On this page · 12 sections
- What Article 50 actually says
- The scope test: are you a provider or a deployer?
- The carve-outs that decide whether you are in scope at all
- What "machine-readable" means when you have to build it
- Sign the Code of Practice, or prove your own adequacy
- The two dates that matter
- The 9-step checklist
- India-specific considerations
- What to do in the next 13 days
- FAQ
- How eCorpIT can help
- References
Summary. Article 50 of the EU AI Act starts applying on 2 August 2026, 13 days from this article's publication date of 20 July 2026. It requires providers of generative AI systems to mark synthetic audio, image, video and text in a machine-readable format, and requires deployers to label deepfakes and certain AI-generated text. Breaching it carries administrative fines of up to EUR 15 000 000 or 3 % of total worldwide annual turnover for the preceding financial year, whichever is higher, under Article 99(4)(g) of Regulation (EU) 2024/1689. One date is missing from most coverage: AI systems placed on the market before 2 August 2026 get a transitional period until 2 December 2026. The European Commission published a voluntary Code of Practice on 10 June 2026, drawn up by 6 independent experts with over 187 participants, and the Commission and the AI Board have confirmed it as an adequate tool for demonstrating compliance.
Most of what has been written about this deadline is a restatement of the legal text. This article is the engineering version: how to decide whether you are in scope at all, what "machine-readable" means when you have to ship it, and the nine things to put in a sprint.
What Article 50 actually says
Article 50 sits in Chapter IV of the AI Act and contains four separate duties. They attach to different parties, and teams routinely assume they have one when they have another.
Paragraph 1 applies to providers. AI systems intended to interact directly with natural persons must be designed so those people are informed they are interacting with an AI system, "unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use". A chatbot on a support page is the obvious case.
Paragraph 2 also applies to providers, and this is the machine-readable one. In the words of the Regulation:
"Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated."
The same paragraph sets the standard those technical solutions have to meet: "effective, interoperable, reliable and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards."
Paragraph 3 applies to deployers of emotion recognition and biometric categorisation systems, who must inform the people exposed to them and process personal data in line with Regulation (EU) 2016/679, Regulation (EU) 2018/1725 and Directive (EU) 2016/680 as applicable.
Paragraph 4 applies to deployers and covers deepfakes and public-interest text. Paragraph 5 is the one that quietly creates frontend work: the information in paragraphs 1 to 4 must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and it "shall conform to the applicable accessibility requirements".
That last clause means your AI disclosure has to be accessible. If your labelling is a low-contrast icon with no accessible name, you have built a compliance artefact that fails a different EU regime. Teams already working through the European Accessibility Act and WCAG 2.2 audit path for Indian SaaS should treat Article 50(5) as the same workstream, not a new one.
The scope test: are you a provider or a deployer?
Under the AI Act these are different roles with different duties, and a single company is frequently both. If you build and place a generative AI system on the EU market under your own name, you are a provider and paragraph 2 lands on you. If you use somebody else's generative system in your own product or workflow, you are a deployer and paragraph 4 lands on you.
A worked example. An Indian product company ships a marketing tool that calls a third-party image model and publishes the results to a client's social accounts. For the image generation itself the model provider carries the paragraph 2 marking duty. But the moment your customer publishes an image that resembles a real person and would falsely appear authentic, your customer is a deployer under paragraph 4 and owes a disclosure. Your product decides whether that disclosure is possible. Build the label surface or your customers cannot comply through your tool.
| Role and duty | Which paragraph | What you have to ship |
|---|---|---|
| Provider of an interactive AI system | Article 50(1) | A disclosure that the user is dealing with an AI system, unless it is obvious in context |
| Provider of a generative AI system | Article 50(2) | Machine-readable marking on audio, image, video and text output, plus detectability |
| Deployer of emotion recognition or biometric categorisation | Article 50(3) | Notice to exposed persons, plus a lawful basis under the GDPR and related instruments |
| Deployer publishing a deepfake | Article 50(4) | Disclosure that the image, audio or video was artificially generated or manipulated |
| Deployer publishing AI text on matters of public interest | Article 50(4) | Disclosure, unless human review and editorial responsibility apply |
| Any of the above | Article 50(5) | Clear, distinguishable notice at first interaction, meeting accessibility requirements |
The carve-outs that decide whether you are in scope at all
This is where most engineering time gets saved or wasted. Article 50(2) does not apply "to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof". It also does not apply where a system is authorised by law to detect, prevent, investigate or prosecute criminal offences.
