The EU’s second draft Code of Practice on the marking and labelling of AI-generated content, issued on 5 March 2026, gives the clearest indication yet of how Article 50 of the AI Act will be enforced in practice. For providers and deployers, the draft is more than a consultation document. It is the closest thing currently available to an operational benchmark for transparency obligations.
What Article 50 covers
Article 50 requires that AI-generated or manipulated content — including text, audio, images and video — be marked in a way that allows users to recognise it as artificial. The obligation applies to both the providers of AI systems and the deployers that put them into use. Deepfakes, synthetic media and chatbot outputs are all in scope.
The Code of Practice translates these obligations into specific measures. It covers how content should be labelled, what technical methods are acceptable, and how responsibility is shared between the parties in the supply chain.
Why the second draft is the benchmark
Although the final code has yet to be formally approved, the second draft reflects extensive stakeholder input and is likely to be close to the final version. The Commission has made clear that approved codes of practice create a presumption of conformity with the AI Act. In practice, that means following the code is the safest and cheapest route to compliance.
Firms that wait for the final text risk running out of time to implement the necessary technical and design changes. Labelling requirements often touch core product features, export formats, APIs and user interfaces. These are not changes that can be made overnight.
Key practical expectations
Machine-readable labels. The draft emphasises technical signals such as metadata and provenance records that travel with the content. Visual watermarks alone are unlikely to be sufficient, particularly where content can be copied, cropped or transcoded.
Layered transparency. The draft supports a layered approach: a machine-readable signal for platforms and intermediaries, and a user-facing disclosure for the end consumer. Both layers need to work together.
Chain of responsibility. Providers must build labelling capability into their systems. Deployers must ensure the labels are preserved and displayed when content reaches users. Contracts between the two should be explicit about who does what.
Scope clarity. The obligation applies to content that could plausibly be mistaken for human-created. That is a broad category. Firms should not assume it only applies to photorealistic deepfakes or obvious synthetic media.
Steps to take now
Audit your generative outputs. Identify every product feature that produces or modifies content that an end user might encounter. Document what type of content is generated and where it appears.
Review your labelling technology. Check whether your systems can embed persistent, machine-readable markers and whether those markers survive common transformations such as screenshots, downloads and platform re-sharing.
Update user interfaces. Make sure disclosure happens at the point of use, not only in terms of service. Persistent labels, badges or notices are likely to be expected.
Prepare contract amendments. If you license generative AI technology or provide it to others, make sure responsibilities for marking and labelling are clearly allocated.
The bottom line
The second draft Code of Practice is the strongest signal yet of how Article 50 will be interpreted. Treating it as the implementation benchmark now will save significant time and rework once the final code is adopted.