EU AI Act
EU AI Act and content provenance
Article 50 transparency obligations have applied since August 2, 2026. C2PA manifests provide machine-readable marking and a record your team can check.
Aug 2, 2026
Article 50 transparency obligations have applied since this date
Dec 2, 2026
Article 50(2) transition ends for eligible existing systems
EUR 15M / 3%
Maximum fine: EUR 15 million or 3 percent of global annual turnover
The 30-second proof runs an AI model in Provenance Chat and verifies the mark live. Or try it yourself.
Policymaker or regulator? Read the two-page Article 50 brief.
Timeline
The Compliance Timeline at a Glance
Aug 1, 2024
AI Act enters into force
Regulation (EU) 2024/1689 becomes law across the EU.
Feb 2, 2025
Prohibitions apply
Bans on prohibited AI practices have applied since this date.
- In force
Aug 2, 2026
Article 50 transparency obligations
Machine-readable marking required. Generative systems placed on the market from this date must comply from day one.
Dec 2, 2026
Article 50(2) transition ends
This transition reaches eligible generative AI systems already on the market on Aug 2, 2026.
Dec 2, 2027
High-risk systems
Stand-alone high-risk AI obligations apply (embedded systems follow Aug 2, 2028).
Code of practice
What the EU Code of Practice asks for
The Code of Practice on Transparency of AI-Generated Content, published in final form on June 10, 2026, operationalises Article 50. Its own words set a high bar, and concede the hard part. Encypher is built to address that technical gap.
“Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art.”
“no single marking technique suffices ... only an appropriate combination of marking techniques and associated detection mechanisms can allow satisfaction of those requirements.” Signatories “will implement a multi-layered marking approach ... with at least two layers of machine-readable marking.”
“given that free-form text cannot transport metadata, a single-layer of marking ... is considered sufficient.”
Quotations are excerpts from the EU Code of Practice on Transparency of AI-Generated Content, published as the final Code on June 10, 2026; ellipses mark omitted text. Source: European Commission.
That last line is the gap. Free-form text was assumed unable to carry a signed mark. Encypher carries a signed, tamper-evident mark inside the text itself, surviving copy-paste, using the C2PA standard for unstructured text, which we co-authored. Here is how the two-layer ask maps to what we provide.
The Code asks for
Layer 1: digitally signed, time-stamped, tamper-evident metadata
Encypher provides
C2PA manifest with a COSE signature and an RFC-3161 timestamp
The Code asks for
Layer 2: an imperceptible mark difficult to separate from the content
Encypher provides
Highly efficient text watermarking with provenance down to a single character, plus provenance embedding across supported image, audio, and video formats
The Code asks for
At least two layers of machine-readable marking
Encypher provides
Both layers in one API call, across many media types
The Code asks for
Free-form text "cannot transport metadata"
Encypher provides
A signed mark carried inside free-form text that survives copy-paste, via the C2PA standard for unstructured text
The Code asks for
Detection available free of charge to the public and researchers
Encypher provides
Free public verification in Provenance Chat and the sign-and-verify demo
The Code asks for
Marking and detection may be provided by third parties
Encypher provides
Encypher is that independent third-party provider
The gap the rules call too hard
Short text was treated as too hard to mark. We mark it.
The rulebook requires AI content to be marked “with the exception of very short text” (Sub-measure 1.1.2): short text was treated as too hard. That is the gap Encypher closes, marking short text so it can be checked later, invisibly, even down to a single sentence. It is not magic: if text is fully rewritten the mark can be lost. But it closes the exact gap the rulebook says is hard.
See it live
Watch it happen
Watch an AI model produce a response that is marked and independently verified, live. This helps demonstrate the Article 50 marking and detection obligations. It does not by itself guarantee compliance.
Expert referenceArticle 50 legal and implementation referenceFor counsel, policy, compliance, and engineering teams: provision-by-provision scope, machine-readable fields, integration patterns, timing, and evidence limits.
Regulation
The Regulatory Framework
The EU AI Act (Regulation (EU) 2024/1689) establishes a risk-based framework for AI regulation across the European Union. For content provenance, the relevant provisions are Article 50 (transparency obligations) and the supporting technical specifications.
