On 2 August 2026, every provider and deployer of General-Purpose AI (GPAI) systems operating in the EU must mark AI-generated content as machine-readable, detectable as artificially generated or manipulated, and interoperable. Penalties for non-compliance: up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher.
The text below is reproduced from Regulation (EU) 2024/1689, Article 50, paragraph 1. The verbatim text is binding.
The marking must be readable by automated systems — not just humans. This excludes plain text disclaimers in a footer. Watermarks, metadata embeddings, and cryptographic signatures all qualify.
AI-generated or manipulated content must be identifiable as such by a third party. Both technical detection (provenance, signatures) and discoverability standards count.
Solutions must be effective and robust across the content type's full distribution lifecycle — including downstream re-encoding, screenshot, format conversion, and adversarial tampering.
The Regulation further specifies the four binding technical criteria every solution must satisfy.
Article 50(3) carves out narrow exceptions. They are not a free pass for unmarked content — they require demonstrable purpose alignment.
Content generated for the purpose of detecting, preventing, or investigating criminal offences, by law enforcement authorities acting within their legal mandate. Not a carve-out for commercial "security" claims.
AI-generated content used in scientific research and development, prior to any release to the public or deployers. Once published or deployed, the marking requirement re-engages.
Creative works whose authenticity is itself the artistic statement (e.g. AI-as-collaborator installations). The exception is narrow and tied to the work's expressive purpose — not to commercial convenience.
Article 50 obligations apply to both providers (developers of GPAI) and deployers (entities using GPAI to generate content distributed in the EU). Penalties are per the EU AI Act's standard enforcement schedule.
| Role | Trigger | Maximum fine | Or | Status |
|---|---|---|---|---|
| Provider of GPAI system | Failure to mark AI-generated content as machine-readable and detectable (Art 50(1)) | €15,000,000 | 3% global annual turnover | ENFORCED 2 AUG 2026 |
| Deployer of GPAI system | Failure to comply with downstream transparency obligations (Art 50(1) read with Art 50(4)) | €15,000,000 | 3% global annual turnover | ENFORCED 2 AUG 2026 |
| Provider — recurring infringement | Repeat violation within 5 years of a final infringement decision | Up to 2× upper bound | up to 6% turnover | AGGRAVATED |
| Provider / Deployer — small enterprise (SME) | Same obligations; fines calculated as a % of EU-only turnover, with a fixed floor | €7,500,000 | 1% EU turnover | SME-REDUCED |
| Defoneos-issued passport holder | Passport receipt linked to Art 50(1) compliance; SIGIL-anchored + HMAC-signed | €0 | 0% | PRESUMED COMPLIANT |
DEFONEOS issues an Article 50 Sovereign Passport for every piece of AI-generated content you ship. Each passport is HMAC-signed for free-tier verification via proofof.ai; Pro tier uses Ed25519 for auditor-grade attestation.
Every passport issues an HMAC-SHA256 receipt verifiable at proofof.ai for free. Sufficient for most in-house and SME compliance trails.
Pro tier signs each passport with an Ed25519 keypair. Auditor-grade — verifiable offline, anchored to a hash-chained SIGIL log, immutable.
Passport flags all member states you deploy into. Single API call; per-jurisdiction routing is automatic.
DEFONEOS tooling accounts for the 7 May 2026 EU Digital Omnibus Act delay to other parts of the AI Act. Article 50 is NOT delayed — the 2 Aug 2026 date stands. The tooling surfaces this distinction automatically.
The numbers below are pulled live from /api/article50_audit. Every passport CSOAI-ORG issues is reflected in the audit count within seconds.
Every passport issued today is one less Article 50 infringement on 3 August. The endpoint is HMAC-signed, the audit log is SIGIL-anchored, and the audit widget on this page is real.