Code of practice on transparency of AI-generated content: what it adds to Article 50

What the obligation asks for

Art. 50(2) of Regulation (EU) 2024/1689 requires the provider of an AI system that generates synthetic audio, image, video or text to mark the outputs in a machine-readable format and to make them detectable as artificially generated or manipulated, with technical solutions that are effective, interoperable, robust and reliable as far as technically feasible. Art. 50(7) requires the Commission to encourage and facilitate codes of practice at Union level for the detection, marking and labelling of such content, and to assess, taking utmost account of the opinion of the Board, whether adherence to a code is adequate for the duties in Art. 50(2) and Art. 50(4); where the Commission deems a code inadequate, it may adopt an implementing act with common rules. Regulation (EU) 2026/1744 amended Art. 50(7) so that the Commission leads the codes in place of the AI Office, the paragraph names marking alongside detection and labelling, and adequacy is assessed in a single step with the Board's opinion; the content of Art. 50(1) to (6) did not change. Art. 50 applies from the general application date 2026-08-02In force; a system that generates synthetic content and was placed on the market before that date has a grace period for the Art. 50(2) marking duty only 2026-12-02Deferred.

The Art. 50 obligation record lists two elements that this guide serves: the documentation element "record of adherence to the Code of Practice on Transparency of AI-Generated Content, or of the alternative means used to show conformity with Art. 50(2) and (4)", and the process element that monitors the Commission's adequacy assessment and any implementing act. The Code's own objectives, point (a) of each section, state that adherence serves as a guiding document for demonstrating conformity while "adherence to the Code does not constitute conclusive evidence" of it. The Commission's published questions and answers on signing state that signing is voluntary, that not signing is not in itself an infringement, that a non-signatory has to show adequacy through other means to the market surveillance authority, and that non-signatories may receive a larger number of information or access requests about their marking and labelling practices. The Commission guidelines, Commission guidelines on Article 50 transparency obligationsPublished, published, expect a non-signatory to carry out a gap analysis against the Code (paragraph 148, as recorded in the block below). No harmonised standard is cited in the Official Journal for Art. 50 as of the anchor date, so no presumption of conformity attaches to adherence or to any technique. Which layer set counts as adequate under Art. 50(2) is unsettled; the guide records the layer set the signatory declares and applies the working reading only in the comparison of step 5.

Inputs

The inputs below are the documentation subset of the PR-50-MARK v1.0 input table plus the records the Code itself names. The full table is on the protocol page.

• The signed signature form for each Code section, or the written decision not to sign, with the executive level of the signer, as the Commission's signing instructions require.
• The scope record of the system: modalities, output paths and the functions assigned to Art. 50 paragraphs (protocol steps 1 and 2).
• The marking architecture description per modality: signed metadata, imperceptible watermark, and any fingerprinting or logging layer (Measure 1.1 and Sub-measures 1.1.1 to 1.1.3).
• The detection solution description: its form, access terms, fee terms and the signed result format (Sub-measures 2.1.1 and 2.1.2).
• The acceptable use policy, terms or documentation clause on metadata markings (Measure 1.2(b)).
• The process document of Measure 4.1 and the internal test and monitoring report of Measure 4.2, with the benchmark used and any upstream or third-party results relied on.
• The interoperability plan under Measure 3.4: the metadata standard adopted, the public integration information, and the option chosen under Measure 3.4(c).
• The training record of Measure 4.3 and the market surveillance request log of Measure 4.4.
• Where Section 2 is signed: the label design and placement records, the internal process description, the review channel and the editorial responsibility policy (Section 2, Commitments 1 to 4).
• python3 with PyYAML installed at a recorded version, for the coverage check.

Procedure

Each step names the Code measure or the protocol step it derives from and the record it produces. Code blocks and the structure table follow the step they belong to. Every signatory name, record name, path and count in the examples is synthetic.

1. Record the Code sections signed, the signature status and the executive level, or the decision not to sign.

   Record adherence-record: sections signed, status (conditional, confirmed, withdrawn, not signed), form reference

   [Code of Practice on Transparency of AI-Generated Content, Section 1 and Section 2, Commitments scope paragraphs; Regulation (EU) 2024/1689, Art. 50(7); PR-50-MARK step 1]

2. List every measure and sub-measure of each signed section; mark each as will, encouraged or may.

   Record measure-register: measure id, binding word, section

   [Code of Practice on Transparency of AI-Generated Content, Section 1 and Section 2, interpretation of 'will', 'encouraged' and 'may']

3. Assign each measure to the modalities and output paths in the scope record; mark out-of-scope measures with the reason.