Read that carefully, because it draws a line straight through a typical product backlog. An autocomplete that finishes a sentence the user was already writing, a grammar fix, a crop, a denoise pass: these are assistive functions for standard editing and they do not substantially alter the semantics of the input. A feature that takes a three-word prompt and returns a finished 800-word article does substantially alter the input. The test is not "did a model touch this". The test is whether the system substantially altered the input data or its meaning.
Article 50(4) carries two more carve-outs worth knowing. Where deepfake content forms part of an "evidently artistic, creative, satirical, fictional or analogous work or programme", the duty narrows to disclosing the existence of generated content "in an appropriate manner that does not hamper the display or enjoyment of the work". And for AI-generated text published to inform the public on matters of public interest, the obligation falls away "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content".
That editorial-responsibility carve-out is the single most useful sentence in Article 50 for any content operation. It is also not a loophole you can assert after the fact. If you intend to rely on it, the review has to be real and somebody has to own it on the record.
What "machine-readable" means when you have to build it
The Act does not name a technology. The recitals accompanying Article 50 list techniques that can be used or combined: watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints and other techniques as may be appropriate.
The drafting record shows where the expert consensus landed. Working Group 1, which drafted the provider section, met on 14 January 2026 and examined "state-of-the-art marking techniques, including watermarking and metadata-based solutions, detection capabilities and their technical limitations, interoperability and standardisation challenges, as well as robustness, resilience against removal and governance aspects". A joint Working Group 1 and 2 workshop on 22 January 2026 considered "the complementary roles of watermarking, metadata, labelling and provenance systems". Complementary is the operative word: the groups did not pick a winner, and neither should you.
One more artefact from that record is worth knowing before you write your scope memo. The Working Group 2 workshop on 22 January 2026 examined a "proposed taxonomy distinguishing 'AI-generated' from 'AI-assisted' content". That distinction is the same line Article 50(2) draws with its assistive-editing carve-out, and it is the vocabulary your documentation should use.
Two families of technique do most of the work, and they fail in opposite ways.
| Technique | What it survives | What kills it |
|---|---|---|
| Embedded provenance metadata | Format conversions that preserve the container; verification gives rich detail about the tool and edit chain | Screenshots, re-encoding that drops the container, deliberate stripping, most social platform pipelines |
| Invisible watermarking in the signal | Screenshots, re-encoding and many crops, because the mark is part of the pixels or samples | Heavy compression, aggressive cropping, adversarial removal; carries far less detail than metadata |
| Perceptual fingerprinting | Nothing is embedded, so nothing can be stripped from the file | Requires a queryable reference database and gives no answer for content you never indexed |
| Server-side generation logs | Fully under your control, cheap, and useful as evidence | Not detectable by any third party looking at the file, so it cannot satisfy paragraph 2 alone |
| Visible labels and disclaimers | Human-readable at the point of exposure, which is what paragraph 4 wants | Not machine-readable, and trivially cropped out |
The practical conclusion is that no single layer is sufficient. Metadata carries the detail and dies on a screenshot. Watermarking survives the screenshot and carries almost no detail. That is why the Code of Practice lands on a layered model, and it is why "we added a metadata field" is not a compliance position on its own.
For metadata, the widely used specification is C2PA Content Credentials. The C2PA has published successive versions of its technical specification, including 2.2 dated 1 May 2025 and 2.4 on its specification site. It references JUMBF (ISO 19566-5:2023) for how Content Credentials are structured and referenced inside assets. The C2PA also runs a Conformance Program that places conforming generator products, validator products and certification authorities on a publicly accessible list. If you are procuring a marking library rather than writing one, that list is the first place to look, because interoperability is an explicit statutory requirement and not a nice-to-have.
Teams that have already looked at consumer-side signals in Apple's stack will find the layered pattern familiar from our guide to SynthID watermarking and AI content authenticity on iOS 27.
Sign the Code of Practice, or prove your own adequacy
The Commission published the final Code of Practice on transparency of AI-generated content on 10 June 2026, at a closing plenary. It has two sections: Section 1 covers provider obligations under Article 50(2), Section 2 covers deployer obligations under Article 50(4), and Annex I supplies an optional EU icon in three variants that deployers can use to label content consistently.
