An executive briefing for compliance officers, AI governance leads, and the counsels who advise them — the week of 22 June 2026.
1. What happened
On 10 June 2026 the European AI Office published the Code of Practice on Transparency of AI-Generated Content, the long-awaited implementation support instrument for Article 50 of the EU AI Act (European Commission; IPTC). It arrived after two public drafts — the second published 3 March 2026 — and in parallel with draft Commission guidelines on the Article 50 transparency obligations, which went through a targeted consultation that closed on 3 June 2026.
The Code is a voluntary instrument. It does not create new law; it offers providers and deployers of generative AI a structured way to demonstrate compliance with the marking and disclosure duties in Article 50(2) and 50(4). Its significance is not that it adds obligations but that it specifies, for the first time in an official document, the technical shape a regulator expects those obligations to take.
2. What it actually changes
For two years Article 50 has been clear on the "what" and silent on the "how." Providers must ensure AI-generated output is marked in a machine-readable way and detectable as artificially generated; deployers must disclose deepfakes and AI interaction. The recurring enterprise question was which technical approach would satisfy a supervisor. The Code answers it by describing a layered model: digitally-signed metadata (referred to in legal commentary as sub-measure 1.1.1), imperceptible watermarking placed alongside it (1.1.2), and an optional fingerprinting or logging registry (1.1.3) (ComplianceHub; Bird & Bird).
Two design choices carry most of the meaning. First, the Code is vendor-neutral on its face yet describes criteria — signed, time-stamped, tamper-evident — that, as of today, only the C2PA Content Credentials standard meets (Bird & Bird). In practice it sets a de facto technical floor without picking a winner. Second, it does not treat signed metadata as sufficient on its own: it pairs it with an imperceptible watermark. That pairing is an implicit acknowledgement of a known weakness — metadata is strippable and frequently lost when content is re-encoded or passed through platforms that do not preserve it (truescreen.io). The Code, in other words, describes defence-in-depth rather than a single labelling step.
What does not change is equally important. The Code is not mandatory, and signing it is not the only route to compliance — an organisation can meet Article 50 by other technical means and document them. But once major providers sign, their chosen approach tends to become the market reference, which raises the practical cost of going your own way.
3. Who is affected
Three groups, in descending order of immediacy. Providers of generative AI systems carry the marking obligation under Article 50(2) and are the primary audience for the signatory process. Deployers — enterprises that integrate or use those systems to generate content, including marketing, media, financial-services, and public-sector workflows — carry the disclosure obligations under Article 50(4), including the duty to label deepfakes and to tell users they are interacting with an AI. Downstream platforms and auditors inherit the verification problem: someone has to read and check the marks, and the Code's "detectable" requirement lands on them.
Geography does not narrow the set much. The obligations attach to systems and content placed on the EU market regardless of where the provider sits. In Spain, AESIA — headquartered in A Coruña — is the coordinating national authority, while Spain's own AI governance bill, approved by the Council of Ministers on 26 May 2026, remains in parliamentary process and is not yet in force. EU obligations apply on the EU timetable irrespective of the national bill's progress.
4. Implementation requirements
Four capabilities working together. A marking step that embeds digitally-signed, tamper-evident metadata — the C2PA-shaped layer. An imperceptible watermark applied in parallel, so a provenance signal persists when metadata is stripped. A verification path — a machine-readable way for a downstream party to check both signals and return a clear verdict, the element most current programmes under-build. And documentation and governance: a record of which systems generate what, which obligation attaches to each, and which date applies. The optional logging registry (1.1.3) sits on top for organisations that want a queryable provenance store.
The sequencing matters because instrumenting marking, watermarking, and verification across a real content pipeline is weeks of engineering, not a configuration change. With the obligations applying 2 August, the remaining window is a build window.
5. What to do this quarter
Four moves, in order. First, inventory: list every system that generates or manipulates content and map each to its specific obligation and date — marking (Art 50(2)), disclosure (Art 50(4)), or both. Second, decide the architecture now rather than after a standards debate; the Code has narrowed the choice to a layered, C2PA-shaped model. Third, decide on the signatory question before 22 July 2026, 18:00 CEST — the deadline to submit the form to appear on the initial signatory list published before 2 August (ComplianceHub). Fourth, instrument verification, not just marking, and test it adversarially: sign an output, re-encode and repost it, and confirm what survives.
One caution for board and counsel conversations: do not over-read the Digital Omnibus. The political agreement of 7 May 2026 deferred only the Article 50(2) machine-readable marking obligation, and only for generative systems already on the market before 2 August, to 2 December 2026 (Latham & Watkins; Gibson Dunn). The disclosure obligations remain live on 2 August. "The AI Act was delayed" is the wrong summary to act on.
6. AIACT50's reading
The Code is validating rather than disruptive for the architecture we build. The regulator has now described, in an official instrument, the layered model AIACT50 has shipped from the start: an invisible watermark, C2PA Content Credentials, Base anchoring, and a public verification API. The shift for the market is that "which architecture" is no longer an open debate — it has been narrowed to defence-in-depth, signed-plus-watermarked-plus-verifiable, and the only remaining questions are build and verification.
The piece the industry conversation still under-weights is that last word. The honest message to a compliance lead this quarter is not fear of a deadline; it is that the design problem is solved and the engineering problem is not — and six weeks is enough time only if the decision is made now.
A mark that no downstream party can independently check satisfies the letter of "marked" while missing the substance of "detectable." That is the half of Article 50 worth claiming, and the half worth building.
Sources: European Commission — digital-strategy portal · IPTC · Bird & Bird · artificialintelligenceact.eu — Article 50 · Latham & Watkins · Gibson Dunn · Travers Smith · ComplianceHub · truescreen.io · AESIA.
This briefing was prepared in degraded mode without the weekly Market Monitor; clause-level numbering (1.1.1 / 1.1.2 / 1.1.3) is drawn from secondary legal commentary and should be confirmed against the primary Code text before any clause is quoted in a binding context.
If you want to see how these layers are combined into a single implementation:
Explore AI Act 50 →