EU AI Act Article 50: What the AI Transparency and Watermarking Rules Actually Require

Published 13 August 2026. A working guide for anyone who builds with, deploys, or writes about generative AI.

On 2 August 2026, the transparency obligations of the European Union's Artificial Intelligence Act became enforceable. The relevant provision, Article 50, is short, but it has quietly changed the rules for every company that generates synthetic text, images, audio, or video and makes it available to people in the EU. If you have wondered why AI products started adding watermarks and "AI generated" labels this year, Article 50 is a large part of the answer.

This article explains what Article 50 requires, who it applies to, the deadlines that matter, and where the law is running ahead of the technology that is supposed to satisfy it. It is written for practitioners rather than lawyers, so treat it as background and not as legal advice.

What Article 50 is, in one paragraph

Article 50 sits in the "transparency" tier of the AI Act, separate from the strict "high risk" rules. Its logic is simple: people have a right to know when they are dealing with a machine or with machine made content. The article turns that principle into four concrete duties, aimed at two different groups, providers (the companies that build and ship an AI system) and deployers (the organisations that put it to use). The full consolidated text is published by the European Commission and mirrored at the independent EU Artificial Intelligence Act portal.

The four transparency duties

Article 50 covers four situations. Each has its own trigger.

• Direct interaction. If a person is interacting with an AI system, such as a chatbot, they must be told, unless it is obvious from the context. A support widget that answers in natural language cannot pretend to be a human agent.
• Synthetic content. Providers of systems that generate synthetic audio, image, video, or text must ensure the output is marked in a machine readable format and is detectable as artificially generated. This is the watermarking clause, Article 50(2), and the one that matters most for our topic.
• Emotion recognition and biometric categorisation. Deployers using these systems must inform the people exposed to them.
• Deep fakes and public interest text. Deployers who publish deep fakes, or AI generated text on matters of public interest, must disclose that the content is artificially generated or manipulated.

The distinction between provider duties and deployer duties is worth holding onto. The obligation to embed a machine readable mark falls on the provider, the company that operates the model. The obligation to disclose a deep fake or a piece of AI written news falls on the deployer, the person or organisation that publishes it.

The watermarking mandate, and why it is hard

Article 50(2) asks for two properties at once. The mark must be machine readable, so that software can recognise it, and the content must be detectable as AI generated. The recital language adds that solutions should be effective, interoperable, robust, and reliable "as far as this is technically feasible." That last clause is doing a lot of work, because no single technique satisfies all of those properties today.

Consider the options. Metadata based provenance, such as C2PA content credentials, is interoperable and easy to read, but it is trivially removed by taking a screenshot or re saving a file. Statistical text watermarking, of the kind Claude uses, is robust to copy and paste, but it is not interoperable, because you need the provider's secret key to read it, and short passages do not carry enough signal to be reliable. Visible labels are unmissable to humans but are not machine readable and are easy to crop away. Every mechanism trades one required property for another, which is why coverage of the mandate in 2026 repeatedly noted that the rule outpaces the technology meant to fulfil it.

The timeline you need to remember

The AI Act phases in over several years, but for Article 50 the dates are compact.

• 2 August 2026. The transparency obligations, including Article 50, became applicable and enforceable.
• 2 December 2026. Under a provisional agreement reached in 2026, generative systems that were already on the market before August 2026 have until this date to meet the machine readable marking requirement of Article 50(2). It is a short grace period for existing products, not a reprieve from the rule.
• Ongoing. The Commission is finalising a voluntary Code of Practice on the transparency of AI generated content, and guidelines that explain how regulators expect the duties to be met. These are the documents to watch, because they define what "good enough" marking looks like in practice.

Penalties

Transparency breaches do not sit in the most severe penalty band of the Act, which is reserved for prohibited practices, but they are not trivial. Non compliance with Article 50 can attract fines of up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher. For a large provider, the turnover figure is the one that bites.

