EU AI Act Article 50, explained for content teams

Most of the EU AI Act (Regulation (EU) 2024/1689) is written for the people who build and place AI systems on the market. Article 50 is the exception. It is the transparency chapter, and it reaches the marketing team that drops a Midjourney render into a campaign, the newsroom that runs a synthetic voiceover, and the agency that publishes on a client's behalf. If your job involves shipping content rather than shipping models, Article 50 is probably the only article you need to read closely — and it became enforceable on 2 August 2026.

What Article 50 actually requires

Article 50 bundles four distinct transparency duties. They are often collapsed into "label your AI content," which is close enough to be useful and wrong enough to get a process built badly. The four:

• Disclosure of AI interaction. Systems that interact directly with people — chatbots, voice agents — must make clear that the person is talking to an AI, unless it is obvious from context.
• Machine-readable marking of synthetic output. Providers of generative systems must ensure their outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. This is the duty that produces file-level metadata rather than a visible caption.
• Deepfake disclosure. Deployers who generate or manipulate image, audio, or video content that constitutes a deepfake must disclose that it has been artificially generated or manipulated.
• Text disclosure. Article 50(4) also covers AI-generated text published to inform the public on matters of public interest: it must be disclosed as AI-generated unless the content has undergone human review and a person or organisation holds editorial responsibility for it.

The distinction that matters operationally is between the machine-readable marking duty and the human-visible disclosure duty. They are separate obligations with separate evidence trails. A visible "Made with AI" badge on a landing page does not satisfy the machine-readable requirement, and an embedded metadata manifest does not by itself satisfy a deepfake disclosure that a viewer is supposed to notice. Teams that treat them as one thing tend to over-deliver on the visible side and under-deliver on the part that is actually auditable.

Provider or deployer — and why agencies are usually both

The Act separates providers (who develop an AI system or place it on the market under their own name) from deployers (who use one under their own authority). A content team using a commercial image generator is a deployer. That sounds like the lighter role, and for most of the Act it is — but Article 50 assigns deployers their own obligations that exist independently of whatever the model vendor did or failed to do.

This is the point agencies most often miss. If your generator embeds provenance metadata and your export pipeline strips it, the resulting published asset is unmarked, and the fact that the upstream provider complied does not transfer to you. Compression steps, CDN transformations, CMS re-encoding, and social platform ingestion all routinely discard metadata. Compliance is a property of the artefact you publish, not of the tool you used to make it.

Territorial scope: this is not only an EU problem

Like the GDPR, the AI Act follows the output rather than the office. It applies where the system's output is used in the Union, which means an agency in Dubai or New York publishing AI-generated campaign content that reaches EU audiences falls inside Article 50. There is no establishment test that lets a non-EU publisher opt out by keeping servers elsewhere. For multinational teams the practical consequence is that the EU rule tends to become the internal baseline, because segmenting a content library by audience geography is harder than marking everything.

Penalties

Breaches of the Article 50 transparency obligations can draw administrative fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. That sits below the Act's top tier (reserved for prohibited practices) but well above the level at which "we'll deal with it if someone asks" is a defensible posture. Enforcement is by national market surveillance authorities, and the realistic first contact for most publishers is not a raid but a request for evidence — a complaint, a procurement questionnaire, or a client's own compliance review asking what you can demonstrate about a specific published asset.

That shapes what "being compliant" means in practice. The question you will be asked is rarely "is your process good?" It is "show me the provenance of this file, as it was when you published it."

What machine-readable marking looks like in practice

The Act names the outcome, not the format: marking must be machine-readable, effective, interoperable, robust, and reliable as far as technically feasible. In 2026 the de facto answer for images, video, and audio is C2PA Content Credentials — the open standard from the Coalition for Content Provenance and Authenticity, which embeds a cryptographically signed manifest describing how an asset was produced, including whether generative AI was involved, using the IPTC digitalSourceType vocabulary. Anyone can inspect a signed file independently at verify.contentauthenticity.org, which is what makes it evidence rather than an assertion.

There are formats where embedding is not available. The C2PA reference implementation does not yet support PDF, so the practical route there is to write the same IPTC digitalSourceType declaration into the document's XMP metadata — machine-readable, readable by Adobe tooling, and satisfying the substance of the requirement. Raw text cannot carry cryptographic metadata at all: copy-and-paste strips everything, which is precisely why Article 50(4) uses a disclosure requirement rather than a marking requirement for text.

Our C2PA implementation guide covers the signing, certificate, and pipeline mechanics in detail.

The unknowable-origin problem

Every content team discovers the same gap in month one. You inherit a library of tens of thousands of assets. Some were made by humans, some by generators, and a large fraction have had every scrap of metadata stripped by a decade of CMS migrations. Detection can find C2PA manifests, XMP digitalSourceType declarations, and generator fingerprints left by tools such as DALL·E, Midjourney, Adobe Firefly, Stable Diffusion, and ComfyUI. Detection cannot prove that a stripped file was made by a human. Absence of markers is not evidence of human origin, and any vendor claiming otherwise is selling you a liability.

The workable answer is procedural rather than technical: a named human-origin attestation. A specific person declares, on the record and with a timestamp, that a given asset is of human origin. That is a normal evidentiary artefact — it is how provenance works everywhere else in business — and it converts an unresolvable technical question into an accountable human one.

A workable compliance process

1. Inventory. Scan the existing library and classify every asset: valid provenance present, AI evidence without provenance, or origin unknown.
2. Remediate the middle bucket. Assets with AI evidence and no marking get a signed C2PA manifest injected declaring them AI-generated. This is the bucket that is unambiguously a violation today.
3. Attest the third bucket. Route unknown-origin assets to a named reviewer for a human-origin attestation, or mark them as synthetic if that is the honest answer.
4. Close the pipeline. Add a check at the publish step, not just at import. Verify that provenance survives your build, resize, and CDN stages — this is where most marking silently dies.
5. Keep the trail. Retain timestamped scan records showing the compliance state of each asset at the moment you published it. Platforms will strip your metadata downstream; the audit trail proves you met the obligation you could actually control.
6. Handle text separately. Log Article 50(4) disclosures for AI-generated public-interest text with a content hash, the responsible person, and a timestamp.

Start with what you have

The distance between "we should look at this" and "we know our exposure" is one scan of the existing library. Most teams find that the violation bucket is smaller than feared and the unknown-origin bucket is much larger than expected — which is useful, because the second one is a staffing question with a known answer, not a legal cliff.

Authentrail scans batches for C2PA and generator markers, evaluates every asset against EU, UAE, and US rules at once, injects signed manifests where they are missing, and exports the timestamped audit report. Try the live scan on the homepage or see pricing.