The EU AI Act, Article 50

Over the past few years, governments around the world have introduced regulations on AI-generated and AI-modified content. On 13 June 2024, the EU signed the EU AI Act (Regulation 2024/1689) into law, which in Article 50(2) requires providers of AI systems that generate synthetic audio, image, video, or text to ensure their outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated." The technical solutions must be "effective, interoperable, robust and reliable."

The penalty for non-compliance, per Article 99, is up to the higher of €15,000,000 or 3% of worldwide annual turnover (the lower of the two for SMEs and start-ups). For any company that uses AI in the content production workflow, this is a massive regulatory risk.

All AI providers must comply: every company that offers a generative AI system in the EU under its own name, including products built on a third-party model or API, wherever the company is based.

The official Code of Practice was published on 10 June 2026, and includes commitments for both providers and deployers of generative AI systems to adhere to, primarily comprising interoperable implementations of digitally-signed metadata (1.1.1) and imperceptible watermarking (1.1.2).

By signing the Code of Practice, providers and deployers can demonstrate compliance with Article 50 of the EU AI Act. Trufo is a signatory of the Code of Practice (Section 1: marking and detection).

For the vast majority of companies, signing the Code of Practice is the most sensible course of action. While it is possible for an AI provider to opt for a different (often proprietary) approach, doing so will require direct engagement with the EU AI Office or national regulators and is not a realistic option for companies whose name is not a five-letter fruit.

There are a series of deadlines that AI providers are subject to, depending on their situation:

1. 2 August 2026

   Providers operating a new system.

2. 2 December 2026

   Providers operating a system already on the EU market (before 2 August 2026).

3. 2 February 2027

   Signatories of the Code of Practice must have interoperable watermark detection (Measure 3.4).

The 2 December date is set by the Digital Omnibus (Regulation (EU) 2026/1744) and confirmed in the Commission's Article 50 FAQ.

The EU AI Office is (for the time being) focused on establishing best practices in interoperability by the 2 February 2027 deadline, so substantial enforcement is not expected before then. Based on GDPR fines, it is likely that the first fines will come in Spring 2027, followed by the first large fine (over €15,000,000) by end-of-year.

Importantly, because published media content can be dated, any lack of compliance now can be used as evidence once enforcement begins.

The key criterion is interoperability. Without this criterion, you can ask Claude to download a few open-source libraries (e.g. c2pa-rs or pixelseal) and add in some metadata and a watermark. However, this would not be interoperable, since the metadata would be untrusted and the watermark would not be understood.

Signed Metadata (1.1.1)

For the digitally-signed metadata, there are two routes:

Imperceptible Watermarks (1.1.2)

For the imperceptible watermark, there are three primary security models:

Providers must also make their marks detectable: the Code requires a detection solution for each marking technique, offered as a public specification, software, or an API (Sub-measure 2.1.1).

The vast majority of AI providers will need at least one third-party vendor. Here is a list of the major providers:

For AI deployers, i.e. anyone who uses the services of an AI provider to create AI-generated or AI-modified content, the requirement is that a human-readable transparency disclosure is added.

The optional EU icons, from the European Commission.

There are a few notable exceptions to this requirement, namely for content that is clearly fictional or creative in nature, for purely personal non-professional use, or (for text) has undergone human editorial review.

Similar regulations are being phased into action around the world:

• California AI Transparency Act: SB 942 (as amended), in effect since 2 August 2026, requires every public generative AI provider to embed a latent disclosure and offer a free verification tool; $5,000 per violation per day.
• China: the Labeling Measures and standard GB 45438-2025, in effect since 1 September 2025, require visible labels plus a metadata label, which platforms must check.
• South Korea: the AI Basic Act, in effect since 22 January 2026, requires generative AI outputs to be marked, visibly or machine-readably; correction orders come first, then fines up to KRW 30M.
• India: the IT Rules amendment, in effect since 20 February 2026, requires visible labels plus permanent metadata on synthetic audio and visual content; non-compliant platforms lose safe-harbour protection.

If you are ready to build, head over to the Trufo Dashboard to get started. If you are still figuring out what is best for your use case, schedule a free consultation with Trufo to chat with an expert in the space.

Official EU sources for Article 50(2), plus a webinar from Trufo:

• EU AI Act (Regulation (EU) 2024/1689): the full text in the Official Journal.
• Article 2: Scope: who the Act applies to, including providers outside the EU.
• Article 3: Definitions: "provider", "deployer", "placing on the market".
• Article 50: Transparency obligations: the marking duty in paragraph 2.
• Article 85: Complaints: anyone may complain to a market surveillance authority.
• Article 99: Penalties: fines of up to €15,000,000 or 3% of worldwide annual turnover.
• Recital 133: why providers must mark and make outputs detectable.
• Recital 135: codes of practice for detection and labelling.
• Recital 136: how marking supports platforms' duties under the Digital Services Act.
• Digital Omnibus (Regulation (EU) 2026/1744): the 2 December 2026 transition (Article 111(4)).
• Code of Practice on Transparency of AI-Generated Content: the full Code.
• How to sign the Code: the signatory form and where to send it.
• Code signatories: who has signed so far.
• Assessment of the Code: the Commission and AI Board find the Code adequate.
• Guidelines on Article 50: the Commission's interpretation of the transparency duties.
• Article 50 FAQ: the Commission's answers, including the transition.
• Market surveillance authorities: each member state's contact point.
• CEPIC webinar on the EU AI Act: Trufo's CEO and CLO walk through the Act and C2PA.