Machine-Readable AI Marking: EU AI Act Article 50 Rules

Article 50(2) applies to providers of AI systems, including general-purpose AI models, that generate synthetic audio, image, video, or text. They must mark that output in a machine-readable format, detectable as artificially generated or manipulated, as far as technically feasible.

It took effect 2 August 2026 alongside the rest of Article 50's transparency rules. A transitional deadline of 2 December 2026 applies to certain marking obligations for systems already on the market before that date, and that grace period comes from the later Digital Omnibus reform rather than the AI Act's original text.

The phrase "as far as technically feasible" and a defined exemption list do real work here. Marking is not required for:

• Short sequences of numbers, symbols, or letters
• Source code
• Machine-to-machine outputs never exposed to a human
• Closed-loop industrial or product-development processes, except their final outputs
• Standard editing-assistive functions

Non-compliance has teeth. Companies face fines up to 15 million euros or 3 percent of global annual turnover, EU institutions up to 750,000 euros, enforced by national market-surveillance authorities, the AI Office, and the European Data Protection Supervisor.

This is a provider obligation about the output itself. A separate, deployer-facing set of duties covering deepfakes and public-interest text sits on the AI-generated content disclosure page.

Neither the Code of Practice on AI-generated content, whose final text was published 10 June 2026, nor the Commission's implementing Guidelines, adopted around 20 July 2026, name a marking technology anywhere. Both set the bar at marking that is "effective, interoperable, robust and reliable," as far as technically feasible.

So a provider could plausibly meet that standard with C2PA-style signed metadata, an embedded statistical watermark like SynthID, or some other mechanism entirely. What matters is whether it works in practice.

That neutrality is deliberate, not an oversight. Around 190 organizations, including Anthropic, Google, Meta, Microsoft, and OpenAI, had signed the Code by the end of July 2026, with the initial-signatory window closing 27 July 2026.

Cooley's commentary notes that signatories get "a degree of presumption of conformity" plus favorable enforcement treatment. Jones Day goes further on the engineering question, writing that "no single labelling or marking technique is sufficient in all cases" and recommending a multilayered approach mixing visible labels with invisible, machine-readable signals.

The Code backs that flexibility structurally. It explicitly permits lighter or adapted labelling for artistic, fictional, or satirical works, so one rigid mechanism does not get forced onto every kind of generated content.

A cluster of marketing and SEO sites assert that the Commission or the AI Office effectively endorsed C2PA as the primary technical pathway for Article 50 compliance. The specifics they cite:

• A required icon at a 24x24px minimum
• PMS 286C blue as the mandated color
• A 5mm minimum size in print
• An "EU AI Office Q1 2026 guidance" mandating C2PA plus SynthID as the compliance default
• A February 2027 interoperable-detection deadline

None of this is supported by the Code of Practice, the Guidelines, or any Commission source. It also directly contradicts their explicit technology-neutral language, which contains no icon specs of any kind.

Treat the icon sizes, the Pantone code, and the C2PA mandate as rumor until an independent primary source confirms them. Jones Day's actual advice to providers, notably, is to combine multiple signals rather than lean on any single one.

No confirmed enforcement action, fine, or corrective order under Article 50 had been publicly reported as of 11 August 2026.

Veeam field CTO Edwin Weijdema, writing days after the deadline, predicted corrective and suspension orders will "significantly outweigh" major fines in year one. He also flagged a genuinely open question: whether AI agents embedded in ticketing or procurement portals even count as systems that trigger these duties in the first place.

Member states are at visibly different stages of readiness:

• Germany's KI-Marktüberwachungsgesetz names the Bundesnetzagentur as default national market-surveillance authority and EU AI Office contact point, backed by an internal coordination unit
• France, per a January 2026 report, had not formally designated its competent authorities at all, after a draft list of 17 candidates including CNIL, DGCCRF, and ARCOM was withdrawn from the relevant bill
• CEN-CENELEC's Joint Technical Committee 21, reportedly more than 300 experts across 20-plus countries working in five groups, is said to be developing harmonized standards partly aimed at Article 50 marking, with no finished standard confirmed

France's status was last confirmed in January 2026, so recheck it rather than assume it still holds months on. The same caution applies to JTC21's output, which rests on secondary sources rather than a fetched primary status page.