EU AI Act · Article 50
"This is AI" — put it in a form
machines can read.
The EU has notified that the deepfake disclosure rule under AI Act Article 50 enters enforceable phase next month. A plain "AI-generated" caption is not enough: providers must embed machine-readable provenance metadata — C2PA, SynthID, or an equivalent — into images, video, audio, and text. Any EU-facing product touching synthetic media has until next month to re-plumb its pipeline.
What Changed
Two years of grace end next month
Of the AI Act that entered force on 1 August 2024, the "synthetic media disclosure" carve-out came with a two-year grace period. That grace ends next month.
The trigger is Article 50. Duties fall on both providers of generative models and deployers who distribute the output. Providers must "mark the output as AI-generated in a machine-readable format." Deployers — social platforms, media, ad networks, ed-tech, banks, chatbot vendors — must "disclose to end-users that the content is AI-generated." The European Commission's digital-strategy page now spells out both duties in parallel.
The words "machine-readable" are load-bearing. A human-visible watermark that reads "made with AI" is not enough. Downstream verifiers must be able to check authenticity automatically, which effectively narrows implementations to C2PA (Content Credentials), Google DeepMind's SynthID, or OpenAI's image-watermarking family.
Stop pasting stickers on synthetic media —
dissolve provenance into the file.
How It Works
Three stages: generate → embed → verify
Fixing only the surface where content is served is not enough. The label has to be baked in at generation time.
Bake provenance into the generation SDK
If you own the model, add the embed step to the generation pipeline. If you call OpenAI, Anthropic, or Google, preserve — don't strip — the provenance metadata their SDKs already return. Adobe and the major platforms drive the C2PA consortium.
Show a human-visible "AI-generated" label at the surface
Deployment UIs must state clearly that content is AI-generated — screen-reader-friendly, not colour-only, icon + text.
Retain audit logs for six months
You must keep audit-grade logs of labelling, editing, and removal. If a C2PA signature is stripped in your pipeline, liability slides to the deployer.
Why It Matters
From "good-faith label" to "regular provenance"
The voluntary-labelling era of 2023–2025 ends here. "We already say AI-generated" stops being a defense.
Vendors could get through 2023 and 2024 by adding a caption. From next month, adding a caption is not compliance. The requirement is compatibility: the label has to be readable by the ecosystem's verifiers. Pipelines that cannot emit a C2PA or SynthID equivalent by next month move to the front of the enforcement queue.
The money matters too. For readers used to the GDPR frame: Article 50 caps transparency-obligation fines at 3% of global prior-year turnover or €15M, whichever is higher. Less than GDPR's 4% / €20M, but the covered surface — anyone offering a synthetic-media feature to EU users — is wider.
Who Feels It
Who this hits — and how
Per persona, the daily-work impact from next month.
Business / PM
Any EU-facing generative feature has three choices by next month: pull the feature, exclude EU from the addressable region, or implement C2PA / SynthID. Article 50 uses "substantive EU nexus" as the test, so an English-only UI with EU revenue is very likely in scope.
Marketers
Ad creative built with AI needs its provenance metadata retained from asset to final cut. Video is the trap: After Effects, Premiere, and DaVinci frequently strip C2PA on export. Freeze your export presets this month.
Engineers
Most compliance work is "don't strip what the SDK already returns." The trap is your own image-processing layer — a resize or re-encode kills C2PA. Add CI tests that follow provenance across the generate → save → serve chain.
Caveats
Three grey zones the text does not fully close
Even as enforcement starts, the regulation and the reality still don't line up on three points.
1) Text. Watermarks for images, audio, and video are technically mature; watermarking text is not. Long-form generative text can carry statistical marks; short-form (headlines, Slack replies, form emails) resists recovery. Practical answer: a two-layer scheme — "provider-declared metadata" + "app-side UI disclosure."
2) Liability when calling a US API. Whether Article 50 applies extraterritorially to OpenAI or Anthropic themselves, or whether the calling EU SaaS carries the load, is not settled. Contracts today lean toward the deployer, so review your provider agreements this month.
3) Verifier interoperability. C2PA and SynthID are different specs; a file without both may be flagged "unsigned" by one of them. Multi-labelling (C2PA + SynthID + provider metadata) becomes the working standard from next month.