Mark Your AI Output Before December

Note. This post is technical guidance, not legal advice. The exact classification of your system (whether you are a provider, whether an exemption applies) deserves a review with your legal team. What engineering can do is have the system ready and the evidence documented.

1. What Article 50 requires, in four obligations

• The transition period only covers 50(2) marking. The AI Omnibus (Regulation (EU) 2026/1744) gave systems already on the market before August 2 until December 2, and only for marking and detection. If your chatbot is both interactive and generative, the "you're talking to an AI" notice should have been there since August.
• No retroactive marking of content generated before August 2. But pre-August text published after that date is in scope.
• Fines for breaching transparency obligations can reach €15 million or 3% of worldwide annual turnover, with proportionality for SMEs. Enforcement is mostly by national market surveillance authorities; the AI Office only acts in specific cases, such as when the same provider offers the general-purpose model and the system built on it.

2. "But I just call an API": why you are probably a provider

1. Don't assume your provider marks. General-purpose model providers are only encouraged to mark at model level, not obliged. Check it, per model and per channel.
2. Your pipeline can strip the mark even when the model applies it. More on that in section 4.
3. You need evidence: which technique you use, why, and how you verified it. The Guidelines and legal analyses stress documenting the technical choice, because that reasoning is your proof.

3. What's out of scope (and what isn't, quite)

• Short sequences of numbers, symbols or letters: single words, captions, alt text, UI labels.
• Source code, including SQL, infrastructure as code, YAML or JSON configuration, and comments that are part of the code.
• Machine-to-machine output that no person sees, such as agent-to-agent communication.
• Closed production workflows (for example in film or games), except for the final output.

1. The output is strictly technical (engineering designs, technical instructions, internal process documentation...).
2. Only a limited, predefined group of professionals inside the provider's and deployer's organisations sees it.
3. It is not meant to leave the company, with safeguards to prevent that (isolation, role-based access control).

4. How to mark, by content type

4.1 Text: the mark lives in sampling

• OpenAI announced its text watermark (textGrain) on October 5. In the API it is off by default: you have to enable it in organisation settings (Data controls > Text provenance) or per project, and select the models. If you haven't touched anything, your OpenAI API output is probably unmarked.
• Anthropic applies the mark at model level, across all its surfaces and regions, for supported models, and is adding it to models released before August 2. Check their table to see whether the exact model you use is covered, including the channel (direct API or cloud).
• Google: on the official developer forum, Google confirmed that Gemini API text carries SynthID, after initially saying the opposite. Until it's in the documentation, we would treat it as something to confirm in writing with the provider.

from transformers import AutoModelForCausalLM, AutoTokenizer, SynthIDTextWatermarkingConfig

tokenizer = AutoTokenizer.from_pretrained(MODEL_ID, padding_side="left")
model = AutoModelForCausalLM.from_pretrained(MODEL_ID)

# The keys are a secret: load them from a secrets manager, never from the repo.
watermarking_config = SynthIDTextWatermarkingConfig(
    keys=load_watermark_keys(),   # list of ints, one per depth
    ngram_len=5,
)

inputs = tokenizer([prompt], return_tensors="pt", padding=True)
out = model.generate(
    **inputs,
    watermarking_config=watermarking_config,
    do_sample=True,               # the watermark acts on sampling
    max_new_tokens=512,
)

• At a target false-positive rate of 1%, it detected the mark in about 80% of 200-token passages and about 95% of 400-token ones, on content like psychology; much less on maths.
• Replacing 10% of the words in a 400-token passage with synonyms dropped detection from around 92% to 66%; replacing 25%, to 17%.
• In its test across the 24 official EU languages, Spanish had the best detection rate (69%) before the watermark strength was tuned.

4.2 The trap is in your pipeline, not the model

• A second model that "rewrites" or "polishes" the answer. If that model doesn't mark (a small self-hosted model to cut costs, say), the final output is unmarked even if the first model marked it.
• Machine translation afterwards with another system.
• Templates that chop and reassemble generated text into short fragments.
• Image optimisers and CDNs that resize, convert to WebP or AVIF and strip metadata by default.

4.3 Images, audio and video: signed metadata plus a watermark

1. Signed, timestamped metadata, secure and tamper-evident. The de facto standard is C2PA (Content Credentials).
2. An imperceptible watermark in the content itself, which survives when metadata is lost (screenshots, conversions). C2PA lets you bind the two, so the watermark helps recover the credentials if they're stripped.

from c2pa import Builder, C2paBuilderIntent, C2paDigitalSourceType

# The signer uses your signing certificate, ideally kept in a KMS/HSM.
with Builder({}) as builder:
    builder.set_intent(
        C2paBuilderIntent.CREATE,
        C2paDigitalSourceType.TRAINED_ALGORITHMIC_MEDIA,  # "AI-generated"
    )
    with open("generated.jpg", "rb") as source, open("signed.jpg", "wb") as dest:
        builder.sign(signer, "image/jpeg", source, dest)

#!/usr/bin/env sh
# check-c2pa-survives.sh: generate a test image, run it through the same
# pipeline as production (resize, conversion, CDN) and check the C2PA
# manifest is still there. Adapt the parsing to your c2patool version.
set -eu
./scripts/generate-test-image.sh > /tmp/in.jpg
./scripts/run-image-pipeline.sh /tmp/in.jpg /tmp/out.webp
if ! c2patool /tmp/out.webp > /tmp/manifest.json 2>/dev/null; then
  echo "FAIL: processed image no longer has a C2PA manifest" >&2
  exit 1
fi
grep -q "trainedAlgorithmicMedia" /tmp/manifest.json \
  || { echo "FAIL: manifest does not declare AI-generated content" >&2; exit 1; }

