Article 50's transparency rules are in force, and they apply to systems already on the market

What Article 50 asks for

Article 50 of the AI Act sets transparency rules for AI systems that talk to people or generate content ^[1]. Since 2 August 2026, providers must ensure that people are told when they are interacting with an AI, and that AI-generated audio, images, video and text are marked in a machine-readable way ^[2].

The marking is less a 'contains nuts' sticker and more a barcode. People barely notice it, but machines read it. The idea is that platforms, fact-checkers and rights holders can detect synthetic content at scale.

Users, not just providers, have duties too. When someone publishes AI-generated text to inform the public and no person has reviewed it and stands behind it, they must say so. When images, audio or video are deepfakes, users must disclose that when they share them, unless it's obviously art or satire ^[1].

Older systems are covered

The Digital Omnibus, adopted in July 2026, clarified that the marking duty under Article 50.2 also applies to generative AI systems placed on the market before 2 August 2026 ^[3]. Those systems have until 2 December 2026 to comply.

That means a chatbot released in early 2025, or an image generator from 2024, must mark its output from December this year. The wording is explicit: the date when the system was first made available doesn't exempt it ^[3].

For providers, this closes a gap. Without it, older systems could have kept generating unmarked content while new ones had to mark theirs.

How the Commission defines compliance

The AI Act doesn't spell out which technical marking methods count as machine-readable. The Commission filled that gap in May 2025 with guidelines on Article 50.2 ^[4].

The guidelines point to methods like C2PA content credentials, IPTC photo metadata and SynthID for images, and similar tools for audio and video. For text, they mention invisible watermarking and metadata standards that survive copy-paste. The methods vary by medium, but the principle is the same: the mark must be detectable by software, not just by eye.

In parallel, the Code of Practice on Article 50 sets out how providers can meet the rules in practice ^[5]. Compliance with the Code creates a presumption that the provider has met the obligation, though it's not the only way to comply.

Supervisors use the guidelines and the Code as their benchmark when they assess systems, which gives providers a clear target.

Marks can be stripped

Here is the problem the rules don't solve: markings can be lost. Compression strips metadata. Screenshots remove watermarks. A file sent through a messaging app or downloaded from a platform often comes out the other side without the mark that was there when it was generated.

The marking duty under Article 50 sits with the provider at the point of generation. What happens to the content after that is harder to control. Platforms can help by preserving marks, but not all do, and even those that try can't stop someone from screenshotting an image and sharing the screenshot.

That's where a record of what was generated becomes useful. The mark travels with the content; the record stays with the provider.

A record of what the AI generated

The thing to seal is a log of what was generated: the output fingerprint, the timestamp, the system version and, if relevant, the prompt or the user reference. The fingerprint is taken from the generated file itself, not from the marking.

Sealing happens at generation. Each time the system produces an image, a piece of text or a video, the provider's backend sends the fingerprint to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The generated content never leaves the provider's systems.

Later, if an unmarked file turns up and someone asks where it came from, the provider can check whether the fingerprint of that file matches one in the sealed log. If it does, the provider can show that the file was generated by their system at that time, even if the marking was stripped along the way.

Anyone the provider shares the log with, such as a platform, a rights holder or a supervisor, can check the fingerprint themselves. The witness doesn't rely on the provider's word. It shows that the record existed at that time and hasn't been edited since, even by someone with administrator rights.

How it would work

1. At generation, the system takes a fingerprint of the output and sends it to WitniumChain, which seals it and returns a witness ID.
2. The sealed record contains the fingerprint, the timestamp, the system version and any relevant metadata, stored by the provider.
3. When needed, anyone can calculate the fingerprint of a file again and check it against the sealed record.

The witness doesn't replace the marking duty in Article 50. It's a record of what was generated, not the marking itself. The two serve different purposes: the mark travels with the content, the record proves it came from you.

What this means for you

If you run a generative AI system, even one released before August 2026, check whether your marking method aligns with the Commission's guidelines and the Code of Practice. December is the deadline for older systems.

Ask your team:

• Do we mark output in a machine-readable way, and does the method survive common sharing routes?
• If a marked file is stripped of its metadata, can we still show it came from our system?
• Do we log what we generate, and is that log kept in a way that a supervisor or a platform could check?

The first question is about meeting Article 50. The second is about having your own evidence when the mark is lost. The third is about making that evidence hold up.

What to watch

The Commission's AI Office has said it will keep updating the guidelines as marking technologies develop ^[4]. Standards bodies, including C2PA and IPTC, are refining their methods for different media types.

National supervisors have started enforcement. The Swedish Authority for Privacy Protection (IMY) and similar bodies across the EU can issue fines up to €15 million or 3% of global annual turnover, whichever is higher ^[1]. For small and medium-sized enterprises, the lower of the two amounts applies.

Platforms are also building detection tools. Some now scan uploaded content for marks and flag synthetic media. Providers whose systems aren't marking correctly may find their content blocked or labelled by platforms before a supervisor acts.

The marking landscape is settling, but it isn't static. Checking your setup now, and keeping a sealed log of what you generate, is cheaper than explaining to a supervisor in six months why you didn't.