Skip to main content
Encypher Logo

EU AI Act Article 50 in plain words.

Since August 2, 2026, companies that build AI tools must mark AI output so software can tell it is AI-made. Companies that publish deepfakes must say so.

Mark one AI output freeRun the readiness check

A plain guide, not legal advice. Your counsel decides what applies to you.

Timeline of EU AI Act Article 50 and California AI Transparency Act dates from June 2026 to January 2028. A later California date, January 1, 2029, is not drawn.
EU AI ActEU AI Act: The European Union's law on artificial intelligence, which includes rules for marking AI-made content. Article 50Article 50: The EU AI Act rule that AI-made content be marked in a form software can read, and deepfakes disclosed. and the California AI Transparency ActCalifornia AI Transparency Act: California's law requiring generative AI providers to hide an AI disclosure in the images, video and audio they make or edit, and offer a free tool that reads it. run on one clock. Duties started in August 2026 and widen through 2028.

Key dates

  1. Guidance

    June 10, 2026: The final Code of Practice on AI content is out.

  2. Law

    August 2, 2026: Every Article 50 duty applies. New AI tools must comply from day one.

  3. Law

    December 2, 2026: Last day for older AI tools to add marking. Deployer duties were not delayed.

Who it applies to

Article 50(1): chatbots
ProvidersProvider: Under the EU AI Act, the company that builds an AI system or puts it on the EU market under its own name. of AI that talks with people must tell them it is an AI, unless that is obvious.
Article 50(2): AI output
Providers of tools that make audio, images, video, or text must apply machine-readable markingMachine-readable marking: A label software can read that says content was made or changed by AI.. Then software can detect the output as AI-made. This covers all such output, not only news.
Article 50(3): emotion and biometric systems
DeployersDeployer: Under the EU AI Act, a company that uses an AI system in its own work, such as a newsroom publishing AI-edited text. must tell people when these systems are used on them.
Article 50(4): deepfakes and public-interest text
Deployers must disclose a deepfakeDeepfake: Image, audio or video made or changed by AI so it looks real and could fool people.. They must also disclose AI text that informs the public, unless a person reviewed it and an editor is responsible for it.

A checklist for your team

Work through it with counsel. Each step names who usually owns it.

  1. Sort each AI tool.
    Are you its provider, its deployer, or both? The duties differ.
    Legal
  2. List what it makes.
    Text, images, audio, video, or a mix. Each type is marked a different way.
    Product
  3. Mark output where it becomes final.
    After the AI makes it, and before your product sends it out.
    Engineering
  4. Offer a free way to check.
    The public and researchers need a way to find the mark.
    Product
  5. Test the real path.
    Copy, paste, convert, and upload your output. See what survives.
    Engineering
  6. Keep the evidence.
    Store each marked output and its record next to your own logs.
    Compliance
  7. Add a notice people can see where 50(4) applies.
    Deepfakes and public-interest AI text need a visible disclosureManifest disclosure: Under California law before SB 1000, a label people could see that says content was made by AI..
    Editorial

What the Code of Practice asks

A file holds a signed label in four layers: who signed it, what they declared including AI use, a fingerprint of the content, and a signature that seals them together.
The label sits inside the file. It names the signer, carries what they declared, fingerprints the content, and is sealed by a signature.

The Code of PracticeCode of Practice on AI-generated content: The EU's voluntary rulebook on marking and labeling AI content, published in final form on June 10, 2026. is the EU's voluntary rulebook for Article 50. Signing it is one way to show you comply. For images, audio, and video it asks for two layers. One is a signed label, such as a C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it.. The other is an invisible watermarkWatermark: A mark placed in the content itself, visible or hidden, so it can be found again after the file is copied..

Text is different. Copied words do not carry file data, so the Code accepts one hidden mark inside free-form text.

