Labelling AI-Generated Content: Article 50, Machine-Readable Watermarks and C2PA

Labelling AI-generated content is no longer a matter of good intentions; it is an obligation that is already in force. Article 50 of the EU AI Act started applying on 2 August 2026 and was not deferred by the July 2026 amendment. Yet the technical half of the duty — what “machine-readable marking” actually means, how it is implemented, and why it so often fails — is explained almost nowhere. This post covers that half.

What Article 50 actually requires#

Article 50 is not one rule but a bundle of four duties, and they fall on different parties: some on the provider who builds the system, some on the deployer who uses it.

• Interaction notice (provider): systems intended to interact directly with natural persons must be designed so that the person is informed they are interacting with an AI system — unless this is obvious from the circumstances and context of use.
• Marking of synthetic content (provider): systems generating synthetic audio, image, video or text must mark the outputs in a machine-readable format and make them detectable as artificially generated or manipulated.
• Emotion recognition and biometric categorisation (deployer): the people exposed to the system must be informed of its operation.
• Deepfakes and text on matters of public interest (deployer): deepfake content must be disclosed as artificially generated or manipulated. A comparable disclosure applies to text published to inform the public on matters of public interest, except where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility. For artistic, satirical, fictional and analogous works, the disclosure is made in an appropriate manner that does not hamper the display or enjoyment of the work.

The full text is at Article 50 ↗; the complete timeline and what was deferred is in the new timeline post.

The article that was not deferred: live since 2 August 2026#

In July 2026, Regulation (EU) 2026/1744 pushed the high-risk deadlines back. The impression this created in public discussion — “the AI Act has been delayed” — is simply false as far as Article 50 is concerned. Article 50 was not amended and started applying on 2 August 2026.

The only concession is narrow: for systems placed on the market before 2 August 2026, the machine-readable marking duty applies from 2 December 2026. That is a four-month technical window for existing products to add marking to their generation pipeline — not a deferral of transparency itself.

Alongside the hard obligation, a voluntary framework also took shape: the Code of Practice on Transparency of AI-generated Content was finalised on 10 June 2026, and roughly 190 organisations had signed by the end of July 2026. A code of practice creates no obligation of its own; it offers a shared reading of how the obligation can be met. Details on the Commission’s page ↗.

A regulation the public was calling “delayed” had a chapter switching on that very week. There is no better argument against reading law from headlines.

What “machine-readable” means: hard binding and soft binding#

The whole obligation turns on one phrase: machine-readable. A caption reading “Generated with AI” does not satisfy it, because it disappears the moment someone screenshots, crops or re-encodes the file. There are two basic technical approaches, and neither is sufficient alone.

Hard binding#

The mark is embedded inside the content itself: in pixel values, in the audio waveform, or in the token-selection distribution of generated text. Its advantage is that it survives a format change to some degree. Its disadvantage is an unavoidable trade-off between robustness and imperceptibility: the more durable you make the watermark, the more it degrades the content; the more invisible you make it, the more easily it is erased.

Soft binding#

The mark travels alongside the content, as a signed metadata package attached to the file. Its advantage is far richer information — which model, what date, what edits were applied. Its disadvantage is fragility: most platforms strip metadata on upload, and a screenshot never carries it at all. Soft binding is therefore usually backed by a fingerprint: a perceptual digest of the content is stored in a registry so that a match can be looked up even after the metadata is gone.

C2PA: how content credentials work#

On the soft-binding side the most mature technical framework is C2PA. It is a specification, currently at version 2.4 and published openly ↗. The core idea is simple: carry the content’s history inside a cryptographically signed manifest.

• Assertion: a single statement about the content — “this image was produced by a generative model”, “this region was cropped”, “this audio segment was added”.
• Claim: the assertions gathered and summarised together.
• Signature: applied with the certificate of the party issuing the claim. Validation checks both signature validity and the trustworthiness of the chain.
• Manifest store: as content is edited, new manifests are appended, producing a chain of edit history.

Two common misreadings are worth correcting. First: a C2PA manifest does not prove that content is authentic. It proves who asserted what, and when. A manifest is worth exactly as much as the party that signed it. Second: the absence of a manifest does not mean content is synthetic — the metadata may simply have been stripped. A verification interface must distinguish these two states; “no signature” and “invalid signature” must never render the same way.

# The correct order in a labelling pipeline (pseudocode)
output = model.generate(prompt)
output = embed_watermark(output)           # 1) hard binding, at generation time
manifest = {
    "generator":  MODEL_NAME_VERSION,
    "timestamp":  utc_now(),
    "assertions": ["ai_generated", "no_edits"],
}
output = attach_manifest(output, sign(manifest))     # 2) soft binding
register_fingerprint(perceptual_hash(output), manifest)  # 3) fallback record
# The wrong order: publish first, mark later.
# A published copy can never be recalled.

Why watermarks die: an honest list of limits#

Most products sold in this space report laboratory detection rates as if they were real-world rates. In the real world, content passes through the following operations, and each of them erases part of the mark:

• Re-encoding: social platforms recompress every image and video on upload. Lossy compression targets exactly the low-amplitude signal a watermark lives in.
• Cropping and rescaling: a spatially localised mark is partly or wholly lost to a crop.
• Screenshots: all metadata is gone; only the pixel-embedded signal remains, and resampling weakens that too.
• The special case of text: text watermarks are placed in the token-selection distribution. A short passage has no statistical room to carry one, and paraphrasing the text with another model reliably removes it. Text is the most fragile of the four content types.
• Deliberate attack: a party who knows the mark is there will try to remove it. Robustness claims must be tested under an adversarial assumption, not an average one.

A watermark is a seal, not a lock. It will not stop a determined attacker; it makes provenance visible in ordinary circulation. That, in fact, is what the obligation is for.

This creates an asymmetry on the detection side: false negatives (marked content appearing unmarked) are very common, while false positives are rare but far more damaging — labelling a human’s work as synthetic is a serious harm. Why threshold choice is a cost-benefit decision rather than a technical default is covered in classification metrics, and the same logic applies here.

An implementation checklist#

For a team turning the obligation into a product plan, in order:

• Take an inventory. Which product surfaces generate or publish synthetic content? Most teams realise late that a summarisation feature counts too.
• Establish your role. For each surface, are you the provider or the deployer? The duty differs.
• Put marking inside the generation step, not the publishing step. A published copy cannot be recalled.
• Design the notice. An interaction disclosure is not a checkbox in the terms of service; it is an interface element visible when the conversation starts.
• Build the verification side too. Test your own output through your own validator, and preserve the distinction between “no signature” and “invalid signature” in the interface.
• Document it. Which method, in which scope, with which known limitations. That is a natural section of the model card.

One closing connection: generating synthetic training data and publishing synthetic content are different things, but they rest on the same discipline — knowing what you produced, with what, and how you marked it. The record-keeping habit in synthetic data transfers directly here, and for the measurement side, the subgroup discipline in bias and fairness applies to detector performance as well.

In short: content labelling is the most technical obligation in the whole text. It cannot be discharged with a warning line under an image; it is a design decision that reaches inside the generation pipeline. A team that does this now both meets a live obligation and becomes one of the few publishers who can prove where their content came from.