Contents7
An illustration generated for a campaign, a synthetic voice in a training video, a product visual retouched by AI: since 2 August 2026, this content falls under the AI Act’s transparency rules. For tools that already existed before that date, the marking obligation falls due on 2 December 2026, the same day as two new prohibitions.
This guide from our Business AI section is based on the consolidated text of the regulation after its July 2026 revision. It is not legal advice: for a sensitive campaign, have your case checked by your DPO or a lawyer.
In short
The provider of the generative tool marks the content, in a machine-readable way; the 2 December 2026 deadline applies to it.
A business that publishes a deepfake, or AI-generated text that informs the public on a matter of public interest, must disclose it, unless the text has been reviewed by a person under editorial responsibility.
A European code of practice, published on 10 June 2026, details both roles and offers disclosure icons.
A watermark detector points to provenance; the absence of a watermark does not prove that content is authentic.
Who must mark, who must disclose?
Article 50 of the AI Act splits the work between two players, which we defined in our guide to the AI Act and the GDPR for SMEs:
From generator to reader: who does what
- The provider marks
The tool that generates the image, video, audio or text embeds a machine-readable mark in the content.
- The deployer discloses
The business that publishes a deepfake tells its audience, clearly.
- The public checks
A detection tool can read the mark and show where the content comes from.
For the provider, Article 50(2) requires outputs to be “marked in a machine-readable format and detectable as artificially generated or manipulated”, with solutions as effective, interoperable and reliable as technically feasible. The obligation does not cover a tool that only assists with standard editing or does not substantially alter what the user gives it.
For the business that publishes, paragraph 4 covers two cases:
- deepfakes: generated or manipulated image, audio or video that could pass for authentic; for a work that is evidently artistic, satirical or fictional, it is enough to disclose its existence without hampering the work;
- text published to inform the public on matters of public interest: it must be disclosed, unless it has undergone human review and a person holds editorial responsibility for it.
The information must be given “at the latest at the time of the first interaction or exposure”, and remain accessible. The question of text, which is subtler, is covered in AI-written text: should you disclose it?
Why 2 December 2026?
The revision of the AI Act adopted in July 2026 added to Article 111 a grace period for tools already on the market:
- 10 June 2026
The Commission publishes the final code of practice on marking and labelling.
- 2 August 2026
The transparency rules of Article 50 apply, to providers and deployers alike.
- 2 December 2026
End of the grace period for marking, for generative tools placed on the market before 2 August 2026.
- 2 December 2026
Two new prohibitions apply, on intimate images generated without consent and on child sexual abuse material.
The two prohibitions of the same day target systems whose intended purpose this is, or that produce such content foreseeably without reasonable safeguards, under Article 5. They concern tool vendors more than their users, but a prohibited use remains prohibited for everyone.
What does the European code of practice recommend?
The law says what, the code of practice says how. The Commission published it on 10 June 2026; it is voluntary, but the Commission and the AI Board have found it adequate to demonstrate compliance.
The code’s official page: two sections, providers and deployers, and a link to the European disclosure icons. Captured on 19 October 2026.
Its first section asks providers for at least two layers of machine-readable marking where necessary (metadata, watermark or another technique) and a detection method open to users, authorities and media, according to the analysis by law firm Jones Day. The second lets deployers use the EU icon or an equivalent label, and an audio disclaimer when a visual label is impossible.
sections: marking by providers, disclosure by deployers
companies and organisations had signed by the end of July 2026, approximately
What a detector proves, and what it does not
On 7 October 2026, Google opened SynthID Detector to everyone; it looks for its watermark in an image, a video or an audio file. According to Le Monde Informatique, it recognises content from Google’s tools and from partners that use the same mark, including OpenAI, NVIDIA and Kakao, but it is “not a universal detector”: content from another tool may escape it, and a result remains “a clue to provenance”, not “absolute proof”.