Article 50 sets out four obligation sets, split between providers and deployers. The table below maps each subsection: who it binds, what it requires, and how Encypher relates.
| Provision | Who | What it requires | How Encypher relates |
|---|---|---|---|
| Article 50(1) | Provider | Systems that interact with people (chatbots, assistants, agents) must make clear the person is dealing with an AI. | Disclosure practice; Encypher provenance can document that a given output came from an AI system. |
| Article 50(2) | Provider | Systems generating synthetic audio, image, video, or text must mark outputs in a machine-readable format, detectable as AI-generated. | Encypher's core fit: C2PA manifests plus invisible text marking applied at the point of generation. |
| Article 50(3) | Deployer | Operators of emotion-recognition or biometric-categorisation systems must inform the people exposed to them. | Outside Encypher's product scope; a disclosure duty to track in your compliance map. |
| Article 50(4) | Deployer | Deep fakes must be disclosed as artificially generated or manipulated. AI-generated or AI-edited text published to inform the public on matters of public interest must be disclosed, unless a natural or legal person holds editorial responsibility for the publication. | Marked content carries its own disclosure record; the audit trail evidences what was published, when, and how it was marked. |
Note the split: the provider marking duty in Article 50(2) applies to synthetic output generally. The public-interest text scope belongs to the deployer disclosure duty in Article 50(4); it does not narrow the marking duty.
The EU AI Act applies to any organization providing or deploying AI systems to users in the EU, regardless of where the organization is headquartered. An American AI company with European users is subject to Article 50 requirements.
Marking
What Machine-Readable Marking Requires
The EU AI Act requires marking that is machine-readable, meaning it can be processed by software without human interpretation. A visible label saying "Generated by AI" satisfies transparency for human readers but does not satisfy the machine-readable requirement alone.
Machine-readable marking must be embedded in or attached to the content in a structured format that allows automated verification. The EU AI Act does not prescribe a specific technical standard, but the recitals reference interoperability and the importance of standards. C2PA is the industry consensus implementation.
A C2PA manifest embedded in AI-generated content records:
- That the content is AI-generated (action: c2pa.ai.generated)
- The generating system identity (AI model and version)
- Generation timestamp (tamper-evident)
- Content hash (detects subsequent modification)
- Publisher or deployer identity (organizational certificate)
This information is verifiable by any party - regulators, auditors, platform operators - using open-source C2PA libraries, without requiring access to proprietary systems.
Implementation
Article 50 Implementation Guide
Implementing Article 50 compliance with Encypher requires integration at the AI content generation step. The integration pattern differs by content type:
Text Content
After AI text generation, before publishing or distributing the content, call the Encypher signing API with the generated text. The API returns the text with embedded C2PA manifest markers. Publish the signed version. The manifest identifies the content as AI-generated and records the generation metadata.
Image Content
Pass the AI-generated image file to the signing API. The API returns the image with an embedded C2PA JUMBF manifest in the file container. Supported formats include JPEG, PNG, WebP, TIFF, AVIF, and HEIC. The manifest records the AI-generation action with generating system identity.
Audio and Video Content
Audio and video files are signed with C2PA manifests embedded in their container structures (ISO BMFF uuid boxes for MP4/MOV/M4A, RIFF chunks for WAV/AVI, ID3 GEOB frames for MP3). The manifest records the AI-generation event and generating system.
A single Encypher API integration handles all content types. SDKs for Python, TypeScript, Go, and Rust wrap the REST API. Batch endpoints handle signing at scale.
Penalties
Penalties
The canonical dates are in the timeline at the top of this page: Article 50 transparency obligations apply from August 2, 2026 for new systems, with a transitional period to December 2, 2026 for generative systems already on the market.
Penalties for non-compliance with transparency obligations run up to EUR 15 million or 3 percent of global annual turnover, whichever is higher. For large AI providers, the financial exposure is material.
Article 50 is in force. Teams with uncovered output should identify the gap, implement marking, and keep evidence of each check. The narrow transition for eligible existing systems ends December 2, 2026.
Creators
The Content Creators' Perspective
The EU AI Act's Article 50 requirements benefit human content creators as well as creating obligations for AI providers. When AI-generated content is marked, human-authored content that is not marked becomes distinguishable from it.
Publishers, journalists, and authors who sign their human-authored content with C2PA provenance create a documented distinction from AI-generated content. A news outlet with a signed archive of human-authored journalism can demonstrate the distinction between their original reporting and AI-generated summaries. This distinction has commercial value in an environment where readers increasingly want to know which content is human-authored.
The EU AI Act does not require human-authored content to be marked. But the availability of C2PA infrastructure creates the practical ability to make that distinction, and the incentive to do so grows as AI-generated content proliferates.
In practice
See how it works
Mark each AI output and keep an evidence trail a regulator or counsel can inspect.
Start free by hand: paste a piece of AI-generated text, mark it in one click, and keep the marked text, a ready-to-paste disclosure statement, and a downloadable per-content evidence record. When your team needs to mark at scale, Mark Compliance automates the same workflow through the API and SDK.
