AIACT50 weekly · week of 12 October 2026. Why 2 December is really two deadlines — and why 2 February is the one that decides whether you built it right.
For most of the year, compliance teams working on the EU AI Act's content-transparency rules were pointed at a single date: 2 August 2026, when Article 50 began to apply. It did apply, and the regime is live. But the date that now shapes the fourth-quarter plan is 2 December 2026 — and it is not one deadline. It is two, arriving on the same day and asking for entirely different work.
Deadline one: marking
The first is a marking deadline. Under the AI Digital Omnibus — Regulation (EU) 2026/1744, which amended the AI Act — generative AI systems placed on the market before 2 August 2026 were given until 2 December to meet the Article 50(2) obligation to mark their synthetic outputs in a machine-readable form. Systems launched after August had no such window and were expected to mark from the start. For teams running models that predate the summer, this is the engineering task to finish before the year ends: outputs a machine can recognise as AI-generated. A failure here sits in the AI Act's general penalty tier of up to €15 million or 3% of worldwide turnover.
Deadline two: the new prohibitions
The second is not a marking task at all. The same Omnibus added new prohibitions to the Act, and they also take effect on 2 December: a ban on AI systems that generate non-consensual intimate imagery, including “nudifier” applications, and on AI-generated child sexual abuse material. No provenance tool discharges this obligation, because it is not a disclosure duty. It is a line. The risk for communicators and compliance leads alike is to let the shared date blur the two together — marking is something you do with technology, the prohibitions are something you make sure you are not doing at all.
Look past December: 2 February 2027
Keeping them separate is the first half of a clear-headed December. The second half is looking past December entirely. The Code of Practice on transparency, which the Commission and the AI Board found adequate in July, asks its signatories — roughly 190 of them — to put interoperable detection in place by 2 February 2027. Interoperable detection is a harder problem than marking your own output. It means the markings you apply can be checked by third parties without forcing them to query every provider's detector in turn. And it is where a December-only mindset becomes expensive. The Cloud Security Alliance has warned, plainly, that a marking scheme adopted just to clear December may need re-implementation within about eight weeks to meet February's bar.
Why the gap is real
There is a technical reason this gap is real rather than bureaucratic. Signed metadata — the C2PA manifest most teams reach for first — is necessary and also fragile. A resize, a re-encode, or a simple screenshot strips it. In August, a researcher demonstrated a forged Content Credential passing on Android, an issue Google declined to fix; a camera maker revoked certificates after a vulnerability in one of its models.
A marking that satisfies a December checklist can still be gone by the time someone needs to verify it, and can still fail February's interoperability test.
Build it once
That is the argument worth carrying into the quarter, and it is an architecture argument, not a fear one. Provenance that lives only in a manifest is one screenshot from disappearing. What survives is a durable, anchored record of origin and a public way to verify it that does not depend on the metadata staying intact. Build that layer in December, and February is a date you have already cleared rather than a second project. Build the disposable version first, and you build it twice.
Provenance that survives a screenshot: a durable, anchored record of origin and a public way to verify it.
Explore AI Act 50 →