Cafiyn Pulse
← Startup Signals
7 min readUpdated 2026-10-02Issue 5

The EU AI output marking rule is not a December deadline. For most teams it started in August.

Almost every summary of this gives one date. There are two, and which one applies to you depends on when you shipped, not on how big you are.

ByKarthik KumarCafiyn Innovations
At a glance
The obligation
AI Act Article 50(2), machine-readable marking of generated output
Shipped before 2 Aug 2026
Comply by 2 December 2026
Shipped on or after 2 Aug 2026
Already applies, since 2 August 2026
Covers
Synthetic audio, image, video and text
Falls on
Providers, not deployers
High risk rules
Deferred to 2 December 2027 and 2 August 2028

What the rule asks for

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text content to ensure that outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". It adds that the technical solution must be "effective, interoperable, robust and reliable as far as this is technically feasible", taking into account the state of the art and the cost of implementation.

Two words carry most of the weight. Machine-readable means a detector should be able to tell, not just a careful human: a visible "generated with AI" caption does not satisfy this on its own. And text is named explicitly, alongside audio, image and video, which surprises people who assume output marking is a deepfake rule about media.

The two dates, and why almost everyone reports one

Article 50 sits in Chapter IV of the AI Act. Chapter IV is not carved out of the Act's general application date, so it has applied since 2 August 2026.

Separately, the Digital Omnibus on AI, Regulation (EU) 2026/1744, added a new paragraph 4 to Article 111. It gives a transitional period to providers of generative systems "that have been placed on the market before 2 August 2026", who must take the necessary steps to comply with Article 50(2) "by 2 December 2026". Its recital describes this as a four month transitional period so that providers already on the market can adapt without disruption.

Read together, that produces two cohorts rather than one deadline. A generative feature that was already on the EU market before 2 August 2026 has until 2 December. A generative feature launched on or after 2 August 2026 never got a transitional period, and the obligation applies to it now.

The reason this matters more than a pedantic distinction: the common summary, "the EU AI output marking rule starts on 2 December 2026", tells a team that launched in September that it has time. It does not. It is the newer product, built by the smaller team, that is most likely to be told the wrong thing here.

The carve-out has three limbs, not one

The obligation does not apply, in the Act's words, "to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences".

Note the phrase "to the extent". This is not a product-level exemption you either qualify for or do not. A single product can be partly in scope: a writing tool whose grammar correction is assistive editing and whose "draft this section for me" button generates new text is doing two different things, and only one of them is plausibly carved out.

The honest reading for most products is that the carve-out is narrower than teams want it to be. If a user presses a button and new content appears that was not substantially there before, that is generation, not standard editing.

What marking looks like in practice

The Act does not name a technology, and the harmonised standards that would tell you what regulators accept are not published. That is genuinely unresolved, and anyone telling you there is a settled compliant answer is overselling. What exists today:

  • For images, video and audio, C2PA Content Credentials are the most established provenance standard and the one most tooling supports
  • For images, an invisible watermark alongside the metadata survives the re-encoding and stripping that metadata does not
  • For text, options are weaker and more contested. Statistical watermarking at generation time exists but is not widely deployed, and a detectable marker that survives copy and paste is an open problem
  • Many upstream model providers already mark their own output. If you pass that output through unchanged, find out what they do rather than duplicating it
  • Whatever you choose, keep a written record of why you chose it and what you considered. The Act's own standard is what is technically feasible given the state of the art, which is a judgement you may have to show

What this is not

Two things get folded into this rule that do not belong to it.

The first is the high risk regime. The Digital Omnibus deferred the Chapter III obligations for high risk systems to 2 December 2027 for Annex III systems and 2 August 2028 for systems that are safety components of regulated products. If your product is not high risk, that reprieve is irrelevant to you, and if it is, the paperwork is not this quarter's problem.

The second is a different obligation that happens to share the 2 December 2026 date. The same regulation added new prohibitions covering non-consensual intimate imagery and child sexual abuse material, applying from 2 December 2026. That is a prohibition, not a marking duty, and conflating the two produces confused compliance notes.

Also worth being clear about who is on the hook. Article 50(2) is a provider obligation. If you deploy someone else's model inside your product, work out whether you are a provider of the system you ship, which usually you are, rather than assuming the model vendor absorbs it.

