The European Commission on 10 June 2026 published the final voluntary Code of Practice on marking and labelling AI-generated content, handing providers and deployers a Commission-blessed route to compliance with Article 50 of the AI Act before its transparency obligations bind on 2 August 2026.

The structure tells the story. Section 1 translates Article 50(2)‘s machine-readable marking duties for providers into concrete sub-measures: digitally-signed, time-stamped metadata (1.1.1), imperceptible watermarking (1.1.2), and, optionally, fingerprinting against a registry database (1.1.3). Section 2 addresses Article 50(4) deployer duties around labelling deepfakes and AI-generated text on matters of public interest. Annex I offers an optional EU icon in three variants: full AI generation, partial AI manipulation, and deepfake.

Carve-outs exist for artistic, satirical, and fictional works, and for content passing through human editorial review. Signatories also commit not to strip existing provenance metadata when they transform third-party content, which closes one of the more obvious laundering routes.

Drafted by independent experts in a multi-stakeholder process facilitated by the AI Office, the code is voluntary in name only. Non-signatories will have to prove equivalent measures directly to national market surveillance authorities, and should expect closer scrutiny. Organisations have until 22 July 2026 at 18:00 CEST to file to appear on the initial signatories list.

Executive Vice-President for Tech Sovereignty Henna Virkkunen urged AI providers and developers to sign on “to show leadership in developing and deploying responsible and trustworthy artificial intelligence.” The Commission will publish complementary Article 50 guidelines before 2 August, and systems already on the market that day get a transitional window until 2 December 2026.

Brussels has learned the GDPR lesson: voluntary frameworks become the default standard once enforcement begins.

Sources

Sources