As of August 2, 2026, the transparency rules in Article 50 of the EU AI Act are enforceable. From today, national authorities across the European Union can investigate and act against companies and creators who publish AI-generated images, video, audio, or text without the required disclosure. If you use tools like Midjourney, Suno, ElevenLabs, or FLUX and your work reaches people in the EU, this is the rule that changes what you have to do before you hit publish.
This is not a new law. Article 50 is part of Regulation (EU) 2024/1689, passed in 2024, but August 2, 2026 is the date its transparency obligations become live and enforceable. Here is what changed, who it applies to, and a concrete checklist to get compliant.
What Changed on August 2
Until now, Article 50 was on the books but not yet enforced. As the European Commission's transparency fact page lays out, national competent authorities designated under the Act now have the legal power to investigate, issue guidance, and take enforcement action. The obligations cover four situations that create transparency risk for people: direct interaction with an AI system, AI-generated or manipulated content, emotion recognition and biometric categorization, and deepfakes plus AI-generated text on matters of public interest.
For most creators and studios, two of those four matter every day: marking AI-generated content and disclosing deepfakes. The Commission has also published guidelines on the scope and application of Article 50 and is developing a Code of Practice on AI-generated content to give the industry practical marking and labeling methods.
Providers vs Deployers: Who Must Do What
Article 50 splits responsibility between two roles, and many creators are both at once. Providers are the people who make or ship a generative AI system. Under paragraph 2, a provider generating synthetic audio, image, video, or text must ensure the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated," with solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible." If you fine-tune a model and expose it in your own app, you are a provider.
Deployers are organizations and professionals who use an AI system in their work. That includes agencies, marketing teams, newsrooms, and independent creators publishing to an audience. Deployers carry the disclosure duties: they must reveal deepfakes, disclose AI-generated text on public-interest topics, and inform people who are subject to emotion recognition or biometric categorization. The practical takeaway is that even if the tool you use already marks its output, you as the publisher still owe your audience a clear disclosure in many cases.
What Creators Must Disclose
The rule reads differently depending on what you are publishing. This table maps common creator scenarios to the role you occupy and the obligation that attaches to it.
| What you publish | Your role | What Article 50 requires |
|---|---|---|
| An AI-generated image or video posted publicly | Deployer | Disclose that the content is artificially generated or manipulated |
| A realistic deepfake of a real person, place, or event | Deployer | Clear disclosure that it is artificially generated or manipulated |
| An AI-written article on news or public-interest topics | Deployer | Disclose AI generation, unless a human editorially reviewed it and takes responsibility |
| Output from your own generative model or app | Provider | Embed machine-readable marks flagging the output as AI-made |
| A chatbot or AI assistant users talk to | Provider or deployer | Tell users they are interacting with an AI, unless it is obvious |
| A purely artistic or satirical AI work | Deployer | Disclose in a way that does not spoil the experience |
The Machine-Readable Marking Requirement
The word "machine-readable" is doing a lot of work in the provider obligation. A visible caption that says "made with AI" is good practice, but it is not machine-readable, because a scraper or platform cannot reliably parse it. Compliance leans on technical provenance built into the file itself. In practice that means one or more of metadata tagging, watermarking, cryptographic provenance, or machine-readable audit logs.
The dominant open standard here is C2PA, the Coalition for Content Provenance and Authenticity specification, surfaced to end users as Content Credentials. C2PA attaches a tamper-evident manifest to a file that records how it was made, including whether generative AI was involved. Adobe, camera makers, and several model providers already support it. Google's SynthID takes a complementary approach by embedding an invisible watermark directly into pixels or audio. For a provider, the safest reading of Article 50 is to ship output that carries a durable, machine-readable signal, not just a caption a user can crop out.
One trap for creators: provenance metadata is fragile. Many social platforms and re-encoding steps strip C2PA manifests on upload. If you rely on embedded credentials to meet the marking obligation, verify the signal survives your export and publishing pipeline, and add a visible disclosure as a backstop.
The Exceptions Creators Should Know
Article 50 is not a blanket "label everything" mandate, and the exceptions are where creative work has room to breathe. Disclosure is not required when the use of AI is obvious to a reasonably well-informed person. Assistive editing functions that do not substantially alter the input, such as minor retouching, are carved out. Artistic and satirical works get a lighter touch: the disclosure must exist but in a manner that does not hamper the display or enjoyment of the work, for example in the credits rather than stamped across the frame. AI-generated text that has undergone human editorial review, with a person or organization taking editorial responsibility, is also exempt from the text-disclosure duty. Law enforcement uses have their own carve-outs.
These exceptions matter because they let a filmmaker or artist comply without defacing the piece, while still closing the door on undisclosed deceptive deepfakes.
Penalties and the December 2026 Grace Period
The enforcement teeth are real. Breaches of the transparency obligations carry fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. That ceiling is aimed at large providers and deployers, but the obligation itself applies to any organization whose AI content reaches the EU market, regardless of where it is based.
There is one important piece of breathing room. A grace period on the marking obligation runs until December 2026 for generative AI systems that were already placed on the market before August 2, 2026. That gives model providers a few months to retrofit machine-readable marking. It does not, however, delay the deployer disclosure duties for deepfakes and public-interest text, which are live now.
Your Article 50 Compliance Checklist
If your work touches an EU audience, here is a practical sequence to get compliant this week.
1. Map your exposure. List every channel where you publish AI-assisted content that EU users can see. The rule follows the audience, not your headquarters.
2. Inventory your tools. Note which of your generators already export Content Credentials or embed a watermark, and which produce clean files with no provenance signal.
3. Turn on provenance. Enable Content Credentials or C2PA export where your tools support it, and confirm the metadata survives your editing and upload pipeline rather than being stripped on re-encode.
4. Add visible disclosure for the high-risk cases. For any deepfake of a real person and any AI-written piece on a public-interest topic, add a plain-language "AI-generated" note unless a human editor is taking responsibility.
5. Label your chatbots. If you run an AI assistant, add a clear notice that users are talking to an AI at the start of the interaction.
6. Keep a record. Document your process so you can show an authority how you decided what to disclose. An audit trail is your cheapest insurance.
Frequently asked questions
Does Article 50 apply to me if I am outside the EU?
Yes, if your AI-generated content is made available to people in the EU. The regulation targets the market where the content lands, so a creator in the US or Asia publishing to an EU audience is in scope.
Do I have to label every AI-edited photo?
Not necessarily. Assistive edits that do not substantially alter the input, such as light retouching or color correction, fall under an exception. Substantial generation or manipulation, especially anything that makes something look real that is not, does need disclosure.
Is a visible "made with AI" caption enough?
For a deployer disclosing a deepfake, a clear visible or audible disclosure is the core requirement. For a provider, the obligation is specifically machine-readable marking, so a caption alone is not sufficient and should be paired with embedded provenance like C2PA.
What counts as a machine-readable mark?
Metadata tagging, watermarking, cryptographic provenance such as C2PA Content Credentials, and machine-readable audit logs all qualify as approaches. The standard is that the signal be effective, interoperable, robust, and reliable as far as technically feasible.
What happens if a platform strips my provenance metadata?
This is a known weakness. If your marking depends on embedded metadata that a platform removes on upload, you have not reliably met the obligation. Add a visible disclosure as a backstop and prefer platforms that preserve Content Credentials.
When do the fines start?
Enforcement powers apply from August 2, 2026. The marking obligation has a grace period until December 2026 for generative systems already on the market before that date, but deployer disclosure duties for deepfakes and public-interest text are enforceable now.
