Machine-readable marking under Article 50(2): the technical implementation checklist

Since 2 August 2026, providers of generative AI systems must ensure their outputs are marked in a machine-readable format and detectable as AI-generated or manipulated — Article 50(2) of Regulation (EU) 2024/1689. Systems already on the market before that date get one extra window, until 2 December 2026 (European Commission FAQ on Article 50; see the live countdown). This guide is the engineering view: what the law actually demands, how the three technique families compare, and a checklist you can hand to your team. Not sure Article 50(2) even applies to you? Run the free 3-minute check first.

What the law actually demands

Article 50(2) sets a results standard, not a named technology. Marks must be effective, reliable, robust and interoperable — “as far as technically feasible”, taking into account the specificities and limitations of the content type, the costs of implementation and the generally acknowledged state of the art. The Commission's Guidelines on Transparency of AI-Generated Content (July 2026) flesh this out, and the Code of Practice on Transparency of AI-generated Content (Section 1) is the Commission-recognised pathway for providers to demonstrate compliance. Two consequences for engineers:

• A visible caption is not enough. “AI-generated” text burned into a corner of an image is human-readable. Article 50(2) wants marking that software can detect. (Visible labels belong to the separate deployer duty of Article 50(4) — see how to label AI content.)
• Perfection is not required — a defensible technique is. The feasibility and state-of-the-art qualifiers acknowledge that no mark survives every transformation. What you must be able to show is that you picked an established technique appropriate for the content type and deployed it consistently.

The three technique families, compared

1. Provenance metadata — C2PA Content Credentials

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open specification for cryptographically signed provenance manifests embedded in the file. A manifest can declare the content AI-generated, name the generator, and is tamper-evident: any modification after signing breaks the signature.

• Interoperability: strongest of the three.An open, vendor-neutral standard with a public trust model and free verification tooling — exactly the “interoperable” property Article 50(2) names.
• Weakness: stripping. Metadata can be removed by re-encoding or by platforms that strip file metadata on upload. The C2PA spec addresses this with durable bindings (watermark-linked manifests), and pairing with an invisible watermark is the common mitigation.
• Effort: low. Mature open-source tooling exists (c2patool and SDKs), or you can sign via a hosted API — one POST request per image, with a free playground to try it.

2. Invisible watermarks

Watermarking embeds an imperceptible statistical signal in the pixels, waveform or token distribution itself. Because the mark lives in the content rather than alongside it, it survives metadata stripping and, depending on the scheme, moderate cropping, compression or re-recording.

• Robustness: strongest — but proprietary.Detection typically requires the watermarker's own detector, so interoperability is weaker than C2PA. Most large model providers ship watermarking for images and audio; several publish detector APIs.
• Weakness: no open cross-vendor standard yet. If you rely on watermarking alone, document which scheme, detector access, and false-positive characteristics — that documentation is your evidence.
• Effort: depends. If you build on a foundation-model API that already watermarks outputs, verify it and record it. If you self-host open-weight models, you must add a watermarking or signing step yourself.

3. Plain file metadata (EXIF/XMP/IPTC)

Writing “AI-generated” into standard metadata fields (e.g. the IPTC DigitalSourceType value trainedAlgorithmicMedia) is machine-readable and trivially cheap — but unsigned and lost on the first re-encode.

• Use as a supplement, not the backbone.Unsigned fields can be edited or removed without trace, so they are weak on the “reliable and robust” criteria. They cost minutes to add and improve detection by platforms that do read them.

What to use per content type

• Images:C2PA manifest at generation time (+ IPTC fields), plus provider watermarking where available. This is the best-served modality — our C2PA guide covers the standard in depth.
• Video:C2PA supports video manifests; pair with the generator's watermark. Mark at final render, not per frame batch.
• Audio: C2PA manifests in supported containers plus audio watermarking; for streaming voice (e.g. voice agents), disclosure at the start of the interaction also engages Article 50(1)/(4) — see the voice-agent guide.
• Text: the hardest case, and the law knows it. Statistical text watermarking exists but is less mature and easily weakened by paraphrasing; there is no embedded-metadata standard for plain text. Practical approach: watermark where your stack supports it, mark machine-readably at the delivery layer where you control it (e.g. HTML metadata, HTTP headers, API response fields), and document why full robustness is not yet feasible — that is exactly what the state-of-the-art qualifier is for. Note the exemptions below, and remember the separate deployer duty for published public-interest text under Article 50(4).

What you do not have to mark

Per the Commission's FAQ and guidelines, the marking duty does not cover, among others:

• outputs communicated exclusively machine-to-machine and processed automatically without human exposure;
• AI performing an assistive / standard-editing function (the guidelines give practical examples of where standard editing ends);
• short sequences of numbers, symbols or letters, and source code;
• outputs used only in closed-loop industrial or product development environments(unless they are the final output), and a narrow business-to-business / industrial-context exemption where the guidelines' conditions are met.

The implementation checklist

1. Inventory generative outputs. Every surface where your product emits synthetic audio, image, video or text that can reach EU users — including white-labelled and API-delivered outputs.
2. Classify each surface against the exemptions above and record the reasoning.
3. Check your model suppliers. If you build on third-party generation APIs, establish what marking they already apply (watermark? C2PA? none?) and get it in writing — the vendor due-diligence guide has the exact questions.
4. Add signing at your boundary. For images the cheapest robust step is embedding a C2PA manifest before delivery — via one API call or self-hosted tooling.
5. Verify marks survive your pipeline. Thumbnails, CDN re-encodes and format conversions are where manifests die. Test end to end.
6. Align with the Code of Practice (Section 1) or document your equivalent measures — providers that do not adhere to the code must demonstrate compliance by alternative adequate means.
7. Keep dated evidence. Marking you cannot prove does not exist for an auditor. Run the free check to generate a dated obligations report, and see what an evidence pack should contain — paid plans automate the recurring part.

What non-compliance costs

Breaches of Article 50 obligations carry fines up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)(g)) — enforced by national market surveillance authorities since 2 August 2026 (Commission: enforcement framework of the AI Act). See who enforces the AI Act in each country and your theoretical maximum exposure.