How to Label AI-Generated Content Under the EU AI Act (Article 50)

How to Label AI-Generated Content Under the EU AI Act

If your company publishes anything a machine wrote, drew, or voiced, Article 50 of the EU AI Act asks you for two separate things from 2 August 2026: a disclosure a human can see, and a mark a machine can read. Most teams have started thinking about the first. Almost nobody has a plan for the second. This guide is about building both, because the marking obligation is an engineering task, not a policy document you can write in an afternoon.

The Deadline That Did Not Move

There is a widespread and expensive misreading going around: that the AI Act was delayed. It was amended, not postponed. The Digital Omnibus on AI – Regulation (EU) 2026/1744 – was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, three days later, specifically so that the rules would be settled before the AI Act's general application date. It pushed the high-risk obligations back: stand-alone Annex III systems now apply from 2 December 2027, and systems embedded in products already covered by sectoral law from 2 August 2028.

It left Article 50 exactly where it was. And Article 50 is the part that touches ordinary companies – the ones running a support chatbot and a marketing team that drafts with generative tools. The high-risk regime was never going to apply to most of them. The transparency regime does, and it arrives on schedule.

The second common error is subtler and worth getting right, because it cuts the other way. Several write-ups describe a split where visible labelling starts in August 2026 and machine-readable marking follows in December. That is not the structure. Everything in Article 50 applies from 2 August 2026. The only concession is a narrow grace period: providers of generative AI systems that were already placed on the market before 2 August 2026 have until 2 December 2026 to meet the marking and detection obligation in Article 50(2), and nothing else. If you ship a new system after 2 August, the marking obligation applies to it immediately.

Step 1: Inventory Every AI Output You Ship

This is the step teams skip, and it is the one that actually takes the time. Before you can mark anything you need an honest list of every place your organisation emits machine-generated output into the world. In practice that list is longer than anyone expects:

• The customer-support chatbot, and any AI-assisted reply drafted inside your helpdesk
• Marketing copy drafted with generative tools and published to the site, ads, or social
• Generated or heavily retouched images in campaigns and product pages
• Product descriptions produced at scale from structured data
• AI voice agents on the phone line, and synthesised voiceover in video
• Automated reports, summaries, and newsletters that go to customers
• Anything a team member generated in a personal ChatGPT tab and pasted into a company channel

That last one is the reason this cannot be delegated to legal. Shadow usage does not appear in a procurement register, and it is where most unmarked synthetic content actually originates. The inventory has to be built from how work really happens, not from the list of tools finance is paying for. If you want a structured way to run that discovery across functions, our enterprise AI efficiency framework covers the three-channel approach we use, and the day-30 governance gate covers who signs off once the map exists.

Step 2: What "Machine-Readable" Actually Requires

Article 50(2) is short and specific. Providers of AI systems, including general-purpose systems, that generate synthetic audio, image, video or text content "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." The statute then adds an engineering standard: those technical solutions must be "effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art."

Two things follow from that wording. First, a visible "Made with AI" badge in the corner of an image does not satisfy Article 50(2). It is not machine-readable, and it disappears the moment someone crops the image. The visible disclosure and the machine-readable mark are different obligations serving different readers, and you need both.

Second, "robust" means the mark has to survive contact with the real world – re-sharing, format conversion, recompression, light editing. This is where most naive implementations fail. Embedded metadata is easy to write and trivially stripped: many social platforms remove it on upload as a matter of course. A mark that only exists in a metadata field is a mark that stops existing the first time the asset is posted anywhere interesting.

Step 3: Implementation by Content Type

The practical answer is layered marking – provenance metadata plus something durable embedded in the content itself – and the right layers differ per medium.

Images are the solved case. The C2PA standard – Content Credentials – attaches a signed manifest describing how an asset was produced, and the generation step is the natural place to write it. If your images come out of a hosted model API, check whether the provider already emits Content Credentials; several do, and inheriting their manifest is far cheaper than retrofitting your own signing infrastructure.

