Our app generates images and text with AI and is used in the EU. Does the EU AI Act require us to watermark or mark that output, what exactly do we have to do, and is December 2, 2026 really the deadline?

What should I check, step by step?

1. Work out your role for each AI feature. Article 50(2) falls on the provider of the AI system that generates the content; labelling deepfakes and public-interest text under Article 50(4) falls on the deployer who uses it. You can be both.

2. Note when each generating system was placed on the EU market. Before August 2, 2026: comply with Article 50(2) by December 2, 2026. On or after that date: it applied from launch.
3. Check the exceptions narrowly. The marking duty doesn't apply where the system performs an assistive function for standard editing or doesn't substantially alter the input data or its semantics. A tool that writes or draws new content isn't covered by that exception.
4. If you build on another company's model, find out what marking its outputs already carry. The Commission's guidelines say you may rely on an upstream provider's or a third party's marking solution if it complies, but you remain responsible for showing compliance.
5. Decide whether to sign the Code of Practice. Signatories can rely on its measures; providers that don't sign must show their own measures are adequate to each market surveillance authority.
6. Implement the marks the Code describes: signed, time-stamped metadata stating AI-generated or AI-manipulated where the format supports metadata, plus an imperceptible watermark, with free-form text under 200 tokens exempt from watermarking. Keep existing provenance metadata intact and prohibit removing it in your terms.
7. Offer a detection solution people can use free of charge, with a downloadable result, and plan watermark detection that works across providers by February 2, 2027.
8. Keep evidence of what you shipped: which marking version ran on which outputs, test results for robustness against common edits such as cropping and re-encoding, and the date each change went live.

What does Article 50(2) of the EU AI Act require for AI-generated content, and when does it apply?

Article 50(2) applies to providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content. The outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated, and the technical solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the type of content, the cost of implementation and the generally acknowledged state of the art. Article 50(5) adds that the information must reach people clearly at the latest at their first interaction or exposure.

• The Commission's guidelines, adopted on July 20, 2026, say the marks must be structured so software can identify and extract them without human intervention. Providers may use one technique or a combination, and are not required to keep a full provenance chain of every modification, although provenance methods can be used to comply. The guidelines are non-binding; only the Court of Justice gives authoritative interpretations.
• Timing: Article 50 applies from August 2, 2026. The Digital Omnibus on AI, published in July and in force on July 27, 2026, added a transition for generative systems placed on the market before August 2, 2026: they must comply with Article 50(2) by December 2, 2026. The Council's May 7, 2026 announcement of the provisional deal described this as a shorter grace period than the Commission first proposed. Deployer obligations under Article 50(4) weren't deferred.
• Penalties: under Article 99(4), breaching the Article 50 transparency obligations can lead to administrative fines of up to EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher.

What does the EU Code of Practice on AI-generated content ask providers to do for marking and detection?

The Code of Practice on Transparency of AI-generated Content was published on June 10, 2026 after two earlier drafts. Signing is voluntary, but the Commission and the AI Board have confirmed it's an adequate tool to demonstrate compliance with Article 50(2), (4) and (5). The Commission says about 190 organisations had signed by the end of July 2026.

• For providers, the Bundesnetzagentur's summary of the Code lists signed metadata (if the format supports metadata, record whether content is AI-generated or AI-manipulated, digitally signed and time-stamped in a tamper-evident way) and an imperceptible watermark, applied after generation or during inference, except for very short text. Fingerprinting or logging by the provider is an optional supplementary measure. Existing metadata marks must be kept and not intentionally removed, and terms of use must prohibit removing them.
• Freshfields' review of the final text says that in practice this means at least two layers of machine-readable marking, with a single layer allowed for systems in closed, technically controlled physical products and for free-form text, which can't carry metadata; text longer than 200 tokens must be watermarked. Watermark detection has to be interoperable by February 2, 2027, through a standard API that routes queries, a readable signpost in the content, a shared detector run by a consortium of signatories, or a comparable solution.
• Detection must be free in principle and hosted in the EU or run locally, in line with EU data protection law. Providers with fewer than 1,000,000 monthly users whose detection tool is costly to run may charge a reasonable fee for a single user's requests above a reasonable volume; regulators, law enforcement, media, fact-checkers, researchers and civil society keep free access without volume limits.

Who is responsible for marking AI-generated content under the EU AI Act when your app uses another company's model?

Article 50 doesn't explicitly apply to general-purpose AI models, only to AI systems. The guidelines encourage model providers to mark outputs at the model level, partly so downstream system providers can meet their own duties, and they say a system provider may rely on a marking solution from an upstream model provider or a third party as long as it complies. Responsibility for showing compliance stays with the provider of the AI system.

• That makes vendor evidence part of your compliance file: what marking the model's API applies, whether your own processing (resizing, compressing, re-encoding, stripping metadata in your pipeline) removes it, and what detection tool covers it.
• Deployers have their own duty under Article 50(4): disclose deepfakes, and label AI-generated or manipulated text published to inform the public on matters of public interest unless it had human review or editorial control and someone holds editorial responsibility. Freshfields notes the final Code requires deployers relying on that review exception to identify who holds editorial responsibility and document their review process, but not to record each individual review.