provemark
Article
Two Article 50 deadlines, and which one is yours
The machine-readable marking obligation in Article 50(2) of the EU AI Act has applied since 2 August 2026. The Digital Omnibus gave part of the market until 2 December. Which of those two dates binds you depends on one question — and if you answer it wrong in your own favour, you are already late.
Most of what has been written about this describes the obligation. This piece is about the calendar, because the calendar is where the decisions are. I have written separately about what the marking actually looks like, certificates and the valid-versus-trusted distinction, and the traps that cost me the most time. Assume the engineering is solved and read on.
The line that decides your date
The question is when your generative system was placed on the market, not when your content was produced and not when you started building.
| Your system was placed on the market… | Article 50(2) marking is due… |
|---|---|
| before 2 August 2026 | 2 December 2026 — a transitional period from the Digital Omnibus |
| on or after 2 August 2026 | from the moment it is placed on the market — no grace period at all |
Both dates are checkable, and worth checking rather than taking from me. The application date is Article 113 of Regulation (EU) 2024/1689: the AI Act applies from 2 August 2026 except for the chapters it lists, and Chapter IV — which is where Article 50 lives — is not among them. The transitional period comes from Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026. Note that it grants four months rather than naming a date; 2 December is the arithmetic.
The asymmetry is the part people miss. The transitional period is a concession to systems that already existed; anything you launch now inherits none of it. A feature that ships in September owes the marking in September.
There is one relief that runs the other way, and it is worth knowing because it removes a frightening amount of imagined work: content that entered circulation before 2 August 2026 does not have to be marked retroactively. The Commission's own guidance puts it plainly — "Content generated prior to 2 August 2026 does not need to be labelled retroactively" — while encouraging deployers to do it where they can. Your archive is not a compliance emergency. Your pipeline is.
What "machine-readable" rules out
A visible "AI-generated" badge in your interface is not what 50(2) asks for. The obligation is that the output itself carries a marking that a machine can detect — a property of the file, travelling with the file, surviving the trip to somewhere you do not control.
In practice that means embedded provenance, and in practice that means C2PA. Concretely it
is one assertion: a c2pa.created action carrying the full IPTC
digitalSourceType URI for trained algorithmic media, signed into the asset. That
single assertion is what a verifier reads. The
marking article shows the exact shape, including
the two ways it is commonly written wrong.
Watch the boundary between obligations. Article 50(2) is about machine-readable marking of synthetic output. The duty to disclose to a person that they are looking at AI-generated content is a different paragraph with a different test. Solving one does not discharge the other, and a vendor who tells you it does is selling you half a control.
The certificate is the critical path, not the code
This is the part that reorders a project plan, and it is the reason I would not wait until October.
Signing works on day one with test certificates. What test certificates do not give you is trust: every verifier will report the signature as valid and the signing credential as untrusted, which is a distinction I have written about at length. Closing that gap needs a production Claim Signing Certificate, and the C2PA certificate policy says those are issued only to Generator Products that have passed the Conformance Program.
There is no application fee and no external audit at the entry level. What there is, is calendar time. You supply a security architecture document on their template, sample output for every media type you claim, and a legal agreement signed on behalf of the company. In my experience that last item — finding the person with signing authority and getting it through them — is the step that consumes weeks, and it is entirely unaffected by how fast your engineers are. The route and what it costs has the detail.
Count backwards from 2 December and that is roughly sixteen weeks. The engineering is days. The paperwork is the long pole. Start them in parallel, today, in that order of worry.
What I would do this month
- Establish which date binds you, in writing, with the market-placement date of each generative feature you ship. If you have several, they may not share a date.
- Start the conformance conversation now, before the implementation is finished. Nothing about it is blocked by unfinished code, and the legal signature is not something you can compress later.
- Get marking working end to end with test certificates. Build, sign, read back, verify. Prove the chain, then swap the certificate when it arrives.
- Audit what happens to your files after signing. This is where most implementations quietly fail: any re-encode, resize or metadata rewrite downstream invalidates the manifest, and your CDN or image pipeline may be doing it without anyone deciding to.
- Decide where the signing key lives before you are in a hurry. A key inside the web application is a different risk profile than a key in an isolated signing service, and that decision is expensive to revisit once it ships.
What this article is not
It is not legal advice, and I am not your lawyer. Dates, scope and the exact reach of the transitional period are questions for counsel who can look at your specific system and how it is placed on the market. What I can tell you with confidence is the technical shape of the obligation and where the schedule risk actually sits, because that is the part I have built.
Marking your output does not make you compliant. It implements one control that the obligation requires. The obligation stays with you.