Who must mark AI-generated images under the EU AI Act — the model provider or the app?

The final guidelines settle it: Article 50 attaches to systems, so the application-layer provider bears the 50(2) marking duty; upstream model providers facilitate under Articles 53–55. An upstream mark alone does not discharge the app's duty.

What counts as machine-readable marking for images?

The deployed pattern is layered: C2PA-style signed metadata as primary, imperceptible watermarking as secondary — effective, interoperable, robust and reliable as far as technically feasible, evidenced by testing on your actual output paths.

From when does image marking apply?

Immediately for systems placed on the market from 2 August 2026; systems placed before that date have until 2 December 2026 under the Omnibus transition.

Kilde › Guides › AI Act Art 50 › AI-generated images under Article 50(2…

AI-generated images under Article 50(2): who marks, with what, since when

Current to 26 August 2026 · updates land in the changelog.

Synthetic images must carry machine-readable marks — and the duty sits with the provider of the generating system, which after the final guidelines usually means the app the user touched, not the model underneath.

The duty

Article 50(2): providers of AI systems generating synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated — with solutions “effective, interoperable, robust and reliable as far as technically feasible”. That last clause is doing real work: it acknowledges the technology is uneven, and it scales with the provider's size — a lever the SME-minded enforcement regime repeats.

Who carries it — settled in July 2026

The final guidelines resolved the value-chain question: Article 50 attaches to systems, not models. The application-layer provider — the wrapper, the product — bears the 50(2) duty; upstream foundation-model providers “facilitate compliance” under their own Articles 53–55 duties. An upstream mark helps but does not discharge your duty: marks are routinely stripped by re-encoding, thumbnailing and platform processing, which is why survival testing across your real delivery paths is the substance of compliance work. Fine-tuning and API edge cases retain a narrow caveat.

What the marking stack looks like in practice

The Code of Practice's layered model reflects deployed reality: signed, tamper-evident metadata (C2PA) as the primary layer — the only broadly deployed technology of its kind — plus imperceptible watermarks as a second layer, with fingerprinting optional. Image is the mature modality: major image generators have shipped C2PA-conformant credentials since 2026. Treat vendor announcements with care — announced is not the same as live, and your evidence should show what your pipeline actually emits.

Timing

Systems placed on the market on or after 2 August 2026: marking applies now. Systems placed before that date: the Omnibus grants until 2 December 2026 — the one genuine grace period in Article 50, covered in the deadline guide. And a deployer who publishes a generated image as a deepfake has the separate 50(4) visible-disclosure duty.

Related guides

Quick answers

Who must mark AI-generated images under the EU AI Act — the model provider or the app?: The final guidelines settle it: Article 50 attaches to systems, so the application-layer provider bears the 50(2) marking duty; upstream model providers facilitate under Articles 53–55. An upstream mark alone does not discharge the app's duty.
What counts as machine-readable marking for images?: The deployed pattern is layered: C2PA-style signed metadata as primary, imperceptible watermarking as secondary — effective, interoperable, robust and reliable as far as technically feasible, evidenced by testing on your actual output paths.
From when does image marking apply?: Immediately for systems placed on the market from 2 August 2026; systems placed before that date have until 2 December 2026 under the Omnibus transition.

Ship the disclosures before enforcement finds the gap.

The AI Act Article 50 Kit: the disclosure copy library (English + 中文), the marking implementation guide with survival-test protocol, deepfake and text-labeling walkthroughs, obviousness and scope memos, the evidence log, the Code of Practice accession path — built from the regulation and the final guidelines, with pinpoint citations.

Get the kit — US$190 Free 4-page sample (PDF)

Instant download · 14-day unconditional refund · single-organisation licence · full product page

General information only — not legal advice, and no clearance opinions. Sources are Regulation (EU) 2024/1689 (Articles 50 and 99), Regulation (EU) 2026/1744, the Commission's final Article 50 guidelines of 20 July 2026 (non-binding) and our audited kit research. Marking-technology status changes fast: treat vendor announcements as live only once verified. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com