What Article 50 requires
Article 50 of the EU AI Act is the transparency chapter. It does not ban anything. It says that certain AI systems and certain AI outputs must be identifiable as such.
For images, two obligations matter.
On providers. Anyone providing a generative AI system that produces synthetic image, audio, video or text must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. The marking has to be effective, interoperable, robust and reliable as far as technically feasible, taking into account the type of content, cost of implementation and the state of the art.
On deployers. Anyone who uses an AI system to generate or manipulate image, audio or video content that resembles real people, places or events — a deepfake — must disclose that the content has been artificially generated or manipulated. This is a human-facing disclosure, distinct from the machine-readable mark.
Note that these land on different parties. The model provider embeds the mark. The person publishing the deepfake makes the disclosure. Both can apply to the same image.
The dates
| Date | What happens |
|---|---|
| Before 2 August 2026 | Content generated in this period needs no retroactive labelling |
| 2 August 2026 | Article 50 obligations apply |
| 2 December 2026 | Deadline for systems already placed on the market before 2 August 2026 to meet the machine-readable marking obligation |
The grandfathering is narrow and worth reading carefully. Existing systems get a few extra months for the marking requirement. Content that already exists does not have to be tracked down and relabelled.
The penalties
Breaches of the transparency obligations sit in the middle tier of the enforcement regime: fines up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher. The higher tier, reserved for prohibited practices, goes further; the lower tier covers supplying incorrect information to authorities.
Fifteen million euros is enough to make marking a product requirement rather than an ethics initiative. That is the point of the number.
What "machine-readable" means in practice
The regulation is deliberately technology-neutral. It names techniques without mandating one:
| Technique | Example | Durability |
|---|---|---|
| Metadata provenance | C2PA Content Credentials, signed manifests | Rich detail, easily stripped |
| Origin tagging | IPTC DigitalSourceType: trainedAlgorithmicMedia in XMP |
Simple, easily stripped |
| Watermarking | Pixel-level marks such as Google's SynthID | Survives re-encoding, needs a detector |
| Fingerprinting and logging | Perceptual hash matched against a provider registry | Survives, requires a lookup service |
In practice most providers are converging on a combination: a C2PA manifest plus an IPTC origin tag for readability, and a watermark for durability. C2PA gives interoperability, which the "interoperable" wording in the Article pushes towards. Watermarking covers the case where the metadata does not survive the trip.
If you want the mechanics of each, see what C2PA Content Credentials are and SynthID explained, and its limits.
What is carved out
Article 50 does not require marking where the AI performs an assistive function for standard editing and does not substantially alter the input data or its semantics. Auto-levels, noise reduction, an AI-assisted healing brush on a dust spot — these are not intended to trigger the obligation. Generative fill that invents a new subject in the frame is a different matter.
There are also exemptions for AI systems authorised by law for detecting or prosecuting criminal offences, and lighter treatment for content that forms part of an evidently artistic, creative, satirical or fictional work — where the disclosure obligation can be met without spoiling the work.
The boundary between "assistive" and "substantially altering" is genuinely fuzzy and will be sharpened by guidance and codes of practice rather than by the Article's own text.
What changes for you as a reader
More AI images will arrive carrying readable markers. That is a real improvement, and you can check it today: drop a file into SynthCheck and it will surface a C2PA manifest, an IPTC trainedAlgorithmicMedia tag, or a generator fingerprint if one is present.
But three gaps stay open, and no regulation closes them.
Metadata still gets stripped downstream. The obligation is on the provider at generation time. It says nothing about what a social platform does to the file afterwards, and platforms re-encode almost everything. See why Instagram strips image metadata.
Not everyone is in scope. Locally run open-source models, services outside the EU that do not target the EU market, and anyone simply ignoring the rules will keep producing unmarked images.
Nothing is retroactive. Every image made before 2 August 2026 is unaffected. That is most of the images currently on the internet.
So the rule you already needed stays exactly as important: the absence of an AI marker never proves an image is authentic. Article 50 raises the odds that a marker is present. It does not turn a missing marker into evidence of anything. The full method is in how to check if an image is AI-generated.
A short checklist if you build with generative models
Not legal advice — a starting point for a conversation with someone who gives it.
- Work out whether you are a provider, a deployer, or both. The obligations differ.
- If your output pipeline re-encodes images, check whether it is discarding provenance you were required to add. Adding a mark and then stripping it two services later is a compliance failure with a paper trail.
- Prefer standardised, published formats over a proprietary tag nobody else can read. "Interoperable" is in the text.
- For deepfake-style content, plan the human-facing disclosure as well as the machine-readable mark. They are separate requirements.
- Keep records of what you mark and how. Demonstrability tends to matter as much as the underlying measure.
FAQ
Does Article 50 apply to me if my company is outside the EU? The AI Act reaches providers placing systems on the EU market and cases where the output is used in the EU, regardless of where you are established. Geography of incorporation is not the deciding factor.
Do I have to label an image I generated in 2025? No. Content generated before 2 August 2026 carries no retroactive labelling obligation.
Is a visible watermark in the corner enough? For the human-facing deepfake disclosure it may help. It does not satisfy the machine-readable marking obligation on providers, which requires something a system can parse — metadata, an embedded watermark, or an equivalent.
Will this make AI detectors accurate? No. It changes what is written in files; it does not make pixel analysis work. Tools that report a confidence percentage from a classifier remain unreliable. SynthCheck deliberately does not produce one — it reports what is written in the file and shows you the raw field it came from.