5. Detectable is not the same as marked

• Providers must offer a detection solution, in principle free of charge, hosted in the EU or runnable locally, and GDPR-compliant.
• Providers with fewer than one million monthly users whose detection has significant operating costs may charge a reasonable fee when a single user exceeds a reasonable query volume. Authorities, media, fact-checkers and researchers always get free access.
• By February 2, 2027, watermark detection must be interoperable across providers (for example via a standard API, a readable "signpost" pointing to the right detector, or a shared detector).

6. The provenance layer: how we'd build it

from dataclasses import dataclass
from enum import Enum

class Modality(Enum):
    TEXT = "text"
    IMAGE = "image"
    AUDIO = "audio"
    VIDEO = "video"
    CODE = "code"

@dataclass(frozen=True)
class GeneratedOutput:
    modality: Modality
    token_count: int | None
    audience: str              # "public", "customer", "internal_restricted", "machine"
    produced_by: str           # exact model and version
    upstream_marks: set[str]   # e.g. {"provider_text_watermark", "c2pa"}

def marking_plan(out: GeneratedOutput) -> dict:
    """Decide which marks policy requires and record the reason."""
    if out.modality is Modality.CODE:
        return {"required": [], "reason": "source code: outside Art. 50(2)"}
    if out.audience == "machine":
        return {"required": [], "reason": "machine-to-machine, no human exposure"}
    if out.audience == "internal_restricted":
        # The B2B exemption needs all three conditions of para. 87.
        # Code doesn't decide it: legal validates it and it's configured per system.
        return {"required": [], "reason": "validated B2B exemption (ref. ADR-xxx)"}
    if out.modality is Modality.TEXT:
        if (out.token_count or 0) <= 200:
            return {"required": [], "reason": "short text (≤200 tokens), no watermark required"}
        return {"required": ["text_watermark"], "reason": "free-form text >200 tokens"}
    # Image, audio and video: two layers.
    return {"required": ["c2pa_signed", "invisible_watermark"], "reason": "synthetic media"}

def enforce(out: GeneratedOutput) -> None:
    plan = marking_plan(out)
    missing = set(plan["required"]) - normalize(out.upstream_marks)
    audit_log(output=out, plan=plan, missing=missing)
    if missing:
        apply_or_block(out, missing)   # mark here or don't publish

• An inventory per model and per channel. produced_by and upstream_marks come from a hand-maintained, verified table: which models mark, since when, with which technique, and on which channel (direct API, Bedrock, Vertex, Azure). That table is your evidence, and it looks a lot like the inventory (AIBOM) we covered in the previous post in this series, on LLM gateways.
• Exemptions are configured, not inferred. Code shouldn't decide something is "B2B": that classification is validated once, documented and applied per system.
• The gateway is a good place for this. If you already route model calls through a gateway, it's the natural point to pin which models may serve public-facing content and check they have marking enabled.

7. Don't forget the 50(1) notice

• Show it on the first chat screen, not in the terms of use.
• Make channels without a visual interface announce it too: voice, WhatsApp, email.
• Review avatars and agents with a human name and tone. Those are exactly the cases where "obvious" stops being obvious.

8. Five mistakes we see coming

1. Assuming the provider marks. At OpenAI, for example, it's off by default in the API.
2. Checking in development, not production. The model, region or cloud channel change, and so does marking coverage.
3. Breaking the mark in an intermediate step: rewriting with another model, translation, image optimisation.
4. Defaulting to the B2B exemption for a product that ends up sending content to third parties.
5. Leaving no trail. If a request comes in, the question will be which technique you use, why and how you checked it. Without a record, that answer doesn't exist.

Checklist: Article 50 before December 2

• [ ] We have a list of systems that generate text, image, audio or video for people in the EU, with their market launch date (before or after August 2, 2026).
• [ ] For each one we know whether we're provider, deployer or both, validated with legal.
• [ ] Exemptions (code, machine-to-machine, para. 87 B2B) are documented per system, with all three conditions when B2B applies.

• [ ] There's a verified table of which models and channels mark text and how; at OpenAI, text watermarking is enabled at org or project level for the models we use.
• [ ] Free-form text over 200 tokens that reaches users is marked, including text that passes through rewriting or translation steps.
• [ ] Images, audio and video carry two layers: signed C2PA metadata and an imperceptible watermark.
• [ ] A CI test checks that marks survive the real pipeline (resize, conversion, CDN).
• [ ] Watermark keys and C2PA signing certificates live in a secrets manager, with rotation and least-privilege access.
• [ ] Terms of use prohibit removing the marks.

• [ ] We know how content from each system is detected and who can access the detector; we've requested access where we rely on a provider's.
• [ ] We have a plan for detection interoperability before February 2, 2027.

• [ ] Chatbots, agents and avatars disclose they're AI at the start of the first interaction, on every channel.
• [ ] If we publish deepfakes or public-interest text without editorial review, they carry a visible or audible label.

• [ ] Every marking decision is logged (system, model, technique, reason), and a document explains why we chose those techniques.

Conclusion