Key takeaways
- Article 50 sets four separate duties across two different roles — providers and deployers — and confusing the two is the most common mistake.
- The marking duty watermarking answers is 50(2): output must be in a machine-readable format and detectable as artificially generated, applying to providers from 2 December 2026.
- It does not require identity. Article 50 asks whether content is synthetic, not who made it — that's California SB 942's territory.
- The Code of Practice describes a layered approach: signed metadata, an imperceptible watermark, and fingerprinting, because no single layer survives every transformation.
What Article 50 requires
Article 50 of the EU AI Act sets transparency obligations for AI systems that generate or manipulate content and for the organisations that deploy them. The European Commission's Code of Practice and Guidelines describe how providers and deployers are expected to meet it in practice.
The four duties
Article 50 bundles four distinct obligations under one article number. Which ones apply to you depends on whether you build the system or use it.
50(1) — provider, general-purpose disclosure
Providers of AI systems intended to interact directly with natural persons must ensure the natural person is informed they are interacting with an AI system, unless it is obvious from the circumstances.
50(2) — provider, machine-readable marking
Providers of AI systems that generate synthetic audio, image, video or text content must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. This is the duty watermarking, fingerprinting and signed metadata answer.
50(3) — deployer, deepfakes
Deployers of an AI system that generates or manipulates image, audio or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated.
50(4) — deployer, public-interest text
Deployers of an AI system that generates or manipulates text published to inform the public on matters of public interest must disclose that the text has been artificially generated or manipulated.
Provider or deployer — which are you?
The duties do not overlap, and none of them is optional to figure out — the obligations attach to the role, not the company size.
| Provider | Deployer | |
|---|---|---|
| Who | Develops the system, or has it developed, and places it on the market under its own name or trademark | Uses an AI system under its own authority, other than for personal non-professional activity |
| Duties | 50(1) and 50(2) | 50(3) and 50(4) |
| In practice | A model or product that generates media. Marking happens at generation, in your pipeline | A business publishing or using generated media. Disclosure is something you show a person |
The Code of Practice, and what it expects
The Code of Practice describes a layered approach to 50(2), because no single technique survives every transformation content goes through after it leaves the generating system.
| What it carries | What happens on transformation | |
|---|---|---|
| Signed metadata | Provenance assertions attached to the file, typically a C2PA manifest | Removed when a file is re-encoded or re-uploaded without metadata preservation |
| Imperceptible watermark | A machine-readable signal embedded in the pixels, samples or tokens | Persistence depends on the technique and the transformation |
| Fingerprinting | A reference computed from the content, held in a registry | Nothing is embedded; requires a registry to resolve against |
This is why the Code pairs an imperceptible watermark with signed metadata rather than treating either as sufficient alone: metadata carries the richest provenance while it survives, and the watermark is what remains readable once it doesn't.
The dates that actually apply
- The AI Act enters into force. Source
- Code of Practice on marking and labelling AI-generated content published. Source
- General-purpose AI model provisions become applicable.
- Article 50 obligations become applicable for systems placed on the market before 2 August 2026.
- Deadline referenced in the Guidelines for demonstrating good-faith adoption of the Code of Practice. Source
Penalties sit in Article 99: administrative fines of up to EUR 15,000,000 or up to 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, the lower of the two figures applies.
Exemptions
- Content that has undergone assistive functions for standard editing, or that does not substantially alter the input data or its meaning, is carved out of the deployer disclosure duties.
- Use authorised by law to detect, prevent, investigate or prosecute criminal offences is exempt.
The Guidelines' real-time-content carve-out is narrower than it is commonly described: it does not cover a recorded voice-agent call, only content generated and consumed live with no persistence.
What Article 50 does not require
| Requires | Does not require |
|---|---|
| Marking of synthetic audio, image, video and text in a machine-readable format | Any specific marking technology — the text names none |
| That the output be detectable as artificially generated or manipulated | A visible label applied by the provider; visible disclosure is the deployer's duty under 50(4) |
| Solutions that are effective, interoperable, robust and reliable so far as technically feasible | Identification of the natural or legal person behind the system in the mark |
| Application by the provider of the generating system | Application by the deployer; the deployer holds 50(1) and 50(4) |
Article 50 does not require a watermark to resolve to a person or a company — only that the content be recognisable as synthetic. A provider-resolvable identity is what California SB 942 asks for; see the SB 942 page for that distinction.
How Verda meets 50(2)
| The duty | Tier | How Verda meets it |
|---|---|---|
| Output marked in a machine-readable format | Compliance | An imperceptible watermark embedded in the signal at generation, across image, audio and video |
| Detectable as artificially generated | Compliance | Free public verification, no account required, plus a documented decode API |
| Effective, interoperable, robust, reliable | Compliance | Signed C2PA manifests alongside the watermark, so the layers back each other up when metadata is stripped |
| Not required by Article 50 — required by California SB 942 | Provenance | The mark resolves to the provider, system, version and timestamp through a registry |
| Not required by any statute | Identity | Optionally the provider record is a KYC-verified organisation or creator — for fraud, brand and agent authorisation |
Verda is registered on the C2PA soft-binding algorithm list for image, audio and video.
Common questions
Does EU AI Act Article 50 require identity in the watermark?
No. Article 50(2) requires that output be marked in a machine-readable format and detectable as artificially generated. Identity is neither named nor implied. California SB 942 is the rule that requires a provider-resolvable payload.
My systems were already on the market. When do I have to mark?
2 December 2026. The 2 August 2026 date applies to systems placed on the market from that date onwards.
Is C2PA enough on its own for Article 50?
C2PA metadata is one of the layers the Code of Practice describes, and carries the richest provenance while it survives. It is routinely stripped by re-encoding and re-upload, which is why the Code pairs it with an imperceptible watermark rather than treating either as sufficient alone.
Does a visible 'AI generated' label satisfy Article 50(2)?
No. 50(2) is a machine-readable marking duty on the provider. A visible label is what a deployer may owe under 50(4), and the two are not interchangeable.
What are the penalties for breaching Article 50?
Under Article 99, administrative fines of up to EUR 15,000,000 or up to 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups the lower of the two applies.
Does this affect me?
Tell us about your product and we'll walk you through what Article 50 requires and how Verda's watermark and detection tool cover it.