What this means if you deploy AI

If you use AI to produce content that reaches people in the EU, three practical habits follow from Article 50. First, keep the provenance signals your tools attach. If your model provider embeds a watermark or content credential, stripping it before publication can move a compliance duty onto you and undermine the whole scheme. Second, disclose where the article asks you to, particularly for deep fakes and for AI written text on public interest matters. A short, honest label is usually enough. Third, do not treat a third party "AI detector" as evidence of compliance. Those tools estimate; they do not read the provider's watermark, and their false positive rates make them unsafe as a basis for accusations or defences.

Text versus images: two different provenance stories

Article 50 treats "synthetic content" as one category, but the engineering underneath splits cleanly in two. For images, audio, and video, the industry is converging on C2PA, cryptographically signed metadata that records how a file was made. It is inspectable and interoperable, which the law likes, but it is removable, which the law has to live with. For text, the leading approach is statistical watermarking, which biases word choice using a secret key so that the provider, and only the provider, can later measure the signal. It survives copy and paste but cannot be verified by anyone without the key. Understanding that split is the single most useful thing a non specialist can take from the regulation, because it explains why "just watermark everything" is harder than it sounds.

What you can verify, and what you cannot

It is tempting to read Article 50 and assume that AI content is now reliably labelled and reliably detectable. The honest position is narrower. You can reliably inspect content credentials on a file that still carries them. You can reliably find and remove hidden Unicode characters in text, which some tools use as a crude marker, using a simple checker. You cannot, from outside the provider, confirm whether a passage carries a statistical watermark, and you should distrust any product that claims a precise probability that it does. The law creates a duty to mark; it does not, and cannot, create a universal public detector.

The bottom line

Article 50 is a reasonable idea, that people should be able to tell when content is machine made, wrapped around a hard engineering problem that no current method fully solves. The rule is live as of August 2026, existing products have until December 2026 to add machine readable marks, and the fines are large enough to take seriously. The smartest response is not to chase a perfect watermark, but to preserve the provenance signals you are given, disclose plainly when asked, and be sceptical of any tool, in either direction, that promises certainty the underlying technology cannot deliver.

Provider or deployer? Worked examples

Because the duties split by role, it helps to place yourself. A company that trains and operates a text or image model, and offers it to the public, is a provider, and carries the machine readable marking duty of Article 50(2). A marketing agency that uses that model to produce a client campaign is a deployer, and carries the disclosure duties for deep fakes and public interest text. A newsroom running an AI writing assistant is a deployer. A SaaS product that bundles a third party model into its own feature can be both, a deployer of the upstream model and a provider of the feature it ships. When in doubt, ask which duty attaches to what you actually control: the generation, or the publication.

How this fits the rest of the AI Act

Article 50 does not stand alone. It sits alongside the rules for general purpose AI models, which carry their own documentation and transparency expectations, and it is being fleshed out by a voluntary Code of Practice on the transparency of AI generated content plus Commission guidelines. Those companion documents matter because they translate the article's high level language, effective, interoperable, robust, reliable, into concrete expectations regulators will actually check against. If you are planning compliance work, they are the texts to read next, because they define what a defensible marking approach looks like in practice.

A starting checklist

• Identify your role for each AI feature: provider, deployer, or both.
• Confirm whether your outputs reach people in the EU. If yes, Article 50 is in scope.
• For generated media, preserve the provenance marks your model provider attaches, and do not strip them before publication.
• For deep fakes and public interest text, add plain disclosure at the point of publication.
• Watch the Code of Practice and guidelines, and align your marking approach to them as they finalise.
• Do not rely on third party detectors as evidence of compliance.

Frequently asked questions

When did EU AI Act Article 50 take effect? The transparency obligations became applicable on 2 August 2026. Generative systems already on the market before then have until 2 December 2026 to meet the machine readable marking requirement.

Who has to comply? Providers of AI systems that generate synthetic content carry the marking duty, and deployers who publish deep fakes or AI generated public interest text carry disclosure duties. If your output reaches people in the EU, it is in scope.

What are the penalties? Non compliance with Article 50 can bring fines up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher.

Does it require watermarking text? It requires synthetic content to be marked in a machine readable way and detectable as AI generated, as far as technically feasible. For text this is hard, because a keyed watermark is not third party readable, which the law acknowledges.

Further reading on this site: How Claude's invisible watermark works · C2PA content credentials explained · Is it legal to remove an AI watermark?