EU AI Act Article 50: What the AI Image Labelling Rules Actually Require

From 2 August 2026, AI-generated images must carry machine-readable marking. Who it binds, what counts, and the grace period.

From 2 August 2026, providers of AI systems that generate synthetic images, audio, video or text must mark those outputs in a machine-readable format so they are detectable as AI-generated. The obligation falls on the provider of the generating system, not on every person who shares a file. Content created before that date does not need retroactive labelling.

There is also a grace period that has been widely misreported, so let's go through it properly.

Key Takeaways

• Article 50 applies from 2 August 2026 and covers synthetic image, audio, video and text outputs.
• The requirement is machine-readable marking, meaning provenance metadata or an embedded watermark that detection tools can read.
• Systems already on the market before that date have until 2 December 2026 to meet the machine-readable marking requirement, under the AI Omnibus provisional agreement of May 2026.
• Content generated before 2 August 2026 is not covered retroactively.
• The obligation is not limited to high-risk systems. It applies to any AI system used in the situations Article 50 describes.

Who the rule actually binds

The most common misreading is that Article 50 makes you personally responsible for labelling every AI image you post. It does not.

The marking obligation in Article 50(2) sits on providers of AI systems that generate synthetic content. That is OpenAI, Google, Adobe, xAI, Stability and their peers. They must ensure their outputs carry machine-readable marking indicating artificial generation.

A separate obligation in the article covers deployers in specific situations, including deep fakes, where disclosure to people viewing the content comes into play. That is a transparency duty about telling the audience, distinct from the technical marking duty on the provider.

So if you generate an image with a compliant tool and share it, the marking should already be in the file. Your obligations depend on context and on what you are doing with it, not on a blanket duty to label everything.

The official Article 50 text is short and worth reading directly, and the European Commission publishes guidance on transparency obligations.

What "machine-readable" means in practice

The regulation is deliberately technology-neutral. It requires that outputs be marked in a machine-readable format and detectable as artificially generated, without mandating one specific mechanism.

In practice two families of technique meet that description.

Provenance metadata, principally C2PA Content Credentials. A cryptographically signed manifest attached to the file recording that it was AI-generated, by what, and when. This is what most major providers have adopted, and it is the approach Adobe, OpenAI and others already ship.

Embedded watermarks, such as Google's SynthID, which encode a signal inside the pixel data itself rather than in metadata.

The two have opposite failure modes, which is why serious implementations use both. Metadata survives editing but is destroyed by recompression and easily stripped. Pixel watermarks survive metadata stripping but degrade under heavy editing.

We covered the trade-off in SynthID explained and in C2PA Content Credentials and how to verify them.

The grace period people keep getting wrong

Here is the detail that matters for anyone tracking compliance dates.

The obligations apply from 2 August 2026. But the AI Omnibus provisional agreement reached in May 2026 gives generative AI systems that were already on the market before that date until 2 December 2026 to satisfy the machine-readable marking requirement under Article 50(2).

That is a transition allowance for existing deployments, not a general postponement. New systems placed on the market from August 2026 are expected to comply from the start.

Separately, and importantly, content generated before 2 August 2026 does not require retroactive labelling. The billions of AI images already in circulation stay unmarked, permanently.

That last point has a direct consequence for detection, which we will come to.

Why this does not solve the detection problem

If every AI image carried a compliant marker, verification would be trivial. Read the marker, done. That is not the world this creates, for four reasons.

The back catalogue is exempt. Everything generated before August 2026 stays unmarked.

Non-EU and open-source systems. A locally run open-weights model on someone's own hardware is not going to attach compliant credentials, and enforcement against a self-hosted deployment outside the EU is limited.

Metadata is fragile. Platform recompression routinely strips C2PA manifests as a side effect. An image can be compliant when generated and unmarked by the time you see it, with nobody having acted maliciously.

Absence proves nothing. Because of the three points above, an image with no marker tells you almost nothing. Most genuine photographs carry no credentials either.

So the practical position after August 2026 is unchanged in one crucial respect: you still cannot conclude anything from missing metadata, and pixel-level analysis remains the thing that actually answers the question. We made that argument in detail in whether removing C2PA makes an image undetectable.

What this means if you publish images

Three practical consequences.

If you generate images commercially for EU audiences, check that your tooling produces compliant marking, and check that your publishing pipeline preserves it. A CMS that recompresses uploads can strip compliance out of your workflow without anyone noticing.

If you verify images, treat credentials as corroboration rather than as the test. Present and valid is meaningful positive evidence. Absent is not evidence of anything.

If you moderate or curate, build the workflow around pixel analysis with provenance as a secondary check. Our free AI image detector does both: it reads C2PA provenance when present and analyses the pixels independently, returning a confidence score and a region heatmap showing which parts of the image drove the result. Analysis runs on-device so the image never leaves your browser, One image scan costs 1,000 credits, which is the whole starting grant on a free account.

What compliant marking looks like in practice

The regulation is deliberately technology-neutral, which leaves a practical question: what actually satisfies it?

Article 50 itself requires marking in a machine-readable format such that outputs are detectable as artificially generated. It does not name a mechanism. Two families of technique are in general use, and they fail in opposite ways.

Provenance metadata. the C2PA specification defines a cryptographically signed manifest attached to the file, recording what generated the content and when. This is what most major providers have adopted. Its weakness is fragility: the manifest lives in a file segment that ordinary recompression destroys, so a compliant image can arrive at a viewer stripped of its marking with nobody acting maliciously.

Embedded pixel watermarks. Google's SynthID documentation describes encoding a signal inside the image data. Its strength is that metadata stripping does not touch it. Its weakness is degradation under heavy editing and aggressive recompression.

Serious implementations use both, because each covers the other's failure mode.

There is an unresolved question underneath all of this that the regulation does not answer. Marking establishes that content is synthetic when the marking survives. It establishes nothing when the marking is absent, because absence has many innocent causes: a platform re-encode, a screenshot, an exempt pre-August-2026 file, or a generator outside the regulation's reach.

That asymmetry is permanent. It means Article 50 makes positive identification easier without making negative identification possible, and detection tooling remains necessary for exactly the cases where marking failed.

Anyone building a verification workflow for 2027 should design around that asymmetry rather than hoping the regulation closes it.

FAQ

When does EU AI Act Article 50 take effect?

2 August 2026, with systems already on the market given until 2 December 2026 to meet the machine-readable marking requirement.

Do I have to label AI images I post personally?

The marking obligation sits on providers of the generating system. Separate disclosure duties can apply to deployers in specific situations such as deep fakes.

Does it apply retroactively?

No. Content generated before 2 August 2026 does not require labelling.

What counts as machine-readable marking?

The regulation is technology-neutral. C2PA Content Credentials and embedded watermarks such as SynthID are the mechanisms in general use.

Does Article 50 only apply to high-risk AI?

No. The transparency obligations apply to any AI system used in the situations the article covers, regardless of risk classification.

The practical upshot

Article 50 makes marking the default for new synthetic content in Europe. It does not make unmarked images suspicious, and it does not make detection unnecessary, because the exemptions and the fragility of metadata leave a very large gap.

Check images at GPTOne and read the heatmap alongside the provenance.

Meta description: From 2 August 2026, AI-generated images must carry machine-readable marking. Who it binds, what counts, and the grace period.