EU AI Act Transparency Code Finalized: What Content Labelling Rules Mean for AI Providers Worldwide

The Regulation That Finally Has Teeth

For years, “AI transparency” lived in policy whitepapers and voluntary pledges. On June 10, 2026, the European AI Office changed that by releasing the final Code of Practice on transparency of AI-generated content — a document that transforms abstract obligation into concrete engineering and legal requirements. The underlying law, Article 50 of the EU AI Act, takes effect on August 2, 2026, with a secondary deadline of December 2, 2026 for systems already on the market before that date.

The Code is technically voluntary. Providers and deployers of generative AI systems can sign it to signal compliance with the AI Act’s transparency obligations, reducing administrative friction across the EU’s 27 member states. But the obligations behind the Code are anything but optional: national market surveillance authorities can levy fines of up to €15 million or 3% of worldwide annual turnover — whichever is higher — for violations of Article 50. For major AI companies operating globally, that translates to hundreds of millions of dollars in potential exposure.

This is also not an isolated EU initiative. The Code’s technical architecture — anchored in C2PA-compatible metadata and interoperable watermarking — is being watched by regulators from Singapore to the United States as a potential global template for AI content governance.

What the Code Actually Requires

The Code splits obligations across two roles: providers (those who build or deploy the underlying AI systems) and deployers (organizations that publish AI-generated content to the public).

Providers: Marking and Detection

Under Section 1 of the Code, AI system providers must ensure their outputs are marked in machine-readable formats detectable as artificially generated. The Code identifies two primary technical mechanisms:

Digitally-signed metadata — Specifically, C2PA-based content credentials that record whether content is AI-generated, time-stamped and signed in a tamper-evident manner. This is the approach the IPTC standards body has confirmed aligns with the Code’s Measure 1.1 requirements.

Imperceptible watermarking — An embedded signal that persists even after a user re-saves or reformats the content. This is presented as an alternative or complementary mechanism, particularly useful for audio and video modalities.

By February 2, 2027, providers must also implement public detection systems — APIs, software tools, or cloud-based services — that allow third parties to verify whether content came from their AI system. The standard requires these detection tools to use publicly available industry standards, ensuring interoperability across vendors.

The Code also defines a taxonomy distinguishing fully AI-generated content from AI-assisted content, with different disclosure requirements for each tier. The former requires explicit machine-readable marking; the latter triggers disclosure obligations only when human editorial review is absent.

Deployers: Labelling for the Public

Section 2 of the Code targets organizations that publish AI-generated content on matters of public interest — news outlets, political campaigns, marketing agencies, and enterprise communications teams among them. Obligations include:

• Visually disclosing deepfakes using standardized EU icons
• Labelling AI-generated or AI-manipulated text when published to inform the public, unless the content underwent meaningful human editorial review
• Notifying users in clear, distinguishable language “at the latest at the time of first interaction or exposure” — not in fine print or buried disclosures

Exemptions exist for artistic, creative, satirical, or fictional works, which can use AI generation tools without triggering the labelling obligations. But the burden of demonstrating an exemption applies will fall on the deployer.

The Chatbot Disclosure Requirement

Article 50’s fourth main obligation — one often overlooked in coverage focused on images and deepfakes — requires that any provider operating an interactive AI system (chatbot, virtual assistant, AI-powered customer service) must inform users they are interacting with AI. This applies at the point of first interaction and must be unambiguous. Systems that mimic human identity without disclosure will face enforcement from day one under August 2026 rules.

What AI Providers Should Do Before August 2

1. Audit Your Output Pipelines for C2PA Readiness

The Code’s preferred technical standard for content marking is C2PA (Coalition for Content Provenance and Authenticity). Providers who have not yet assessed their output pipelines for C2PA integration should treat this as an urgent technical workstream. The gap between organizations that have begun C2PA implementation and those that have not is widening: according to compliance tracking firm Responsible AI Labs, 78% of organizations have not taken meaningful steps toward AI Act compliance as of mid-2026, and over 50% lack even a basic AI inventory.

For image and video generation systems, this means integrating C2PA manifest signing at the point of generation — before content leaves the provider’s infrastructure. Retrofitting this capability into deployed systems is significantly more costly than building it in from the start.

2. Define and Document Your Taxonomy Mapping

The Code’s distinction between “fully AI-generated” and “AI-assisted” content is not self-defining — each organization must establish internal policies that map its specific products to these tiers. A text editor that uses AI to suggest sentence completions sits in a different tier than a system that generates full articles from a prompt. A marketing platform that uses AI to resize images differs from one that generates images from scratch.

This mapping exercise is not just a compliance formality. It determines which metadata assertions are required, which visual labels must be shown, and which user notifications must fire. Organizations that skip this step will face inconsistent implementations that regulators can challenge.

3. Register as a Signatory to Reduce Cross-Border Burden

Signing the Code of Practice does not waive any legal obligations under the AI Act — but it does create a recognized compliance pathway that reduces administrative friction across all 27 EU member states. Rather than negotiating with each national market surveillance authority independently, a signatory can point to its Code adherence as evidence of compliance with Article 50. The process requires sign-off from a senior executive with authority to bind the organization.

4. Prepare Detection APIs Before the February 2027 Deadline

The requirement to provide public detection systems — allowing third parties to verify the AI-origin of content — is one of the Code’s less publicized obligations, but it carries significant engineering implications. Building a public API that correctly identifies your own AI-generated content, scales to public demand, and remains current as your models update requires sustained engineering attention. The February 2, 2027 deadline gives organizations roughly eight months from August 2026 to deliver this capability. Starting now avoids the sprint.

The Bigger Picture: A Global Labelling Standard in the Making

The EU’s transparency code does not exist in isolation. It is one of several converging signals that AI content labelling is shifting from voluntary industry practice to enforceable global norm.

The GPAI Code of Practice — which governs general-purpose AI model obligations under a separate chapter of the AI Act — has been signed by approximately 24 providers including Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, and Amazon. Meta declined to sign the GPAI code, and xAI signed only the safety and security chapter. These abstentions are telling: they indicate that some of the largest AI producers are betting on negotiated national exemptions or alternative compliance pathways rather than the EU’s preferred framework.

That bet may not pay off. The August 2026 deadline applies regardless of signatory status. And with the EU demonstrating that it can move AI regulation from framework text to enforceable code within 24 months of the AI Act entering into force, regulators elsewhere are watching. Singapore’s AI governance framework, China’s existing deepfake regulations, and proposed US federal transparency rules all point toward content provenance as the next major battleground in AI policy.

For AI providers operating globally, the practical implication is clear: implementing C2PA-compatible content credentials and audit-ready transparency infrastructure is no longer a regulatory hedge. It is baseline infrastructure for operating in any major market.

Frequently Asked Questions

Sources & Further Reading

• Further Reading
• EU Code of Practice on Transparency of AI-Generated Content — European Commission
• Article 50: Transparency Obligations — EU AI Act Reference
• Signing the Code of Practice on Transparency of AI-Generated Content — European Commission FAQ
• EU AI Transparency Code of Practice — IPTC Analysis
• General-Purpose AI Code of Practice — Official Portal
• EU AI Act August 2026 Compliance Countdown — Responsible AI Labs