Text is the honest problem. There is no deployed, robust way to watermark short-form text such that the mark survives paraphrase, truncation, or a copy-paste into an email. This is exactly why the legislator wrote "as far as this is technically feasible" into Article 50(2). That phrase is not a loophole to hide behind, but it does mean the defensible position for text is to implement what your formats genuinely support, document the technical limits you hit, and record the reasoning. Documented, reasoned effort against the state of the art is the standard the article sets.

Step 4: Chatbot Disclosure

Article 50(1) is the cheapest item on this list and the one with the shortest path to done. Providers must ensure that systems intended to interact directly with people are built so that those people are informed they are dealing with an AI system – "unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect."

Do not lean on the "obvious" exception. It is a genuine carve-out, but it is judged from the user's perspective, and a support widget that opens with a friendly first name is not obviously a machine to a customer who is not thinking about it. Disclose at the first interaction, in the conversation itself rather than buried in a linked policy, and keep it legible when the widget is embedded on a partner site or resized on mobile.

The part teams forget is ownership. Decide now who approves that disclosure string, and where it lives in your release process, because it is a piece of user-facing copy that a well-meaning growth experiment can quietly A/B away. Bring it into the same review path as the rest of your compliance-relevant copy – the same discipline we describe in our guide to automating legal compliance workflows.

What the Code of Practice Actually Asks For

On 10 June 2026 the European Commission published the final Code of Practice on marking and labelling of AI-generated content. Adherence is voluntary, and the Commission has confirmed it as an adequate tool for demonstrating compliance with the transparency obligations. The obligations themselves remain legal requirements regardless of whether you sign up.

For most companies the practical value of the Code is not the signature. It is that it gives you a defensible reference point for the judgement calls Article 50(2) forces you to make – which techniques count as state of the art, what layered marking looks like in practice, where technical feasibility genuinely runs out. If you are going to have to document your reasoning anyway, documenting it against a Commission-endorsed benchmark is a materially stronger position than inventing your own.

Who Is Actually Liable: Provider vs Deployer

The obligations split, and companies routinely assume they are only ever the deployer. If you fine-tune, wrap, or rebrand a model into something you put in front of users, you may be wearing both hats.

Two carve-outs are worth knowing. Where deepfake content forms part of an evidently artistic, creative, satirical or fictional work, the obligation narrows to disclosing the existence of generated content in an appropriate manner – it does not force a disclaimer across the artwork. And the text-disclosure duty in Article 50(4) is scoped to text "published with the purpose of informing the public on matters of public interest," which is narrower than all marketing copy, though the marking duty on the provider side is not.

Article 99(4)(g) sets the exposure for getting this wrong: up to €15,000,000 or, for an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. The obligations also reach beyond the EU – a provider established elsewhere is caught where its systems or their output are used in the Union.

Your Next 30 Days

Frequently Asked Questions

Does the AI Act delay mean I can ignore the August 2026 deadline?

No. The Digital Omnibus on AI, Regulation (EU) 2026/1744, deferred the high-risk obligations to December 2027 and August 2028. It did not change Article 50. The transparency obligations – chatbot disclosure, marking of synthetic content, deepfake disclosure – still apply from 2 August 2026.

Is a visible "AI-generated" label enough to comply?

Not on its own where Article 50(2) applies. That provision requires outputs to be marked in a machine-readable format and detectable as artificially generated. A visible badge serves human readers; a machine-readable mark serves detection systems. They are separate requirements and you generally need both.

Do we have to go back and label content we generated last year?

No. Content generated before 2 August 2026 does not need to be labelled retroactively, though the Commission encourages it where possible.

What if we bought our AI system before the deadline?

There is a narrow grace period. Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking and detection obligation in Article 50(2). It applies only to that obligation, and only to systems already on the market.

How do you machine-readably mark AI-generated text?

Honestly, you often cannot to a robust standard. There is no widely deployed technique that survives paraphrase, truncation, or copy-paste. Article 50(2) is qualified by "as far as this is technically feasible", so the defensible approach is to implement marking where your formats support it, and to document the technical limits you assessed and why.

Does this apply to a company based outside the EU?

Yes, where the system or its output is used in the Union. Establishment outside the EU does not remove the obligation if you are serving EU users.

This article is informational and does not constitute legal advice. Confirm your specific obligations with qualified counsel.

Sources & References