The EU Code of Practice on AI-generated content
The Code of Practice on Transparency of AI-Generated Content turns Article 50 into concrete measures. For providers, it asks for two marking layers, a free detector, tested quality and documentation. Here is each measure, and what one Kennmarq.com call covers.
In short
- What: the Commission-backed code for Article 50: Section 1 for providers (four commitments, 17 measures), Section 2 for deployers' labels.
- Status: voluntary. The Commission found it adequate on 8 July 2026: signatories are supervised mainly on whether they follow it; others must show other adequate means.
- Section 1's core: signed, time-stamped metadata plus an imperceptible watermark, free detection, robustness tests, and interoperable watermark detection by 2 February 2027.
- Kennmarq.com: both layers, free detection with signed results, input marks kept, and public documentation you may reuse.
Checked on 24 October 2026. This page explains what Kennmarq.com does; it isn't legal advice.
Who it's for, and what signing does
- Providers of generative AI systems sign Section 1; deployers who publish deepfakes, Section 2. Vendors of marking and detection tools may sign too, so their customers can rely on them.
- Signing is voluntary, and following the Code isn't conclusive proof of compliance. But after the Commission's positive Opinion, signatories are supervised mainly on whether they follow it, and following it can lower a fine (Art. 99(7)).
- Who has signed: about 190 organisations by the Commission's count, among them OpenAI, Google, Meta, Microsoft, Anthropic, Mistral and Black Forest Labs.
- Relying on a vendor is allowed: the marks may be added by the provider, an upstream model or a specialised vendor, and the provider stays responsible (Measure 1.1).
Section 1, measure by measure
| Measure | The Code asks | Kennmarq.com |
|---|---|---|
| 1.1.1 Signed metadata (required) | Record that the content is AI-generated or manipulated, signed and time-stamped so tampering shows; keep the keys secure; leave out sensitive data | C2PA Content Credentials, signed with keys kept in AWS KMS and time-stamped (RFC 3161); nothing personal in them |
| 1.1.2 Imperceptible watermark (required) | A mark that is hard to separate from the content, the robust complement to the metadata | TrustMark, Video Seal or AudioSeal, read back from the finished file before it leaves |
| 1.1.3 Fingerprinting or logging (optional) | A supplement to the two layers, never enough alone | Not needed for the two-layer rule |
| 1.2(a) Keep the marks of inputs | Keep the metadata marks of content your system transforms, as far as feasible | Kept as an ingredient (keep_input_credentials, on by default) |
| 1.2(b) Terms against removal | Your terms forbid deployers and others to remove or tamper with the marks | Yours: a clause to adapt |
| 1.3 Richer provenance (encouraged) | The system's name, the provider's company name and a time; the model and its version may be added | All of them: provider, app_name, app_version, model, model_version, and the signed time |
| 1.4 Visible-label option (encouraged) | Let users add the EU's visible label when they generate | label=true draws the EU's icon from the Code's Annex 1 into the picture or every frame (labels) |
| 2.1 Free detection | A detector for every technique used, free of charge, open to the public when the public may see the content | Images: free and public at kennmarq.com/check. Images, video and audio: POST /v1/verify (video and audio with a free key) |
| 2.1.2 Signed results | On request, a signed result with the content's hash, the detector's identity and the time | POST /v1/verify with signed=true |
| 2.1.3 Private detection | Uploads kept confidential and deleted right after the check | The checker reads images in the browser; /v1/verify reads in memory and keeps nothing |
| 2.3 Clear, accessible results | Say which mark a result rests on, and include what the marks carry; accessibility (WCAG 2.1 AA encouraged) | The checker shows each mark separately, with what it says |
| 3.2–3.3 Reliability and robustness | Measure error rates, and test the marks against edits, cropping, rescaling and attacks | Our robustness report: survival and false-reading rates per edit, for images |
| 3.4 Interoperability | Established metadata standards from the start; watermark detection made interoperable by 2 February 2027 | C2PA from the start; TrustMark is on the C2PA's list of soft bindings |
| 4.1–4.2 Documentation and testing | A documented process, and tests before launch and after; others' documentation and test results may be reused | Our docs, robustness report and changelog are public, for you to reference |
The two-layer rule (Measure 1.1) applies to images, video and audio: no single technique meets the Code's requirements alone yet, so metadata and a watermark are both required. A video with sound needs its sound marked too, as every Kennmarq.com clip's is.
Dates
- 2 August 2026: Article 50 applies.
- 2 December 2026: systems placed on the market before 2 August 2026 must mark their output (Art. 111(4), as amended by Regulation (EU) 2026/1744).
- 2 February 2027: watermark detection made interoperable (Measure 3.4(c)).
What stays with you
- Deciding whether to sign, and signing.
- Your terms against removing the marks (Measure 1.2(b)).
- Your documented process, training and cooperation with authorities (Commitment 4).
- Deciding which files are deep fakes, and labelling those you publish (Section 2, Art. 50(4)):
deepfake=trueadds the label.
Start with the EU AI Act guide, or mark your first file in the Quickstart.