EU AI Act Content Marking: Article 50(2) SOP and Labels

Document 06 of the RegShelf kit is a standard operating procedure for the machine-readable marking duty: scoping, technique selection, implementation, verification and evidence. Its companion, document 07 (Labelling Templates), covers the other side of Article 50 — the visible, human-facing labels deployers must put on deepfakes and on AI-generated text published to inform the public (Article 50(4)), including ready-to-use caption, on-screen, alt-text and pre-roll wording, the lighter regime for artistic and satirical works, and the editorial-responsibility statement for the human-review exemption. The two documents deliberately separate the two duties because the Act does: invisible marks are the provider's job; visible labels are the publisher-deployer's.

Providers of AI systems that generate synthetic content — and that category is wider than SMEs expect. If you build a product feature on top of a third-party model (an image generator inside your app, powered by an API), you are typically the provider of your AI system even though someone else built the model, and the marking duty sits with you — though in practice you discharge much of it through your vendor, which is why the SOP includes a vendor question set. If you merely use a third-party generative tool, you are a deployer: the Article 50(2) marking duty stays with the tool's provider, but the Article 50(4) labelling duties in document 07 can be yours whenever you publish deepfakes or public-interest text.

Outputs of in-scope systems must be marked machine-readably, and the marking must be effective, interoperable, robust and reliable as far as technically feasible — taking into account the specificities and limitations of the content type, the costs of implementation and the generally acknowledged state of the art. Points SMEs get wrong:

• No SME exemption. Article 50(2) applies to providers of all sizes; cost and state of the art are feasibility factors, not a carve-out.
• Dates: in force and enforceable since 2 August 2026 (fines up to €15 million or 3% of worldwide turnover; SMEs and small mid-caps pay the lower of the two, Article 99(6)); systems placed on the market before 2 August 2026 have until 2 December 2026; new systems must mark from day one.
• The Code of Practice on marking is voluntary. The Commission declared it adequate in July 2026 and following it is the simplest way to demonstrate compliance, but its milestones — such as interoperable marking by February 2027 — are commitments under a voluntary code, not statutory deadlines.
• An exception exists for assistive functions for standard editing that do not substantially alter the input or its meaning — apply it narrowly and document every use.

The Content Marking SOP (doc 06) contains: a scope section with an in/out table and system inventory; the obligation and dates in plain language; a guide to the four marking technique families — C2PA/Content Credentials provenance metadata, invisible watermarking, fingerprinting/logging, and format-level metadata — with a recommended primary and secondary technique per content type; a five-step procedure (assess, choose, implement, verify, document); seven questions to send every generation vendor; a verification log for sample checks after your full production pipeline; and an exception record for assistive-editing features. The Labelling Templates (doc 07) add the deployer layer: the two-element deepfake test, visible-label requirements (clear, at first exposure, medium-fitted, accessible, persistent through sharing), ready-to-use label texts for images, video and audio, the artistic-works regime, the Part B rules for public-interest text with the editorial-responsibility statement, and a publication decision log.

Inventory every feature that generates content (cross-referencing your AI system inventory), decide provider or deployer per feature, and check the grace-period question: on the market before 2 August 2026 means a 2 December 2026 deadline. Enable vendor-side marking first — most large APIs can emit C2PA today — and only build your own where the vendor leaves gaps; then verify samples with an independent tool after compression, resizing and CDN delivery, and log the results. Never strip marks or invite users to. If you publish realistic AI images, cloned voices or AI-written public-interest articles, apply the doc 07 visible labels as well.