Skip to content
Kennmarq.com, home
Menu

2 December 2026: AI systems already on the EU market must mark what they make

· Reviewed by Angelo Lamonaca

In short

  • Who: providers of AI systems that generate images, video, audio or text, wherever they're based, when the output is used in the EU (Art. 2(1)(c)).
  • When: since 2 August 2026 for systems placed on the market from that day; by 2 December 2026 for those already on the market before it (Art. 111(4)).
  • What: outputs marked in a machine-readable format and detectable as AI-made (Art. 50(2)). The Code of Practice asks for two layers, signed metadata and an imperceptible watermark, and a free detector.
  • Fines: up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher; for SMEs and start-ups, whichever is lower (Art. 99(4) and (6)).

The law: Article 50(2), and a date for systems already on the market

The EU's AI Act (Regulation (EU) 2024/1689) asks whoever provides a generative AI system to mark what it makes. Article 50(2):

“Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.”

AI Act, Article 50(2)

Article 50 has applied since 2 August 2026 (Art. 113). The Digital Omnibus on AI (Regulation (EU) 2026/1744) then gave systems that were already on the market more time: their providers have until 2 December 2026 to take the steps Article 50(2) needs (Art. 111(4)).

How to do it is set out in the Commission's Code of Practice on transparency of AI-generated content, final since 10 June 2026. Signing it is voluntary, but the Commission and the AI Board have confirmed it as an adequate voluntary tool to show compliance with Article 50's transparency duties. Our guide to Article 50 goes through it step by step.

The problem: two marks on every file, and a way for anyone to check them

Marking isn't one setting. For audio, images, video and text in a file, the Code asks for at least two layers of machine-readable marking, as long as no single technique is reliable enough on its own (Measure 1.1):

  • Digitally signed metadata recording that the content is AI-generated or manipulated.
  • An imperceptible watermark in the content itself, which the Code calls a robust mechanism to complement the signed metadata: metadata can be lost when a file is converted or re-uploaded, a watermark is made to stay.

Providers also commit to a detection solution, made available free of charge (Measure 2.1), and to a ban in their terms or documentation on removing or tampering with the marks (Measure 1.2).

For a team whose product is the AI app, that means signing keys and certificates, a time-stamp service, a watermark model for each kind of file, a detector people can use, and tests that the marks hold up. A system launched before August has to have all of it running by 2 December.

The risk: fines up to 3% of worldwide turnover

Article 50's duties are among those the AI Act fines most heavily after its outright bans:

  • Up to EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(4)(g)).
  • For SMEs and start-ups, each fine is capped at whichever of the two is lower (Art. 99(6)).

Those are ceilings. The dates aren't: a system placed on the market since 2 August 2026 has had to mark from its first day, and every system already on the market before then has to by 2 December 2026.

Who's affected

The duty is the provider's: whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Art. 3(3)). Where the provider is based doesn't matter when the output is used in the EU (Art. 2(1)(c)). That can take in, for example:

  • Apps that turn prompts or photos into pictures: image generators, AI photo editors, headshot and avatar apps.
  • Video generators, and editors that create or change clips with AI.
  • Voice, speech and music generators.
  • Products built on open models such as FLUX or Stable Diffusion, run in ComfyUI or behind your own API: the model may come from someone else, but if the app carries your name, you are likely its provider.
  • Services that run generators for their users: model APIs like Replicate and fal, generation sites like CivitAI.
  • Text generators: Article 50(2) covers text too, where the Code accepts a watermark alone for free-form text.

Not covered: AI that only assists with standard editing, or doesn't substantially change the input or its meaning (Art. 50(2)). Deployers who publish deep fakes have a duty of their own, a visible disclosure (Art. 50(4)).

The same day: two new bans

The Omnibus also added two prohibited practices to Article 5, applying from 2 December 2026 (Art. 113(a)): AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts or sexual activity without that person's explicit consent (Art. 5(1)(ba)), and AI systems that generate child sexual abuse material (Art. 5(1)(bb)).

A provider is caught where that is the system's intended purpose, or where the system makes it a reasonably foreseeable and reproducible outcome without reasonable and adequate safeguards to reliably prevent it (Art. 5(1a)). Breaking an Article 5 ban costs up to EUR 35 million or 7% of worldwide annual turnover (Art. 99(3)).

Our safety check screens a picture for both before you mark or publish it, with published error rates. It's a risk signal that helps you meet those safeguards, not a guarantee.

Why Kennmarq.com

One API call on every generation or edit adds both layers the Code names: a signed, time-stamped C2PA manifest saying the file is AI-made, and an invisible watermark (TrustMark in pictures, Video Seal in clips, AudioSeal in songs whenever the sound can hold it). Text isn't marked yet; that's planned for March 2027. Anyone can check a file for free with the checker or the verify endpoint: the free detection the Code asks for.

Running ComfyUI in production? Swap Save Image for the Mark & Save Image node (Video and Audio nodes too): with your API key, every output leaves ComfyUI with the watermark and signed Content Credentials. Install it from the ComfyUI Registry with comfy node install comfyui-kennmarq, or search "Kennmarq.com" in ComfyUI-Manager; the ComfyUI guide has the setup.

Name the markets you serve and each file gets what their laws ask for, with a receipt per law; we check every country's labelling rules each week. Every feature is free up to 1,000 marks a month: start with the quickstart.

Kennmarq.com helps you meet these rules; it doesn't take over your duties. You stay the provider of your AI system, and deciding what is a deep fake, what your terms say and what your users are told stays with you. This article explains the law as we read it on 4 November 2026; it isn't legal advice.

How this was produced: drafted with AI from government sources, first EUR-Lex, Regulation (EU) 2024/1689 (AI Act), and checked against them by Angelo Lamonaca before publishing.

On the law map

Every country's rules, and what one call covers for each kind of file: Germany, France, Italy on the map, and every country's laws side by side. The law's page: EU AI Act, Article 50. Step by step: EU AI Act, Article 50.

Sources