Adherence is voluntary. The underlying obligations are not. That distinction decides your compliance route.
| Route | What you commit to | What you carry |
|---|---|---|
| Sign the Code | Complete the Signatory Form and send it to the AI Office, signed by someone with authority to bind the organisation, such as a senior executive | An EU-wide recognised framework, reduced administrative burden, and a place in the Signatory Taskforces |
| Comply by other means | Nothing to the AI Office; you design your own measures | You must demonstrate those measures are adequate, assessed individually by different national market surveillance authorities |
| Do neither | No marking, no labelling | Exposure under Article 99(4)(g): up to EUR 15 000 000 or 3 % of worldwide annual turnover, whichever is higher |
The Commission's own framing of the second route is the part worth pausing on. Non-signatories "will have to demonstrate that those measures are adequate", and that assessment happens "individually by different market surveillance authorities". For a company selling across several member states, that is not one conversation. It is one per authority that takes an interest.
As of the Commission's 9 July 2026 update to its policy page, the Commission and the AI Board have confirmed the Code as an adequate voluntary tool for demonstrating compliance. Separately, the Commission has said its guidelines on the interpretation and scope of Article 50 will be published ahead of 2 August 2026. A public consultation on the draft guidelines, published 8 May 2026, has already closed. Those guidelines will clarify which providers, deployers and systems fall in scope, which concepts and exemptions apply, how the obligations work in practice, and how compliance may be demonstrated. If your scope analysis is finely balanced, they are worth waiting for. If it is not, they will not save you.
The two dates that matter
The headline date is 2 August 2026. The second date is the one that decides whether your existing product is on fire.
From 2 August 2026, providers and deployers of AI systems within the scope of Article 50(2) and (4) must comply. There is an exception for AI systems placed on the market before that date: those systems benefit from a transitional period for compliance until 2 December 2026.
That is four extra months, and it applies to the system, not the company. A generative feature you shipped in March 2026 has until 2 December 2026. A generative feature you ship in September 2026 does not; it has to be compliant on arrival. Teams planning a Q4 launch should note that the transitional period gives them nothing at all.
For context on how this fits the wider timetable, our earlier piece on the EU AI Act changes landing in August 2026 for enterprises covers the obligations arriving alongside Article 50.
The 9-step checklist
Nine items, in the order a team should actually do them.
1. Inventory every generative surface. Not every model call. Every place where output reaches a person. Include the ones product does not think of as AI features: autocomplete, summarisation, image cleanup, translated support macros, generated alt text.
2. Classify each surface as provider or deployer. Two columns. A surface can be both if you generate and publish.
3. Run the substantial-alteration test and write down the answer. For each provider-side surface, decide whether the system performs an assistive function for standard editing, or fails to substantially alter the deployer's input data or its semantics. This is the step that removes work from the backlog, so document the reasoning rather than the conclusion.
def in_scope_for_marking(surface):
"""Article 50(2) triage. Record the reasoning, not just the verdict."""
if surface.law_enforcement_authorised:
return False, "Art 50(2) law enforcement carve-out"
if surface.assistive_standard_editing:
return False, "assistive function for standard editing"
if not surface.substantially_alters_input_or_semantics:
return False, "no substantial alteration of input data or semantics"
return True, "machine-readable marking required"
4. Pick your layers per modality. Images and video get metadata plus an invisible watermark. Audio gets a watermark, because audio metadata rarely survives redistribution. Text is the hard one; the state of the art for reliable text marking is weaker than for other modalities, and the statute explicitly allows for "the specificities and limitations of various types of content". Say so in your documentation instead of pretending otherwise.
5. Buy the marking layer rather than building it. Interoperability is a statutory requirement. Check the C2PA Conformance Program list before you write a line of signing code.
6. Build a provenance record on the server side. This does not satisfy paragraph 2 by itself, because a third party cannot read it from the file. It is what you will produce if a market surveillance authority asks what happened.
{
"generation_id": "gen_01J8Z2Q7",
"surface": "campaign-image-composer",
"role": "provider",
"model_family": "text-to-image",
"substantial_alteration": true,
"marking": {
"metadata_manifest": "attached",
"signal_watermark": "applied",
"modality": "image"
},
"created_at": "2026-07-20T09:14:22Z"
}
7. Build the deployer label surface. Deepfake and public-interest-text disclosure is your customer's duty, but only your product can make it possible. Ship the label. The EU icon set in Annex I of the Code gives you three variants, so you do not have to design your own.
