The EU AI Act's Article 50 transparency rules went enforceable on August 2,
2026.
If you ship a generative AI feature that touches EU users, you now owe the regulator a machine readable marking on your output.
The obvious shortcut, drop a C2PA manifest and call it done, does not survive contact with production.
Here is what actually works, with the code to make it real.
The Two Layer Reality Article 50(2) requires effective, interoperable, robust, and reliable marking.
The EU Code of Practice interprets that as at least two layers: signed metadata (C2PA) plus imperceptible watermarking (SynthID or equivalent).
Fingerprinting is optional layer three.
The reason for two layers is not bureaucratic.
It is a screenshot.
C2PA lives in a JUMBF metadata box.
X strips it on upload.
CDNs strip it during optimization.
Screenshots destroy it entirely.
Microsoft admitted this openly in its February 2026 Media Integrity report: preventing every attack on provenance is not possible.
Invisible watermarks embedded in the pixel content survive those operations but carry very little information.
You need both.
Generating a Signed C2PA Manifest (Node) Two things to notice.
First, the field is what auditors will actually search for; the IPTC value is the standard flag for AI generated content.
Second, the timestamp authority URL is not optional if you want long term verifiability.
A signature without a trusted timestamp is only as good as your certificate lifetime.
Embedding SynthID (Python, Vertex) If you are already on Google's Imagen or Veo stack, SynthID is applied automatically on generation, and you can verify it via the Vertex AI API.
If you are running Stable Diffusion or Flux locally, you need to add an equivalent scheme yourself.
Here is the Vertex path.
Detection is not binary.
SynthID returns a confidence score, and you set the threshold.
For compliance logs, log the raw score, not just the verdict.
When a regulator asks how you know your marking survived a compression, you want the numbers.
Deployer Disclosure Middleware Article 50(4) puts the disclosure obligation on the deployer.
If you serve generated content in a product, you have to attach a human perceivable cue at the point of consumption.
This should be middleware, not a per-endpoint decision.
The header is machine readable, the banner is human perceivable.
Both are required for a defensible position under Article 50(4).
The Detection Endpoint You Owe Yourself The regulator will not just require that you mark content.
They will ask you to prove your marking works on your own output.
Build the endpoint before you need it.
Log every call.
When a national authority asks for proof, "our compliance rate this quarter" should be a SELECT statement, not a scramble.
Two Gotchas People Are Missing The Article 50(2) grace period expires December 2,
2026.
If your system was on the market before August 2, you have four months to add the machine readable marking.
Systems launched after August 2 owe it from day one.
The August 2 immediate obligations were the deployer disclosure and chatbot rules under 50(1) and 50(4).
Rolling your own watermark is a strategic mistake.
The EU is standing up a public detection capability aligned with the Code of Practice, which is drafting toward SynthID compatible schemes and C2PA compliant manifests.
If your custom scheme is not in that reader, your marking is not effectively detectable, and "effectively detectable" is one of the four adjectives in the statute.
Fine Math Up to 15 million euros or 3 percent of global annual turnover, whichever is higher.
For a startup at 10 million ARR that ships an unmarked generated image feature to EU users, worst case is 15 million euros.
For a company at 5 billion ARR, worst case is 150 million euros.
The gap between the effort to comply (a sprint) and the exposure (a quarter of ARR) is the largest asymmetry in AI regulation right now.
Ship List for This Week Wire C2PA signing into your image, video, and audio generatio