Marking AI-generated content: what Europe requires since August 2026

Since 2 August 2026, a product that generates content with AI and reaches users in the European Union carries two new, checkable obligations: mark that content in a machine-readable format, and tell the person when they are interacting with a system. Checkable is the word that changes the work — these are verified by opening a file with a metadata inspector, not by reading a privacy policy.

Many teams read the July headline — “Europe delays its AI rules” — and shelved the topic. The delay is real. It does not cover this.

What was deferred in July and what was not

Regulation (EU) 2026/1744, adopted on 8 July 2026, published in the Official Journal on 24 July and in force since 27 July, moved the high-risk dates:

• Stand-alone Annex III systems: Chapter III obligations move to 2 December 2027.
• AI embedded in regulated products (Annex I): to 2 August 2028.
• Article 50 (transparency): not deferred. It applies from 2 August 2026.

The single concession for transparency is a four-month transition: generative systems already on the market before 2 August 2026 must comply with marking as from 2 December 2026. Content created before August needs no retroactive labelling. If your product was already shipped, the date that matters is weeks away, not a year.

What Article 50 requires, exactly

Four obligations, split between whoever builds the system (provider) and whoever puts it into operation (deployer). The distinction is not academic: it decides which of your teams does the work.

1. Direct interaction (provider). Tell the person they are dealing with an AI system from the start of the first interaction, clearly and distinguishably, unless it is obvious to a reasonably well-informed person.
2. Machine-readable marking (provider). Synthetic audio, image, video or text must be marked and detectable as artificially generated or manipulated.
3. Emotion recognition and biometric categorisation (deployer). Inform the people exposed to the system.
4. Deepfakes and public-interest text (deployer). Disclose a deepfake upon first exposure at the latest; label generated text published on matters of public interest.

The marking exceptions are narrow and worth knowing before you over-build: short sequences of numbers, letters or symbols; source code; machine-to-machine outputs with no human exposure; closed-loop industrial environments; and assistive functions for standard editing. A style corrector does not trigger marking. A product-image generator does.

Does it apply if my company is in Bogotá with no European office?

Yes, if the system output is used in the Union. The regulation reaches providers established outside the EU when the output produced is intended to be used in the Union. The test is where the result lands, not where the company is registered or the server sits.

In practice that catches more Latin American companies than expect it: the SaaS with customers in Spain, the software factory delivering a module to a European brand, the agency producing creatives for a campaign in Germany. Invoicing from Colombia does not change the analysis.

What “machine-readable marking” means once you have to write it

The standard the industry already implements is C2PA. Its Content Credentials specification defines a manifest: a set of assertions about the file, a claim that gathers them, and a digital signature made with the signer’s key. So far, familiar cryptography.

The architectural decision sits in how the manifest binds to the content. The spec distinguishes two:

• Hard binding: a cryptographic hash identifying the whole asset or a portion of it. Precise and brittle — any re-encode invalidates it.
• Soft binding: an identifier that is not statistically unique — a fingerprint of the content — or one embedded inside the content itself, such as a watermark.

The second kind is what holds the obligation up in the real world, and the spec says why: a Durable Content Credential is one whose soft binding allows the manifest to be discovered in a repository even after it has been separated from the asset. Translated into production: metadata gets stripped. The first platform that re-encodes your image to serve a thumbnail leaves the file with no manifest. An implementation that only writes metadata complies inside your bucket and stops complying the moment a user shares.

Where you put it matters as much as what you put. Marking belongs at the generation boundary, not the presentation layer: the endpoint that produces the file signs it before responding. Leave it to the frontend and every new consumer — mobile app, webhook, export with attachments, a client integration — silently breaks compliance again, and nobody notices because no test looks at that.

What if the model is not mine?

That is the majority case in LATAM: your own product on top of third-party models. The marking obligation falls on the provider of the system that generates the content, and if you integrate a model and publish the result under your brand, that provider is you. You inherit the technical capability of the layer below, not the responsibility.

Check what your provider actually marks and in which modalities. SynthID, for instance, embeds imperceptible watermarks in image, video, audio and text, designed to survive cropping, filters, frame-rate changes and lossy compression; in audio, added noise, MP3 compression and speed changes. That robustness is exactly the property the regulation asks for, and it is a property you measure rather than declare.

The practical test: generate a file through your pipeline, push it through the same re-encoding your own CDN performs, and check whether it is still detectable. A contract stating “we comply with the AI Act” is not evidence. A file carrying a verifiable credential is.

What about generated text?

This is the obligation teams miss most often, because text does not feel like “synthetic content”. Article 50(4) requires labelling generated or manipulated text published to inform the public on matters of public interest — politics, administration, justice, rights, security, health, environment, consumer safety, cultural or scientific developments — unless it went through human review or editorial control with someone accountable for it.

The Commission sets the bar: human review means deliberate examination by a person with knowledge of the subject, and editorial control implies authority to approve, alter or reject. Running a spell-checker does not qualify. For a team with a regulatory newsletter, a corporate blog or support answers about health and safety coming out of a model, the decision is binary and has to be made per flow: either you document editorial control, or you label.

Is signing the code of practice worth it?

The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026, drafted by independent experts in a process facilitated by the AI Office. It is voluntary, the Commission and the AI Board consider it an adequate instrument to demonstrate compliance, and by late July 2026 around 190 organisations had signed. Anyone who does not sign must demonstrate compliance by other adequate means and accepts more scrutiny.

The code imposes no specific technology: it requires the technical solution to be effective, interoperable, robust and reliable as far as technically feasible, given the acknowledged state of the art. In engineering terms: you choose between content credentials and watermarking, but you have to show it survives real file handling.

On 20 July 2026 the Commission also adopted its guidelines on transparency obligations, with definitions and examples for the concepts that get argued about most. They are non-binding, and they are still the document national market surveillance authorities will use to decide whether you comply.

What does getting it wrong cost?

Penalties for breaching Article 50 reach up to 15 million euros or 3% of total worldwide turnover, enforced by national market surveillance authorities rather than a single European office.

The cost that arrives first, though, is commercial. A European client’s vendor questionnaire already carries the question, and the answer that closes it is a file produced by your system with its verifiable credential attached. Teams that have it solved clear that filter in one call; the rest open a three-month project in the middle of a negotiation.

Where we would start on a Monday

1. Inventory the generation points. Every endpoint, job or integration producing content a person will see. There are usually more than the team remembers: avatar generation, the automatic report summary, the support assistant.
2. One marking point. At the generation boundary, shared. That is the difference between one change and fifteen, and between a detectable regression and silent non-compliance.
3. Classify each flow as provider or deployer. It decides whether the duty is to mark or to disclose, and which team implements it.
4. A test that fails. Generate, re-encode the way your CDN does, verify the mark is still detectable. Without that test, compliance lasts until the next refactor of the image pipeline.
5. Traceability. Record which version of which model produced each marked output. The auditor’s question is not “do you have a policy?” but “where did this specific file come from?”.

And one date in the calendar: if your generative system was already on the market before 2 August, marking is due on 2 December 2026.

How we help at Athrun Data Intelligence

A 30-minute call to review your generation points and tell you which ones fall under Article 50 and which do not — including the uncomfortable answer that your case is out of scope and you need to do nothing. If it fits, we implement marking at the generation boundary, with the robustness test that keeps it true over time.