligations to two roles:

For example:

• If company A operates an API service for AI-image generation and company B calls that API service to create marketing content, then company A is a provider and company B is a deployer.
• If company A runs an open-weight model designed for AI-image generation to create marketing content, then company A is both a provider and a deployer.

For the formal definitions, see Article 3: Definitions.

#When

The general deadline for Article 50 compliance is 2 August 2026. For providers operating existing AI systems, the Digital Omnibus Resolution grants a grace period through 2 December 2026. For providers operating new AI systems, the original deadline holds.

The use of imperceptible watermarks is not yet fully standardized. The general deadline for adherence to a standardized solution is 2 February 2027.

#What

As a provider, you are required to implement digitally-signed content OR imperceptible watermarks. In settings where the content is not confined to a controlled closed environment, BOTH are required insofar as it is technically feasible to do so (multi-layered machine-readable marking).

As a deployer, you are required to add a standard visible (or audible) disclosure, for human consumption. As a deployer, best efforts should be made to preserve any machine-readable markings added by providers. Exceptions are made in the case of (1) clearly artistic or fictional works and (2) law enforcement activities.

For the full text, see Article 50: Transparency Obligations.

#Recommendation

We recommend that anyone operating an AI model (as opposed to calling an API) that generates or manipulates digital media content add an “AI labeling” step at the end of the production workflow. This step may include, in the following recommended order, (1) applying an invisible watermark, (2) adding a visible disclosure, (3) attaching signed C2PA metadata.

In the case where there are multiple layers of deployers (e.g. one brand that uses several agencies), the visible disclosure requirement appears to apply to all deployers involved. This may result in nonuniformity in icon placement. For this reason, it is recommended that style guidelines are set.