What to do

  1. 1Work out which cohort each generative feature is in: on the EU market before 2 August 2026, or on or after.
  2. 2If anything launched on or after 2 August 2026 and is unmarked, treat that as current rather than pending.
  3. 3Decide feature by feature whether the assistive editing carve-out applies, remembering it is scoped "to the extent".
  4. 4Ask your upstream model providers what marking they already apply to output you pass through.
  5. 5Pick a provenance scheme per content type and write down why, since the standard is what is technically feasible.
  6. 6Keep the high risk dates and the new prohibitions separate in your compliance notes. They are different obligations.

Common questions

When does the EU AI output marking rule apply?

Article 50(2) has applied since 2 August 2026. Providers of generative systems placed on the EU market before 2 August 2026 were given until 2 December 2026 by the new Article 111(4). Anything placed on the market on or after 2 August 2026 is already covered.

Does it cover text, or only images and video?

Text is named explicitly. Both Article 50(2) and Article 111(4) refer to systems generating synthetic audio, image, video or text content.

Is a visible "AI generated" label enough?

Not on its own. The requirement is that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. A visible label is not machine-readable marking.

What is the exemption?

The obligation does not apply to the extent a system performs an assistive function for standard editing, or does not substantially alter the input data or its semantics, or where authorised by law to detect, prevent, investigate or prosecute criminal offences. It is scoped "to the extent", so a product can be partly in scope.

Does this fall on us or on the model provider?

Article 50(2) is a provider obligation. If you ship a system that generates content to users, you are generally a provider of that system, whoever built the underlying model. Many model vendors mark their own output, so ask what they do before duplicating it.

What happened to the high risk rules?

Regulation (EU) 2026/1744 deferred the Chapter III high risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. That is a separate regime from the Article 50 transparency duties.

Sources

Read against the primary documentation rather than secondary coverage. Where a figure comes from a provider's own docs, it is quoted as published on 2026-10-02.