8. Make the disclosure accessible. Article 50(5) requires the information to conform to applicable accessibility requirements, and to appear at the latest at first interaction or exposure. That means an accessible name, sufficient contrast, and keyboard reachability. A tooltip on hover is not a disclosure.
9. Decide the Code question and put a name on it. Signing needs a person with authority to bind the organisation. That is a board-level calendar item, not an engineering ticket, and it takes longer than the engineering.
India-specific considerations
Indian product and services companies are exposed here through their customers, not their geography. The AI Act reaches systems placed on the EU market regardless of where the team sits, so a Gurugram or Bengaluru engineering group shipping a generative feature into a European customer's product inherits the provider-side analysis in practice even when the contract names the customer as provider. Settle that allocation in writing before 2 August 2026, because Article 25 of the Act governs responsibilities along the value chain and a silent contract is not a defence.
There is one piece of genuinely good news for smaller companies. Article 99(6) provides that in the case of SMEs, including start-ups, each fine is capped at the lower of the percentage or the fixed amount, rather than the higher. For a company with modest turnover, that inverts the calculation: the ceiling becomes 3 % of turnover rather than EUR 15 000 000. It reduces the worst case; it does not remove the obligation.
Indian teams should also avoid treating this as a European clone of domestic privacy work. The Digital Personal Data Protection Act 2023 governs personal data, and Article 50 governs disclosure of synthetic content. They overlap only at Article 50(3), where emotion recognition and biometric categorisation deployers must both notify people and hold a lawful basis. Teams building that stack should read Article 50(3) alongside our DPDP Act engineering playbook for Indian startups, and cost the two workstreams separately rather than merging them, as our breakdown of DPDP compliance cost against the 2027 deadline sets out.
The real cost here is usually the inventory, not the marking. Attaching a manifest is a library call. Finding all 40 places where your product generates something is three weeks of archaeology.
What to do in the next 13 days
If you have not started, the honest sequence is: inventory, classify, and write down your substantial-alteration reasoning. Those three steps are worth more than a rushed watermarking integration, because they tell you how much of the remaining work you actually owe, and because they are the artefacts an authority will ask for. Then check whether each in-scope system was placed on the market before 2 August 2026 and therefore has until 2 December 2026. Most teams discover the deadline they are working to is the December one, which turns a panic into a plan.
FAQ
How eCorpIT can help
eCorpIT is a Gurugram-based technology consultancy, founded in 2021, with senior engineering teams building generative AI features for product companies in India, Europe and the United States. We design applications aligned with EU AI Act Article 50 requirements: generative surface inventories, provider and deployer classification, substantial-alteration analysis you can show an authority, layered marking with conformant libraries, and accessible disclosure components that satisfy Article 50(5). If you are working towards 2 August or 2 December 2026 and want the scope question settled quickly, talk to our team.
References
- Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems — full text of Article 50, Regulation (EU) 2024/1689, with entry into force of 2 August 2026.
- Article 99: Penalties — administrative fines, including Article 99(4)(g) and the SME provision at Article 99(6).
- Code of Practice on Transparency of AI-Generated Content, European Commission policy page — sections, signatory routes, drafting timeline; last updated 9 July 2026.
- Questions and answers on the Code of Practice on Transparency of AI-Generated Content — voluntary status, transitional period to 2 December 2026, forthcoming guidelines.
- Commission publishes Code of Practice on marking and labelling AI-generated content — press release, 10 June 2026.
- Meet the chairs leading the development of the new Code of Practice — working group structure and the independent chairs who drafted the Code.
- EU icons for labelling AI-generated content — the optional icon set supplied in Annex I of the Code.
- Regulatory framework for AI, European Commission — the AI Act's overall structure and application dates.
- Content Credentials: C2PA Technical Specification 2.4 — the provenance metadata specification and its use of JUMBF (ISO 19566-5:2023).
- C2PA Conformance Program — the publicly accessible list of conforming generator products, validator products and certification authorities.
- C2PA Technical Specification 2.2, 1 May 2025 — earlier ratified version referenced for version history.
- Guide to Article 50 transparency rules — analysis of the scope of Article 50 beyond high-risk classification, including the marking techniques listed in the recitals.
- Working Groups advance discussions on transparency obligations under Article 50 of the AI Act — AI Office record of the January 2026 working group meetings and workshops, including the AI-generated and AI-assisted taxonomy.
- Article 25: Responsibilities Along the AI Value Chain — allocation of provider and deployer duties across the AI value chain.
Last updated 20 July 2026.
