From 2 August 2026, the EU AI Act’s transparency rules in Article 50require AI-generated content to be marked so it can be detected as artificial. If you build products that generate or publish synthetic media or text, this is the most concrete, time-boxed reason to put content provenance on your roadmap now. This guide explains what the rules ask for, who they cover, and what “machine-readable marking” means in practice.
This is general information, not legal advice, and not a statement that any product makes you compliant. Confirm specifics with qualified counsel for your situation, and read the official AI Act text directly.
What Article 50 requires
The transparency obligations fall into a few buckets:
- Mark AI outputs in a machine-readable format. Providers of generative AI systems that produce text, images, audio, or video must ensure outputs are marked and detectable as artificially generated or manipulated.
- Label deepfakes and certain AI text. Deepfakes, and AI-generated or manipulated text published to inform the public on matters of public interest, must be clearly disclosed to people who see them.
- Disclose AI interactions. People must be told when they are interacting with an AI system, such as a chatbot, unless it is obvious.
On 10 June 2026 the European AI Office published the final voluntary Code of Practice on the Transparency of AI-Generated Content (now undergoing adequacy assessment) to give providers practical, shared methods. Notably, it points to digitally-signed metadataas a recommended marking mechanism, alongside imperceptible watermarking and optional fingerprinting or logging. Following a positive adequacy assessment, signatories could rely on the Code’s measures to demonstrate compliance with the underlying obligation. The Code supports the obligation; it does not replace it.
Important exceptions
The rules are narrower than “label everything AI touched.” Article 50 carves out:
- Assistive or non-substantial edits. The provider marking duty does not apply where the AI performs a standard-editing or assistive function and does not substantially alter the input data or its semantics.
- Human-reviewed public-interest text. The disclosure duty for AI-generated public-interest text is relieved where the content underwent human review or editorial control and a person or organization holds editorial responsibility.
- Artistic and satirical work. For evidently artistic, creative, satirical, or fictional works, deepfake disclosure is limited to a manner that does not hamper the display or enjoyment of the work.
Who it applies to
Article 50 reaches both providers (who build or place generative AI systems on the market) and deployers (who use them, for example to publish a deepfake or AI-written public-interest article). If your platform sits anywhere in the pipeline that produces or distributes synthetic content to people in the EU, assume some part of this applies to you.
Machine-readable marking means provenance
“Detectable as artificially generated” and “machine-readable” are the operative words. A visible badge is not enough on its own; the marking has to be something software can read reliably. That is precisely what a content provenance record provides — and why the open C2PA standardis the common reference point regulators and platforms keep landing on. A signed record that states what produced an asset, in a format any verifier can parse, is exactly the kind of digitally-signed metadata the Code highlights — a strong candidate for the machine-readable marking, paired with a human-facing label for disclosure. Whether a specific implementation is legally sufficient depends on a conformity analysis against Article 50(2)’s effectiveness, interoperability, robustness, and reliability criteria; treat provenance as a capability that helps, not as a compliance verdict.
Two obligations, one record
It helps to separate the human label from the machine marking, then drive both from the same source of truth:
- Human label. A clear, visible disclosure for deepfakes and public-interest AI text.
- Machine marking. A signed, parseable provenance record traveling with the content so downstream systems can detect and surface its AI status automatically.
The subtlety that trips teams up: only mark what is actually AI-generated. Over-labeling human editorial work as AI is its own compliance and trust problem. A provenance system should distinguish human-authored content from machine-generated content at the record level — Hessian does this by omitting the AI source-type marker on editorial-origin records.
A practical readiness checklist
- Inventory every surface where your product generates or publishes synthetic content.
- Decide where marking happens — ideally at publish time, as a signed record, not as after-the-fact metadata that gets stripped.
- Make the marking machine-readable and interoperable (for example, a C2PA-compatible manifest) so platforms and auditors can consume it.
- Distinguish AI-generated from human-authored content explicitly.
- Keep an auditable trail of disclosures — who published what, when, and how it was marked.
How a provenance-first CMS helps
If marking is an after-thought, it tends to live in fragile file metadata that does not survive distribution — see why content credentials get stripped. If it is built into publishing, every asset can carry a durable, machine-readable record by default. That is the design behind a headless CMS with a provenance layer: signed at publish time, delivered as data, and distinguishing human from AI. To see how Hessian approaches disclosure-ready publishing, visit the product overview or get in touch.