Provenance, watermarking, and the August 2026 deadline

There is a date every operator shipping into Europe needs on the calendar. On August 2, 2026, the transparency obligations of Article 50 of the EU AI Act begin to apply.

Article 50 requires disclosure when a person is interacting with an AI system, disclosure of deepfakes, meaning AI-generated or manipulated image, audio, or video of real people or events, and machine-readable marking of AI-generated synthetic content so it can be detected as artificial. The marking obligation is the one that reaches into the generation pipeline itself, because it asks that your output carry a signal a machine can read.

One nuance to watch. A provisional measure known as the AI Omnibus, agreed in mid-2026, would give systems already on the market before August 2 until December 2, 2026 to meet the machine-readable-marking requirement. Treat that grace period as pending rather than settled law until the final text lands.

The industry answer is converging on two layers. C2PAC2PA (Content Credentials)An open provenance standard, backed by Adobe, OpenAI, and Microsoft, that attaches cryptographically signed metadata proving a file's origin, though the metadata strips easily when a file is re-encoded. Content Credentials attach signed, tamper-evident metadata describing how a file was made; Google's SynthIDSynthIDGoogle's watermarking system, which embeds an identifying signal in images, audio, video, and text it generates. embeds an invisible watermark into the pixels or audio samples themselves. At Google I/O in May 2026, Google announced it is bringing SynthID and C2PA verification into Search and Chrome, so a viewer can check provenanceProvenanceA verifiable record of how a piece of media was made and by whom, increasingly required so that synthetic content can be traced. in the browser, and OpenAI joined the C2PA steering committee the same month and committed to embeddingEmbeddingA list of numbers that represents the meaning of a word, image, or concept in a form the model can compute with. Similar things sit close together in this numeric space. SynthID alongside Content Credentials. The C2PA specification is being standardized as ISO/IEC 22144.

For an operator this is market access, not optional hygiene. If your generated media reaches EU users you need disclosure and machine-readable marking in the output path, and you want provenance metadata to survive post-production rather than being stripped on export. Build it in now. Retrofitting marking after a launch is painful and, after August, late. And it is not only EU law that will ask for it: customers in regulated industries such as journalism, legal, and medical increasingly require provenance metadata as a condition of use, regardless of jurisdiction.