The short version: on August 2, 2026, the EU AI Act's Article 50 transparency duties became enforceable. If your product talks to users, you owe them a disclosure they can see. If your product generates media, you owe a mark machines can read — in practice, C2PA Content Credentials. Chatbot disclosure is an afternoon of work and applies now. Media marking is about a day of work and, for systems already live, is due by December 2, 2026. This is the code for both.

What Article 50 actually asks of you#

Strip away the legalese and there are two obligations that land on a normal software product (Article 50 text, Commission FAQ):

  1. Interaction disclosure — Article 50(1). If your AI system interacts directly with people — a chatbot, a support agent, a voice bot, an avatar — you must ensure the person is informed they're interacting with an AI, unless it's already obvious to a reasonably well-informed user.
  2. Generated-content marking — Article 50(2). If your system generates or substantially manipulates text, images, audio, or video, the output must be marked in a machine-readable format and detectable as artificially generated. The marking has to be "effective, interoperable, robust and reliable as far as technically feasible."

Both duties bind you whether you're the provider (you built it) or the deployer (you put it in front of EU users). The maximum fine for a transparency breach is the greater of €15 million or 3% of worldwide annual turnover — a floor you'll never actually hit as a small company, but the enforcement posture is real and the fixes are cheap. So fix them. (For the non-code view — the full obligations list and what the Digital Omnibus deferred — see our Article 50 founder compliance checklist and the August 2 transparency-deadline explainer.)

Part 1 — Disclose your chatbot (do this today)#

This is the easy one. The requirement is that the user knows before they engage. A visible, persistent notice does it. Don't bury it in a Terms page; put it where the conversation starts.

<!-- Minimal, compliant disclosure: visible before the user types,
     persistent in the header, and carried in a machine-readable attribute. -->
<div class="chat" role="region" aria-label="AI assistant" data-ai-agent="true">
  <header class="chat__banner">
    <span aria-hidden="true">🤖</span>
    You're chatting with an <strong>AI assistant</strong>, not a human.
    <a href="/ai-disclosure">How this works</a>
  </header>
  <!-- messages… -->
</div>

Two things make this robust rather than box-ticking:

There's no watermark or cryptography here; the obligation is comprehension, and this duty is not deferred — it applied on August 2.

Part 2 — Mark your generated media (C2PA Content Credentials)#

For anything your product generates — an image, a video, a synthetic voice clip — you need a machine-readable mark. The interoperable answer everyone is converging on is C2PA Content Credentials: a signed JSON manifest embedded in the file that records what made it and how, and that platforms like Google Images, LinkedIn, Meta, and YouTube already read and surface as an "AI info" label (Content Credentials).

The key ingredient for Article 50 is the IPTC digital source type trainedAlgorithmicMedia, which is the standard code for "produced by a generative AI model." Put that in an action assertion and any C2PA reader can detect the file as AI-generated.

The manifest

Write a manifest that declares your app as the generator and stamps the AI source type:

{
  "claim_generator": "acme-imagegen/1.0",
  "assertions": [
    {
      "label": "c2pa.actions",
      "data": {
        "actions": [
          {
            "action": "c2pa.created",
            "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
          }
        ]
      }
    }
  ]
}

Sign it with c2patool

The open-source c2patool attaches and signs the manifest. The signed file carries a tamper-evident, machine-readable provenance record (CLI usage):

# render.png is your model output; sign.sh runs your signer (cert + key)
c2patool render.png -m manifest.json -o render-signed.png --signer-path ./sign.sh -f

To verify what you produced — the same thing a platform's reader does:

c2patool render-signed.png            # prints the manifest as JSON
c2patool render-signed.png --info     # high-level report

For a server-side pipeline, do the signing in-process right after generation instead of shelling out per file: the c2pa-python SDK attaches and signs the manifest with your certificate, and the CAI's Python example shows the production shape — a signing endpoint backed by a KMS-held key rather than a key on disk. The one rule that matters: your signing key lives in a KMS or HSM, never in the repo. Provenance you can forge is provenance that means nothing.

The trap: metadata gets stripped#

Here's what turns a compliant demo into a non-compliant product. C2PA metadata is fragile. A screenshot drops it. A re-encode can drop it. A platform that rewrites the file's metadata drops it. The instant your image leaves your surface, the manifest may be gone.

That's exactly why the Commission's Code of Practice (finalized June 10, 2026) expects at least two layers of marking where technically feasible: **embedded metadata plus a watermark**. The watermark lives in the pixels or the token stream, so it survives transformations the metadata doesn't.

The practical pairing today:

Mark both for anything that will be re-shared. Mark at least the metadata for everything.

The deadline you can still miss#

One date does a lot of work here. Under the Digital Omnibus provisional agreement (May 2026), generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet the machine-readable marking requirement of Article 50(2).

Read that carefully, because it splits your to-do list:

The 20-minute checklist#

  1. Add the disclosure banner to every chatbot/agent/voice surface that serves EU users. Visible, persistent, before first input. (Applies now.)
  2. Add the trainedAlgorithmicMedia C2PA manifest to your image/video/audio generation output, signed with a KMS-held key. (Due Dec 2 for existing systems; day-one for new ones.)
  3. Add a watermark layer (SynthID or equivalent) for media that will travel off your surface.
  4. Verify with c2patool <file> and the public Content Credentials verifier before you call it done.
  5. Write down who reviewed what — if a human takes editorial responsibility for published AI text, that's a documented carve-out, not a vibe.

None of this is a moat or a feature. It's plumbing you now have to have — and the cheapest time to install it is before December 2, not after a complaint.