This Encypher-issued record states how the content was marked and verified. It is not a certificate from a government or regulator, proof of legal compliance, or legal advice. Confirm your obligations with qualified counsel.
Mark in action
One answer, signed sentence by sentence
Recorded from the live Provenance Chat. Every completed sentence passes through the signing session before it appears, and the disclosure panel opens the returned C2PA manifest: document ID, manifest ID, provenance ID, the c2pa.created action, and an IPTC algorithmicMedia source type. This machine-readable record supports the marking and disclosure workflow described by Article 50.
Try it in Provenance ChatThe recording shows Mark signing as content is generated. The five annotated steps below are the other path: the dashboard flow for text you already have, ending in the disclosure statement and per-content evidence record. It reads without video.
- 1
Paste your AI text
Drop in any AI-generated text. No setup, no API key.
- 2
Mark it in one click
Encypher embeds the machine-readable C2PA marking the EU AI Act Article 50 expects.
- 3
Get your marked text
Copy the marked text. The invisible marking travels with it and survives copy and paste.
- 4
Share the disclosure
A ready-to-paste AI disclosure statement and badge, generated for you.
- 5
Keep the evidence record
Download a per-content evidence record and open the public verify link.
Download the one-page walkthrough (PDF)
Free way to start
Mark AI content by hand
Paste, mark, and download a per-content evidence record. No API key to set up. Free covers 1,000 declared AI-output items and 5 Article 50 evidence records a month. The first application date is August 2, 2026.
Start Marking FreeWhat changes between plans
Format coverage, the trust chain, and public verification are the same on every row of this table. Volume, identity, and support are what a plan buys.
| Feature | Mark Trial | Starter | Standard | Growth | Enterprise |
|---|---|---|---|---|---|
| Formats on one Mark contract: text, images, audio, video, PDF, DOCX, XLSX, PPTX | 85+ | 85+ | 85+ | 85+ | 85+ |
| Signing original human publishing | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Public verification, no account required | |||||
| Declared AI-output items per month | 1,000 | 10,000 | 100,000 | 500,000 | Unlimited |
| Per-content Article 50 evidence records per month | 5 | Unlimited | Unlimited | Unlimited | Unlimited |
| Dedicated organization signing certificate | |||||
| RFC 3161 cryptographic timestamps | |||||
| CAWG identity certificate | Included, pending approval | Included, pending approval | Included, pending approval | Included, pending approval | |
| White-label identity, Encypher root CA key issuance | Paid add-on | Paid add-on | Paid add-on | Paid add-on | |
| High-volume batch signing, 100+ documents per request | |||||
| Full audit trail for compliance | |||||
| Support options subject to approved terms | Paid add-on | Paid add-on | Paid add-on | Paid add-on | |
| SSO (SAML, OAuth) and role-based access control | |||||
| Service levels and escalation terms defined in the approved enterprise contract | |||||
| Self-serve checkout, no sales call |
One Mark contract covers all 85+ formats in the matrix today, on every plan. DOCX, XLSX, and PPTX sign under C2PA 2.4 and verify version-agnostically. They are supported formats, not formal C2PA Conformance Program formats.
Signing original human publishing is unlimited under fair-use guardrails. The monthly allowance applies to declared AI-output items.
Every paid plan includes a free CAWG identity certificate, pending enrollment and program approval. It can assert organization identity, personal identity, and multiple editor or tenant identities within one manifest, and it adds to, rather than replaces, the C2PA claim signer.
White-label identity with a private signing key issued from the Encypher root Certificate Authority is a paid add-on for organizations that want tool identity alongside organization identity. Encypher issues these identity certificates rather than accepting customer keys, because signing certificates reach the C2PA Trust Lists only through the conformance program.
Signing ordinary publishing stays free and uncapped, and it is not one of these plans. The Mark Trial is the free way to evaluate AI-output marking: start free with 1,000 declared AI-output items and 5 Article 50 evidence records a month. Trial output is signed with the Encypher platform identity; a paid plan with an accepted identity proof adds your organization.
Starter, Standard, and Growth subscribe self-serve from $99/mo, no sales call. Paid plans add the Article 50 evidence dossier and a live coverage view on top of the table above. Talk to us for Enterprise terms: SSO, contract-defined service levels, and white-label identity.
Resources
Related Resources
Show the Article 50 evidence you have today
Start free by marking AI content by hand. Mark Compliance automates API and SDK marking at scale and gives your team an Article 50 evidence dossier with a live coverage view.