Executive briefing — the week of 15 June 2026.
1. What happened
On 10 June 2026 the European AI Office published the final Code of Practice on Transparency of AI-Generated Content (European Commission). The Code is a voluntary, soft-law instrument, prepared through a multi-stakeholder process facilitated by the AI Office. Its purpose is narrow and practical: to help providers and deployers of generative AI systems meet the transparency obligations of Article 50 of the AI Act, which apply from 2 August 2026 (artificialintelligenceact.eu).
Voluntary does not mean optional in effect. As Bird & Bird and others have noted, the Code is designed to become the de facto compliance benchmark for both providers and deployers ahead of the August application date (Bird & Bird). Adherence is the cleanest available evidence that an organisation has taken reasonable steps to comply; departure from it will need to be justified.
2. What it actually changes
Until last week, Article 50(2) read as a principle: providers of generative AI systems must ensure outputs are marked in a machine-readable format and detectable as artificially generated. The Code converts that principle into a checkable specification.
Marking (Measure 1.1). Providers are directed to combine two machine-readable mechanisms — digitally-signed, time-stamped metadata (sub-measure 1.1.1) and imperceptible watermarking (sub-measure 1.1.2) — with an optional third mechanism of fingerprinting or logging against a registry database (sub-measure 1.1.3) (IPTC technical analysis, 10 Jun 2026). The Code names no vendor and no specification. But IPTC, the news-media standards body, was direct: "while it is not named specifically, the only technology that meets these criteria is C2PA." The signed-metadata requirement, in practice, points to Content Credentials, with CAWG assertions encouraged for richer provenance.
Non-removal (Measure 1.2). Signatories commit to retain, and not intentionally strip, existing metadata markings when content is used as input and transformed by their system — and to prohibit users, via terms and conditions, from removing those markings.
Detection (Commitment 2). Signatories must make a detection system publicly available, free of charge — as a published standard, as software, or as a cloud API — so members of the public can check whether content was generated by their system, even after metadata is stripped. This is the part of the Code that moves transparency from "marking your own output" to "letting anyone verify it."
Interoperability (Measure 3, deadline 2 February 2027). The Code openly acknowledges that no current technical solution meets all four of the AI Act's criteria — effective, reliable, robust, interoperable — and frames its commitments as work towards that goal. Concretely, providers must implement an interoperability solution for their detection mechanisms by 2 February 2027, using a publicly available interoperable standard or a "publicly readable signpost" that tells the public which detection solution to use without running every provider's detector in turn (IPTC).
Labelling (Section 2, deployers). Deployers commit to visually disclose AI-generated markings using a common set of icons supplied by the AI Office, with disclosure rules calibrated by modality — persistent icons for video, fixed icons for images, audible disclaimers for audio — and lighter-touch disclosure for evidently artistic, satirical, or fictional work (Tech Policy Press).
3. Who is affected
Two roles, two obligation sets. Providers — those who develop or place generative AI systems on the market under their own name (foundation-model developers, AI application vendors, organisations that substantially modify a system) — carry the marking and detection obligations. Deployers — any organisation using a generative AI system in a professional capacity — carry the labelling and disclosure obligations. Purely personal, non-professional use is out of scope; there, responsibility sits with the platform (Tech Policy Press). In practice, almost every enterprise touching generative content is one role or the other, and many are both.
4. Implementation requirements
A compliant provider pipeline, read off the Code, needs four things in place: signed Content Credentials on generated outputs; an imperceptible watermark robust to common manipulations; ideally a durable log or fingerprint so provenance survives metadata stripping; and a free, public detection endpoint. By 2 February 2027 that detection must be interoperable — routable without querying every provider individually. Deployers need a disclosure layer: the AI Office icon set, applied per modality at first exposure, with documented internal processes to classify content and exercise human oversight, and the exceptions for creative and satirical work handled deliberately rather than by default.
5. What to do this quarter
Four concrete steps. First, take Measure 1.1 and test it against what your generation pipeline emits today — not what your vendor's datasheet claims. Second, calendar three dates, not one: 2 August 2026 (Article 50 applies), 2 December 2026 (the Digital Omnibus grace period for generative systems already on the market to meet machine-readable marking, per the 7 May 2026 provisional agreement — Consilium, CMS), and 2 February 2027 (interoperable detection). Third, scope the detection endpoint now; it is the layer most teams have not budgeted, and it has the longest lead time. Fourth, if you operate in Spain, read AESIA's published guidance — Spain has Europe's first operational AI supervisor and a sanctions framework reaching €7.5m or 1% of global turnover for transparency breaches, though no Member State had issued an AI Act fine as of March 2026 (White & Case).
6. AIACT50's reading
The Code did not invent a new architecture. It ratified the layered one the industry has been assembling — signed metadata, imperceptible watermarking, a durable record, and public verification — and it did so in functional language that maps cleanly onto a four-layer stack: invisible watermark, C2PA Content Credentials, an anchored log, and an open verification API. The layer the market has under-served is the last one: free, interoperable, public verification, the subject of the barely-discussed 2 February 2027 deadline. That is where the work is, and it is where we build.
One caution we will keep repeating, because the Code itself models it: provenance verifies origin and satisfies Article 50 transparency. It is not moderation, and it is not a deepfake cure. The honest sale is the architecture, not the fear.
Sources: European Commission — Code of Practice announcement · IPTC technical analysis (10 Jun 2026) · Bird & Bird · Tech Policy Press · Consilium (Omnibus, 7 May 2026) · CMS — Digital Omnibus · artificialintelligenceact.eu — Article 50 · White & Case — Spain tracker
If you want to see how these four layers are combined into a single implementation:
Explore AI Act 50 →