Machine-Readable AI Marking: EU AI Act Article 50 Rules

Article 50(2) applies to providers of AI systems, including general-purpose AI models, that generate synthetic audio, image, video, or text. They must mark that output in a machine-readable format, detectable as artificially generated or manipulated, as far as technically feasible.

It took effect 2 August 2026 alongside the rest of Article 50's transparency rules. A transitional deadline of 2 December 2026 applies to certain marking obligations for systems already on the market before that date, and that grace period comes from the later Digital Omnibus reform rather than the AI Act's original text.

The phrase "as far as technically feasible" and a defined exemption list do real work here. Marking is not required for:

• Short sequences of numbers, symbols, or letters
• Source code
• Machine-to-machine outputs never exposed to a human
• Closed-loop industrial or product-development processes, except their final outputs
• Standard editing-assistive functions

Non-compliance has teeth. Companies face fines up to 15 million euros or 3 percent of global annual turnover, EU institutions up to 750,000 euros, enforced by national market-surveillance authorities, the AI Office, and the European Data Protection Supervisor.

This is a provider obligation about the output itself. A separate, deployer-facing set of duties covering deepfakes and public-interest text sits on the AI-generated content disclosure page.

Neither the Code of Practice on AI-generated content, whose final text was published 10 June 2026, nor the Commission's implementing Guidelines, adopted around 20 July 2026, name a marking technology anywhere. Both set the bar at marking that is "effective, interoperable, robust and reliable," as far as technically feasible.

So a provider could plausibly meet that standard with C2PA-style signed metadata, an embedded statistical watermark like SynthID, or some other mechanism entirely. What matters is whether it works in practice.

That neutrality is deliberate, not an oversight. Around 190 organizations, including Anthropic, Google, Meta, Microsoft, and OpenAI, had signed the Code by the end of July 2026, with the initial-signatory window closing 27 July 2026.

Cooley's commentary notes that signatories get "a degree of presumption of conformity" plus favorable enforcement treatment. Jones Day goes further on the engineering question, writing that "no single labelling or marking technique is sufficient in all cases" and recommending a multilayered approach mixing visible labels with invisible, machine-readable signals.

The Code backs that flexibility structurally. It explicitly permits lighter or adapted labelling for artistic, fictional, or satirical works, so one rigid mechanism does not get forced onto every kind of generated content.

No, and no Commission source supports any of it: not the C2PA mandate, not the pixel dimensions, not the Pantone colour. A cluster of marketing and SEO sites assert that the Commission or the AI Office effectively endorsed C2PA as the primary technical pathway for Article 50 compliance. The specifics they cite:

• A required icon at a 24x24px minimum
• PMS 286C blue as the mandated color
• A 5mm minimum size in print
• An "EU AI Office Q1 2026 guidance" mandating C2PA plus SynthID as the compliance default
• A February 2027 interoperable-detection deadline

None of this is supported by the Code of Practice, the Guidelines, or any Commission source. No Commission text mandates a pixel dimension, a Pantone colour, or a print size, and none names C2PA as a required pathway.

One correction is owed here, because the rumour sits next to something real. The Commission has published an official EU icon set, and Section 2 of the Code of Practice does carry placement specifications for it. Those icons are optional, they are about visible labelling rather than machine-readable marking, and they look nothing like the invented specs above. The next section covers what they actually are.

Treat the pixel dimensions, the Pantone code, the print minimum, and the C2PA mandate as rumor until an independent primary source confirms them. The real EU icons carry none of those attributes. Jones Day's actual advice to providers, notably, is to combine multiple signals rather than lean on any single one.

The Commission publishes an official icon set for labelling AI-generated content, and it is easy to miss because it answers a different question than machine-readable marking does.

There are three icons. A basic icon, for when AI was involved in creating deepfake content or published text. Fully AI-Generated, for content generated entirely by AI with no human-created elements beyond prompting. Partially AI-Modified, for pre-existing human-made content that AI turned into a deepfake. Each comes in four variations: black, white, and both at 50 percent transparency, downloadable as SVG and PNG.

The Commission is direct about their status: "The use of these EU icons is optional, but the labelling requirements under Article 50 AI Act are not." It adds that using them "does not establish legal compliance by itself."

The icons were user-tested, and the Commission notes performance improved across all measures when the basic icon was paired with a text label such as "modified."

Placement rules live in Section 2 of the Code of Practice, and the summary version is stricter than most voluntary guidance: the icon must be perceivable at first exposure, must sit where no overlay covers it, and must remain visible when the content is reshared or downloaded.

Licensing is genuinely open. The icons are free for anyone to use without attribution to the Commission or the AI Office, though non-signatories using them should not be read as claiming adherence to the Code.

No confirmed enforcement action, fine, or corrective order under Article 50 had been publicly reported as of 11 August 2026.

Veeam field CTO Edwin Weijdema, writing days after the deadline, predicted corrective and suspension orders will "significantly outweigh" major fines in year one. He also flagged a genuinely open question: whether AI agents embedded in ticketing or procurement portals even count as systems that trigger these duties in the first place.

Member states are at visibly different stages of readiness:

• Germany's KI-Marktüberwachungsgesetz names the Bundesnetzagentur as default national market-surveillance authority and EU AI Office contact point, backed by an internal coordination unit
• France, per a January 2026 report, had not formally designated its competent authorities at all, after a draft list of 17 candidates including CNIL, DGCCRF, and ARCOM was withdrawn from the relevant bill
• CEN-CENELEC's Joint Technical Committee 21, reportedly more than 300 experts across 20-plus countries working in five groups, is said to be developing harmonized standards partly aimed at Article 50 marking, with no finished standard confirmed

France's status was last confirmed in January 2026, so recheck it rather than assume it still holds months on. The same caution applies to JTC21's output, which rests on secondary sources rather than a fetched primary status page.