Ninety Days to Mark Everything You Shipped Before August

On 2 August 2026 the transparency obligations in Article 50 of the EU AI Act became applicable, and a lot of teams did the disclosure work. A line above the chat input, a spoken sentence at the top of a voice call, a note in the product help centre. What far fewer teams did was the second obligation in the same article, the one that requires outputs of generative systems to be marked in a machine readable format and detectable as artificially generated or manipulated. There was a reason for that, and it was a legitimate one. The Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, gave generative systems that were already placed on the market or put into service before 2 August 2026 until 2 December 2026 to comply with the marking duty. That deadline is 90 days from the date on this article, and the deferral covered precisely the systems that are hardest to retrofit.

It is worth stating what Article 50(2) asks, because it is narrower than the panic version and wider than the comfortable one. Providers of AI systems that generate synthetic audio, image, video or text must ensure the outputs are marked in a machine readable format and detectable as artificially generated or manipulated. The techniques are not prescribed, but the qualities are: solutions must be effective, interoperable, robust and reliable as far as is technically feasible, taking account of the type of content, the cost of implementation and the generally acknowledged state of the art. There are real carve outs. Assistive editing functions that do not substantially alter the input data or its semantics are out of scope, which is why a grammar corrector is not caught. Systems that merely relay or reproduce existing content without modifying it are out. Source code itself is outside the marking duty, although natural language output from the same system is not. Breach sits in the penalty band of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher, enforced by national market surveillance authorities.

The way the grandfathering was read is the interesting failure. In practice it functioned as a four month extension for the entire generative stack, because almost every generative product in commercial use today was on the market before August. Founders heard that the high risk obligations had been pushed to December 2027 by the same Omnibus, heard that something else had moved to December 2026, and merged the two into a general sense that the AI Act had been postponed. It has not been. Article 50(1) interactive disclosure has been live since August and is enforceable now. Article 50(4), the deployer duty to disclose deepfakes and to label AI generated text published to inform the public on matters of public interest, has also been live since August and was never deferred. The only thing that moved is the marking obligation for legacy generative systems, and it moved by four months, not by a year.

There is more help available here than most teams realise. On 10 June 2026 the AI Office published the Code of Practice on transparency of AI generated content, together with a standardised set of icons for marking media that is AI made or AI edited. The Code is voluntary, and signing it does not create a legal presumption in the way the harmonised standards route does, but it is the clearest available statement of what the Commission considers adequate. It lists C2PA content credentials as an example of a technical solution meeting the criteria, and it points toward a layered approach rather than a single mechanism: provenance metadata embedded in the file, an imperceptible watermark that survives the metadata being stripped, and server side logging that lets you answer the question of whether a given asset came from your system. Complementary signals such as SynthID sit in the same picture. If you are choosing an approach in the next 90 days, choosing the one the regulator has already described in writing is the cheap decision.

The population this catches is larger than the model labs, and that is the part worth checking carefully. If you ship a product that generates images, audio, video or text, you are a provider of a generative AI system for the purposes of this article whether or not you trained anything. The app builders are squarely in this space: a Lovable, Bolt or v0 project that generates marketing copy or images for end users is generating synthetic content, and so is an agent built on ChatGPT or Claude that drafts and publishes text. Voice platforms in the ElevenLabs mould and image tools in the Midjourney mould are the obvious cases, but the less obvious ones are the internal products that quietly grew a generation feature. Two questions settle most of the boundary cases. Does the system substantially alter the input, or is it assistive editing. And does your own product modify the output of an upstream provider in a way that strips or invalidates the marking that provider applied, because if it does, the marking that satisfies the law is now your problem rather than theirs.

The engineering reality is where the four months actually go, and it is not the part anyone budgets for. Provenance metadata is fragile in exactly the places modern content pipelines operate. Image optimisers strip it, CDN transforms re encode and drop it, social platforms remove it on upload, a screenshot destroys it completely, and any format conversion is a coin toss. That is why the layered approach exists and why a metadata only implementation will not survive a serious audit question about robustness. Text is harder still, and it is honest to say the state of the art for marking generated text is weak: watermarking schemes exist, they degrade under paraphrase and editing, and there is no equivalent of an image container to carry a credential. The reasonable posture for text is to lean on the wording of the article, implement what is technically feasible, document what you assessed and rejected and why, and keep server side logs that establish provenance even when the artefact carries none. A written technical feasibility assessment is itself evidence, and it is the artefact you will wish you had.

Mapping this into the compliance work you already do is straightforward if you treat each generative surface as a system rather than as a feature. Under ISO 42001, each one earns an inventory entry with a named owner, the model behind it, the content types it produces, the marking mechanism applied to each type, and the date the mechanism was last verified. Under SOC 2 and ISO 27001, the marking pipeline is a change managed component, because a build change that swaps an image library or adds a compression step can silently remove provenance in the same way it can remove a security header. Vanta, Drata, Secureframe, Sprinto, Thoropass and Hyperproof will all carry that register against a control with a review cadence, which turns a scramble into a monitored obligation. Teams that have been through PCI DSS will recognise the shape of the problem from client side script inventory: the control is not hard, the difficulty is knowing every place the thing you are inventorying actually appears.

So here is the 90 day version, and it is deliberately small enough to start this week. List every surface in your product that emits generated audio, image, video or text to a person, including the ones added since the last architecture review. For each surface, record whether you are the provider or the deployer, what marking is applied today, and whether that marking survives the full delivery path from generation to the screen of the user. Pick your mechanism from the Code of Practice rather than inventing one, and implement metadata plus watermark plus logging where the content type allows it. Write the technical feasibility assessment for the surfaces where full marking is not achievable, especially text, and have someone senior sign it. Then add a verification step to your release process, because the failure mode here is not a missing implementation, it is an implementation that was correct in September and got quietly broken by an unrelated change in November.

None of this is an argument that the marking regime is well designed. It asks for robustness the underlying techniques cannot always deliver, it is easiest to satisfy for the content types where deception is least consequential, and it leans on a voluntary Code to fill the gap between the wording and the practice. Those are fair criticisms and they will be litigated. They do not change the position a team is in on 3 September 2026. The obligation applies, the deferral that made it feel distant expires in 90 days, and it expires for the systems that need the most work, because those are the only systems the deferral ever covered. The teams that come out of December cleanly will not be the ones with the best watermark. They will be the ones who can produce a list of every generative surface, say what is marked and how, and show the dated assessment explaining the ones that are not.