EU AI Act Article 50: labelling AI-generated content, and the 2 December 2026 deadline

Under Article 50 of the EU AI Act, anyone who builds an AI system that makes images, video, audio or text must mark its output so a machine can tell it is AI-made. Anyone who publishes deepfakes, or AI text meant to inform the public, must say so. The rules apply from 2 August 2026. Systems already on the market before that date have until 2 December 2026 to add the marking. Fines reach €15 million or 3% of worldwide turnover.

The law sets the duty. The Commission's Code of Practice, published in June, sets out how to meet it. Both matter if you build or use generative AI and your users or audience include people in the EU.

First, which role are you?

The Act splits the work between 2 roles, and one company can hold both:

• Provider: you build the AI system or put it on the market under your name. A company that wraps a model in its own image generator is a provider of that generator.
• Deployer: you use an AI system in your work. A newsroom that publishes AI-written summaries is a deployer.

Pick your role and what you make, and see the duty and how to meet it:

Try itEU AI Act Article 50: what do you have to label?

Provider (I build it)Deployer (I publish it)

Content

·Images, video or audio·A deepfake of real people·Text in a file (PDF, doc)·Chat answers·Public-interest text·Grammar fixes only·A chatbot people talk to

Art. 50(2)Duty applies

1. Layer 1Signed metadataLost on a screenshot
2. Layer 2Imperceptible watermarkSurvives a screenshot, weakened by heavy edits
3. Layer 3Fingerprints or logs (optional)Never enough alone

2 layers because each fails differently: metadata vanishes on a screenshot, a watermark survives it.

What providers must do: mark the output

Article 50(2) says outputs must be "marked in a machine-readable format and detectable as artificially generated or manipulated". The duty covers audio, images, video and text. It does not apply when the system only assists standard editing, such as a grammar fix, or does not substantially change what the user put in.

The Code of Practice describes the marking it expects:

2 layers because each fails in a different way. Metadata vanishes when a picture is screenshotted; a watermark survives that but can be weakened by heavy editing. The Code also asks providers to give away a detection tool free of charge, with free access for authorities, media, fact-checkers and researchers, and to work toward a shared detection solution by 2 February 2027.

What deployers must do: tell people

Article 50(4) puts 2 duties on whoever publishes:

1. Deepfakes: an image, audio or video that resembles real people, places or events and could pass as real must be disclosed as AI-made. For an obviously artistic, satirical or fictional work, the disclosure can be light enough not to spoil it.
2. Text that informs the public on matters of public interest, such as AI-written news, must be disclosed, unless a person reviewed it and someone holds editorial responsibility for it.

The disclosure must come at the first moment someone sees or hears the content, and be clear and accessible. The Code suggests an optional EU icon built around the letters "AI", with "generated" or "modified" beside it. For deepfake audio it suggests a short spoken notice at the start.

Chatbots carry a separate duty under Article 50(1): tell people they are talking to an AI unless it is obvious.

The deadline that matters

The extra 4 months come from the Digital Omnibus, Regulation (EU) 2026/1744, which added the grace period for systems that were already selling.

What it costs to get wrong

Article 99 sets fines for breaking Article 50 at up to €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized companies and start-ups it is whichever is lower, a deliberate softening for smaller teams.

If you build on someone else's model

Most teams call a model through an API. Whether the model maker's watermark is enough depends on what reaches your user. If you pass images through untouched, the maker's marking may travel with them. If you resize, crop, recompress or combine outputs, check that the metadata and watermark survive your pipeline, and add your own if they do not. Treat it like any other GuardrailGuardrailChecks placed around a model that stop or change what goes in and what comes out, such as a filter on user messages or an approval step before an agent acts.: test it with real outputs, not with the documentation.

The Code is voluntary, so following it is not the only route to compliance. It is, however, the route regulators wrote down, which makes it the safest default until the guidance and court cases say more.