Watch out
The absence of a mark does not prove that content is authentic. Heavy editing can erase a watermark, and not every tool uses the same one. A detector helps check an image you receive; it replaces neither the source nor the judgement of the person who publishes.
What your business can check by 2 December
- List your generative tools.
Images, video, voices, text: including those built into your design software or your CRM.
- Ask each vendor how it marks.
Which technique, since when, and whether it signed the code of practice; the list of signatories is public.
- Spot your deepfakes.
A realistic face, the voice of a real person, a scene that could pass for real: those must be disclosed.
- Write the review rule.
Who reviews generated text published to inform, and who signs off editorial responsibility for it.
- Choose the label.
The EU icon or a clear notice, in the same place on every publication.
From the field
On this blog, every article prepared with AI starts as a draft and is only published after review by a person who takes responsibility for its content; it has been a written rule of our content engine since a client had to take down pages generated without checks. And our covers, including this one, are drawn in code, object by object, never generated: a decision taken on 12 October 2026, which settles the question of their marking in advance.
What it changes for a team of 20 to 500 people
Most of the technical work falls to tool vendors. Your part is a publishing rule: know which content is generated, disclose what could mislead, and have the rest reviewed by someone accountable for it. It is one more line in your policy, for which we offer a basis in enterprise AI governance, and it fits the approach described in our guide to integrating AI in a business. The risk did not wait for the regulation, as our analysis of AI as a disinformation machine or a remedy recalls.
Marking is only one of the deadlines. The full timetable, revised in July, is explained in what the Digital Omnibus changed in the AI Act, and our October AI news for leaders sums up the rest of the month, from Meta’s terms on crawling websites to the postponed NIS2 law in France. To choose tools whose guarantees you know, our AI at the right cost offer starts from your actual uses.
Frequently asked questions
Must an AI-generated image used in an advert be marked?
Technical marking is the job of the tool that generated it: it is the provider’s obligation. You must also disclose the image if it is a deepfake, that is, if it could pass for a real photo of a person, a place or an event. An evidently imaginary illustration is not covered by that obligation, but your policy may choose to disclose it anyway.
What exactly changes on 2 December 2026?
Two things. Generative tools placed on the market before 2 August 2026 must have the machine-readable marking required by Article 50 in place. And two prohibitions apply: systems designed to generate intimate images of a person without consent or child sexual abuse material, or that foreseeably produce them for lack of reasonable safeguards.
Does text written with ChatGPT need a notice?
Only if it is published to inform the public on matters of public interest, and the obligation falls away if a person has reviewed the text and holds editorial responsibility for it. A reviewed and signed product page or blog article is therefore not covered. The tool’s provider, for its part, must mark its text in a machine-readable way.
Can SynthID Detector prove that an image is authentic?
No. It detects the watermark of Google and its partners; it does not see other tools’ marks, and heavy editing can erase a watermark. A positive result is a serious clue to provenance. A negative result proves nothing: trace the image back to its source before publishing it.
Sources
- Article 50(2) (new tab)ai-act-service-desk.ec.europa.eu
- Article 111 (new tab)ai-act-service-desk.ec.europa.eu
- Article 5 (new tab)ai-act-service-desk.ec.europa.eu
- The analysis by law firm Jones Day (new tab)jonesday.com
- Le Monde Informatique (new tab)lemondeinformatique.fr
Jim · founder of Brain Plus AI
Also in business ai
Stepping back8 min
Should you disclose that a text was written by AI?
Transparency owed to the reader, or a detail of how the text was made, like a spell checker? The EU AI Act settles it only halfway, with a criterion that is useful well beyond the law: does a human answer for the text?
Understand7 min
Digital Omnibus: what changed in the AI Act
Regulation (EU) 2026/1744, in force since 27 July 2026, revised the AI Act: high-risk rules postponed, AI literacy relaxed, two more prohibitions, relief extended to mid-sized companies. What changes, what does not, and the updated timetable.
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.