"given that free-form text cannot transport metadata, a single-layer of marking ... is considered sufficient."Code of Practice, final Code, Measure 1.1

Where Encypher fits

Mark adds the label after your AI makes output and before you send it. You ship the text or file as usual. A public check shows the signer, the AI claim, the time, and whether anything changed. This content provenanceContent provenance: The record of where a piece of content came from and how it changed, carried with the content itself. record is from Encypher. It is not an EU certificate, and the AI Act does not require C2PAC2PA: The Coalition for Content Provenance and Authenticity: the group that publishes the open standard for content labels..

Free covers 1,000 signed outputs, AI or not, and 5 evidence records a month. Paid plans start at $99/mo, self-serve. Start free or try it in Provenance Chat.

Good questions.

Does Article 50 cover AI-generated text?
Yes. It covers text as well as audio, images, and video. The Code of Practice treats free-form text on its own track, with an exception for very short text.
We are outside the EU. Does it apply to us?
It can. A company outside the EU is in scope when its AI tool is sold in the EU or its output is used there.
When did Article 50 take effect?
On August 2, 2026. AI tools already on the market before then have until December 2, 2026 to add marking. Deployer duties were not delayed. Content made before August 2, 2026 needs no label after the fact.
What are the fines?
Non-compliance carries fines of up to EUR 15 million or 3 percent of global annual turnover. That is the Article 99(4) cap, whichever amount is higher. For small and medium firms, start-ups, and small mid-caps, the lower amount applies (Article 99(6) and 99(6a)).
Does C2PA guarantee compliance?
No. The AI Act names no technology. C2PA gives signed, standard labels for supported files, and Encypher adds a mark inside free-form text. Your team and counsel decide scope, exceptions, visible notices, and whether the whole setup meets the law.

Need terms for a large rollout? Talk to us.

Sources

  1. Regulation (EU) 2024/1689, consolidated text (CELEX 02024R1689-20260727) Law
  2. Regulation (EU) 2026/1744 Law
  3. Commission Guidelines C(2026) 5054 final Guidance, not binding
  4. Commission Q&A on Article 50 transparency obligations Guidance, not binding
  5. Code of Practice on Transparency of AI-Generated Content Voluntary

For engineers

Show the technical detail

Marking by content type

  • Text: call the signing API after generation. It returns the text with a hidden mark built on the C2PA standard for unstructured textC2PA text-provenance standard: The part of the C2PA standard that puts a signed label inside plain text, using invisible Unicode characters.. Publish the returned text.
  • Images: the API embeds a JUMBFJUMBF: JPEG Universal Metadata Box Format: the container that holds a C2PA label inside a media file. manifest in JPEG, PNG, WebP, TIFF, AVIF, or HEIC.
  • Audio and video: the manifest goes in the container, such as ISO BMFFBMFF: ISO Base Media File Format: the box structure behind MP4, MOV, HEIF and similar files. boxes for MP4, MOV, and M4A, RIFFRIFF: The chunk-based file layout behind WAV, AVI and WebP. chunks for WAV, and ID3ID3: The tag block in an MP3 file that holds its title, artist and other details. frames for MP3.

What the manifest records

A c2pa.created action, the digital source typeDigital source type: A field in the label that says how content was made: captured by a camera, made by AI, or a mix. trainedAlgorithmicMedia, the generating system, a signed time from a Time Stamp AuthorityTimestamp authority: An outside service that signs the time a record existed, so a signature stays checkable after its certificate expires., a hash of the content, and the signer's certificate. Open-source C2PA tools can read it without Encypher.

Limits

Full rewriting, character normalization, or an unsupported transform can remove a text mark. The check reports what it can verify and never turns missing evidence into a positive result. The final Code calls for marking free-form text over 200 tokens and excepts very short text; Encypher can mark shorter passages too, as extra coverage rather than a legal requirement.

Keep reading

Create. Mark. Endure.

Mark one AI output and inspect the evidence.

Mark one AI output freeRun the readiness check