Related

Pre-launch checklist →Crawler and bot policy changes →

More from Signals

OpenAI removes o1, o3-mini, o4-mini and GPT-4 Turbo on 23 October. The replacements it names run from 5.5 times the price to 97 percent less.
Eleven models and six fine tuned models go dark in four days. Here is OpenAI's own mapping, what each landing costs on a typical month of traffic, and the places where the named replacement is not the cheapest or cannot be used at all.
OpenCode says a breach hit 1.4 percent of Console users who linked an AI provider. Rotate those keys before the root cause is published.
OpenCode has confirmed the breach and has not said how it happened or what was taken. Here is what the vendor said, who is exposed, the order to work in, and how to limit the damage next time.
GitHub Actions workflow lockfiles are in public preview. Here is how to turn them on, check them in CI, and what they do not protect.
A tag can move after you reviewed it. A lockfile makes the runner use the commit you reviewed. Here is the setup, the CI check, the policy, and what a lockfile cannot tell you.
Next.js 16.4.1 and 15.5.28 fix two critical remote code execution flaws. For one of them there is no workaround.
Two of the three fixes were postponed from September. Here is what each flaw needs in order to be reachable, the one workaround that exists, and what the announcement leaves out.
A poisoned npm release that punishes you for revoking the stolen token. The order of your response is the whole defence.
Most incident guidance starts with revoking the leaked token. Here that is the trigger. What StepSecurity found, the order it recommends, and why a valid provenance attestation did not help.
Claude Haiku 5.5 costs a tenth of Haiku 4.5 per token. One token past 100,000 it costs half.
The rate card is a tenth of Haiku 4.5. The footnote is a threshold that moves the price fivefold and that a tokenizer change pushes you toward.
Gemini 4 Argon launched at $2 and $10 and goes to $4 and $20 on 1 December. Price your product on the second number.
Every tier on the pricing page doubles on the same date. What changes, what the number includes, and what to do if you are building on the launch rate.
Claude Haiku 5.5 is not a model id swap. Five things that worked on Haiku 4.5 now return a 400.
The model id is the easy part. The requests that now fail, the response parsing that changes, and the details that fail quietly.
Next.js shipped 16.3.7 and 16.3.8 a day apart. Only one of them is the security release.
Two patch releases a day apart, one of them a decoy if you are not reading carefully. And the 15.5 line does not get the high severity fix at all.
Sonnet 5.5 cut the rate by a third and the token count went up by about 30 percent.
A third off the per-token rate is not a third off the bill when the same text now costs more tokens. Here is the arithmetic, and the five ways your code can break.
Your AI gateway holds every provider key you have. A 9.9 just landed in LiteLLM.
An AI gateway concentrates every upstream key into one process. That is the point of it, and it is why a privilege escalation there is worse than it looks.
The table your coding agent created does not have row level security on it.
Dashboard-created tables get row level security by default now. API-created tables do not, and API is how your coding agent works.
A 9.5 in next/og. Whether it reaches you depends on one line in your OG route.
The advisory rates it 9.5, but it only fires if your OG image route puts attacker-controlled text into SVG. Here is how to find out which side of that line you are on.
OpenAI and Anthropic both cut prices on 22 September. One of them costs you a refactor.
Two frontier price cuts in one day is a good week for anyone paying a token bill. The migration cost is not evenly distributed, and one of the two prices comes with an expiry hedge.
A package install reads your home directory. This week two of them did it on purpose.
The implant did nothing clever. It read the files your shell reads, in the place your credentials live, and sent them somewhere else. That is the whole attack, and it works.
GitHub is switching off SHA-1 SSH keys. Find out now whether yours is one of them.
The keys at risk are the old ones, on the machines nobody logs into, in the pipelines that have run untouched for three years. Those are also the ones that will fail loudest.
Every third-party script tag is a standing grant to run code on your visitors.
A marketing form, a chat widget, an analytics snippet. Each one is permission for someone else's server to execute whatever it sends, on every page it sits on, forever.
1.8 million Android apps were scanned for hardcoded keys. Here is how to check yours.
Finding secrets in shipped apps is now a cheap, automated pipeline. Anything compiled into an APK, an IPA or a JavaScript bundle should be treated as already published.
OpenAI's Agents API will hold your agent state. What breaks if you ever need to leave.
Two major providers moved into the agent state layer in the same week. A managed harness is a real shortcut, as long as you keep a copy of what it holds.
Meta's Muse agent can now check out at your store. What merchants should change.
Agent purchases are arriving through wallets and single-use cards, not through merchants adopting a new protocol. Many merchants will receive them without choosing to.
What Brevo's SSO incident teaches about multi-tenant SAML and hijacked sending accounts.
One incident, two lessons: why email authentication did not help, and the tenant-scoping mistake anyone shipping SSO can make.
Cloudflare now sorts bots into Search, Training and Agent. What it means for your site and your agent.
The same change lands on two audiences. Site owners can now accidentally block search; agent builders will find more doors closed.
OpenAI has announced ten dated deadlines between 23 October 2026 and 1 April 2027. Here is the calendar.
Ten dated deadlines in six months, every one announced in public. The failure mode is never the notice. Updated 19 October with the entries added since September.
Nvidia bought Hugging Face. Your open-weight fallback is now a vendor relationship.
The commitments say nothing breaks. The structural change is that "we can always self-host" is now a dependency on one vendor rather than on a neutral commons.
The Videos API goes away on 24 September and OpenAI names nothing to move to.
Every other deprecation on OpenAI's page offers a migration target. This one does not, which makes it a different kind of problem.
Whisper shuts down on 26 February. The risk is not the deadline.
Five months is a generous window. Whisper is also typically wired into a background job that fails into a queue rather than into a user's face.
The Assistants API is gone. Your app may not have told you yet.
It shut down on 26 August 2026. The replacement is not a drop-in, and the most common migration mistake changes your model's behaviour without throwing an error.
One Copilot code review costs 13 requests. Here is the rest of the maths.
Copilot now bills on usage rather than seats. The headline change is simple. The multipliers underneath it are where teams get surprised.
Row-level security is on by default now. That is not the same as being protected.
Lovable fixed the default. The gap that actually leaks data was never the default, it was the policy, and no platform can write that for you.
Your model comparison is measuring the wrong number.
Every price list is per token. Your bill is per finished piece of work. Those two numbers can rank models in opposite orders.
An agent with production log access is a new identity. Treat it like one.
Always-on agents that read production logs are arriving fast. The access-control question they raise is old and well understood, which is the good news.

Open the tool.

Ten production categories, three minutes, and a ranked list of what to fix first.

Check your own stack