AIACT50 weekly · week of 29 September 2026. The August date was the start line. The technical obligation arrives in December.
For most of this year, the EU AI Act's transparency rules were a countdown. Since 2 August 2026 they have been something less dramatic and more demanding: a live obligation with a staged transition. The distinction is worth getting right, because it decides which teams are exposed this quarter and which are not.
Live since 2 August
Here is what actually changed. Article 50's transparency obligations became enforceable on 2 August, on schedule — not delayed, not deferred. Providers of AI systems that interact directly with people must disclose the AI. Providers of generative systems must embed machine-readable markings in synthetic audio, images, video and text. Deployers must label deepfakes and AI-generated text on matters of public interest. Non-compliance carries administrative penalties of up to €15 million or 3% of worldwide turnover, and the rules reach any organisation whose outputs land in front of EU users, wherever the company sits.
The date that matters now: 2 December
But the date that matters most right now is not August. Generative systems already on the market before 2 August were given a transition window to implement the machine-readable marking. That window closes on 2 December 2026. A second, quieter deadline follows on 2 February 2027, when providers must offer detection tools with watermark-detection interoperability. So the teams most at risk today are the ones that treated the August date as the finish line and shipped a disclosure banner. The harder, technical obligation — marking outputs so they can be read and verified downstream — arrives in December.
The deployer has been talking to an empty room
Two developments from the summer sharpen the picture. First, the AI Office's Code of Practice on Transparency of AI-generated Content, published at the end of July and confirmed adequate by the Commission, drew roughly 190 signatories. The revealing detail is the split: the section covering deployer labelling attracted 192 signatories, while the section covering provider marking attracted 95. The obligation, in other words, is concentrated where most enterprises actually operate — as deployers of someone else's model, not as model-makers. Most coverage this quarter has been about the providers. The deployer has been talking to an empty room.
One technique is not enough
Second, the Code mandates a layered approach — digitally signed metadata and imperceptible watermarking — and it is explicit about why: no single technique satisfies robustness, reliability, interoperability and effectiveness at once. This is the part the market keeps eliding. The industry shorthand is that embedding a watermark or a content credential at generation closes the obligation. The regulation's own reasoning says otherwise, and so does the field evidence: provenance metadata is routinely stripped by uploads, screenshots and re-encoding, and the standards community is candid that a missing credential is not proof of anything.
You can mark content flawlessly and still be unable to demonstrate its provenance weeks later, after it has travelled.
The question to ask before December
That reframes the question every compliance and governance team should be asking before December. It is not “did we mark it.” It is “can it be verified — by someone who isn't us, later, after distribution.” Marking is the easy half. Durability and independent verifiability are the half that does not fix itself in a sprint, and they are what the February interoperability deadline will test.
The regulation is technology-neutral; it names no specific standard, and no vendor's architecture is a legal requirement. But the shape it describes — mark, and make the mark durable and checkable — is now a Q4 procurement decision rather than a 2027 planning note. Sixty-five days is enough to treat 2 December as a plan. It stops being enough somewhere in November.
Sources: Baker Botts, Sep 2026 · Faegre Drinker, Jul 2026 · European Commission — Code of Practice backing · Goodwin, Aug 2026 · eyesift — C2PA status 2026 · CSA — watermarking deadline
Mark, and make the mark durable and checkable — content-provenance architecture for Article 50:
Explore AI Act 50 →