Executive briefing · week of 14 September 2026. All regulatory claims verified against public sources, cited inline.
1. What happened
Two things converged this month, and neither is a new rule. First, the European Commission's Code of Practice on Transparency of AI-generated Content moved from signature to operation: the AI Office is launching two signatory task forces in September 2026, drawing on the roughly 190 organisations — Anthropic, Google, Meta, Microsoft, Mistral, OpenAI, Synthesia among them — that had signed by the end of July (European Commission). Their remit is to share implementation practice, feed back on transparency measures, and advance the state of the art for Article 50 marking.
Second, the deadline structure created by the Digital Omnibus on AI (Regulation (EU) 2026/1744) has settled into place, and with it a widespread misreading. The Omnibus kept Article 50's transparency obligations applicable from 2 August 2026 but extended the machine-readable marking requirement under Article 50(2) to 2 December 2026 for generative systems already on the market before 2 August (Mayer Brown; Usercentrics).
2. What it actually changes
Less than the shorthand suggests. The only Article 50 duty that moved is machine-readable marking of pre-existing generative systems (50(2)) — and only that duty, and only for systems already on the market on 2 August 2026. New systems placed on the market after that date are not covered by the extension.
Everything else in Article 50 applies now. The obligation to inform people when they interact directly with an AI system (50(1)) took effect on 2 August 2026. The obligation on deployers to disclose deepfakes and other synthetic content (50(4)) took effect on the same date (artificialintelligenceact.eu). The task forces do not change any of these dates; they shape how the marking duty is met in practice, which is a different question from when it binds.
The practical change, then, is a narrowing of scope dressed up in the market's telling as broad relief. An enterprise that hears "AI transparency moved to December" and stands down has misread a four-month extension of one clause as a reprieve on the whole article.
3. Who is affected
Providers of generative AI systems carry the marking duty (50(2)) and the design duty to make AI-generated output detectable. Deployers — any organisation that publishes AI-generated or AI-modified content, or operates an interactive AI system facing the public — carry the disclosure duties (50(1) and 50(4)). In practice most enterprises are deployers, and many are both. The deployer duties are the ones already in force, which means the population with a live obligation this quarter is far larger than the population watching the December marking date.
For Spanish organisations there is a named counterparty. AESIA is the national competent authority under the Regulation, and the national AI bill that sets the domestic sanctioning regime is in parliamentary processing (regulatoryai.eu; White & Case). The obligations are European; the supervision is increasingly local.
4. Implementation requirements
Three duties, met three ways. For 50(1), interactive systems — chatbots, voice agents, assistants — must make plain to the user that they are dealing with a machine; this is a design and copy task, and it is due now. For 50(4), deployers publishing synthetic media must attach a disclosure at the point of publication; this requires a reliable way to determine that a given asset is AI-generated or modified, which in turn means reading provenance rather than trusting a manual checkbox. For 50(2), providers must embed machine-readable marks so that output can be detected as artificial; the industry's answer is now legible — Content Credentials (C2PA) for signed provenance plus an invisible watermark such as SynthID that survives editing and format changes (OpenAI).
The layer most enterprises underestimate is the read side of 50(4). Generation-side marking is being commoditised by the model providers; verification and disclosure at the deployer's publishing pipeline is not something those announcements deliver. Google bringing C2PA verification to Chrome and Search points in the right direction but stops at the consumer's browser, not the enterprise's workflow (c2paviewer.com).
5. What to do this quarter
Read Article 50 as three clocks and act on the two that already run. Audit interactive systems for a clear AI-interaction notice (50(1)). Put a disclosure step into every publishing workflow that can emit AI content, backed by automated provenance verification rather than human memory (50(4)). Only then turn to the December marking date (50(2)), and treat it as the deadline for evidence you have been generating all along, not the moment to begin. Where possible, adopt the layered architecture the Code task forces are converging on — signed provenance, an invisible watermark, and a verification path you can call programmatically — because building to that model now is cheaper than retrofitting to whatever the task forces formalise. For Spanish deployers, add one line to the plan: assume AESIA is the authority that will ask.
6. AIACT50's reading
The market has resolved the generation-side question and left the deployment-side question largely open. Providers now emit provenance; enterprises still cannot reliably read and disclose it at the moment they publish, which is exactly where Article 50(4) places the obligation and exactly where the near-term compliance exposure sits. AIACT50 is built for that layer — Content Credentials and invisible watermarking underneath, a Base L2 anchor for an auditable record, and a public verification API at the point of deployment — because the half of Article 50 that the industry's announcements skip is the half that binds most enterprises today.
Sources: European Commission — Code of Practice backing · European Commission — Article 50 FAQ · Mayer Brown — Digital Omnibus · Usercentrics · EU AI Act — Article 50 · OpenAI — Advancing content provenance · C2PA Viewer · regulatoryai.eu — AI Act Spain · White & Case — AI Watch Spain.
If you need to read provenance and disclose it at the moment you publish — the deployer side of Article 50(4):
Explore AI Act 50 →