   Record measure-register: modalities, in scope yes or no, reason

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Commitment 1, 'as applicable to the type(s) of content'; PR-50-MARK step 1]

4. Name for each mandatory measure the evidence record held and the protocol step that produces it, or "documentation, no test".

   Record measure-evidence-map: measure id, commitment, binding word, evidence record, protocol step or 'documentation, no test'

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 4.1; PR-50-MARK steps 4 to 45]

5. Compare the declared layer set per modality with Measure 1.1 and its two single-layer exceptions; record the exception claimed.

   Record layer-set-comparison: modality, layers declared, expectation applied, exception claimed

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 1.1 and Sub-measures 1.1.1 to 1.1.3; PR-50-MARK steps 4 and 38]

6. Record the detection solution form, its free-of-charge terms, the expert-user access rule and the signed downloadable result.

   Record detection-access-record: form (specification, software, API), fee terms, access restriction, signed result format

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Sub-measures 2.1.1 and 2.1.2; PR-50-MARK steps 5 and 17]

7. Obtain the terms clause that prohibits removal of metadata markings and the input-metadata retention statement.

   Record non-removal-record: clause reference, input-metadata retention statement; documentation, no test

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 1.2(a) and (b)]

8. Record the metadata standard adopted, the public integration information and the watermark interoperability option chosen under Measure 3.4(c).

   Record interoperability-record: metadata standard, public information location, Measure 3.4(c) option (i) to (iv), planned completion in the signatory's plan

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 3.4(a) to (c); PR-50-MARK steps 10, 23 and 24]

9. Obtain the Measure 4.1 process document and the Measure 4.2 test report; record the benchmark and any upstream reliance.

   Record target-justification-record: benchmark named, upstream or third-party results relied on, monitoring log reference

   [Code of Practice on Transparency of AI-Generated Content, Section 1, Measures 4.1 and 4.2; PR-50-MARK step 6]

10. Run the coverage check; list each mandatory in-scope measure without an evidence record as a gap.

    Record measure-coverage-report: measure id, evidence present yes or no, gap reason

    [AIAssuranceLabs procedure; Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 4.1]

11. Where Section 2 is signed, repeat steps 2 to 10 with the deployer label, process and editorial records.

    Record measure-register and measure-evidence-map: Section 2 rows

    [Code of Practice on Transparency of AI-Generated Content, Section 2, Commitments 1 to 4; PR-50-MARK steps 29 to 32]

12. File the map, the coverage report and the gap list in the adherence record and the remediation list.

    Record Code of Practice adherence or alternative-means record (Art. 50(7)); Remediation list (PR-50-MARK output)

    [Code of Practice on Transparency of AI-Generated Content, Section 1, Measure 4.4; PR-50-MARK step 44]

Example for step 1. The adherence record holds what the Commission's signing instructions and the Code fix about the act of signing, in words and without dates. Separate sections of the Code may be signed individually; individual commitments may not. A provider under Art. 50(2) signs Section 1, a deployer under Art. 50(4) signs Section 2, and an organisation in both roles signs both; a provider of a generative AI model or a marking or detection technology provider may sign Section 1 without being bound by Art. 50(2). A signature is conditional on the positive adequacy assessment by the Commission and the Board, which the Commission's page states has been given. A signature can be withdrawn by a letter signed by an executive at the same level as the one who signed, after which the benefits of adherence no longer apply. The timeline in words: the Code was published before the Art. 50 application date; forms received by the AI Office's cut-off shortly before that date make up the initial signatory list; a form sent after the cut-off still makes the sender a signatory; and Measure 3.4(c) fixes a later date, after the application date, by which a Section 1 signatory implements one of four interoperability options for watermark detection. The Code contains no periodic transparency-report commitment. The reporting it does contain is: testing and reporting on performance against internal benchmarks until the AI Office endorses evaluation methods (Measure 4.2), public information to the Commission and stakeholders on how to integrate and access the detection solutions for non-metadata layers (Measure 3.4(b)), documentation and access on the reasoned request of a market surveillance authority (Measure 4.4), handover of a retired detection solution without replacement to the market surveillance authorities (Sub-measure 2.1.4), and, for Section 2 signatories, publication of the contact details of the person with editorial responsibility (Commitment 4) and of any sectoral good practices (Section 2, Commitments preamble).

Example for step 2. The table below is the structure of the Code as published, one row per measure, with the sub-measures named in the subject cell and the binding word the Code assigns. "Will" marks a measure the Code calls mandatory for a signatory and that a market surveillance authority monitors; "encouraged" and "may" mark optional measures. The row for a measure names the Code as its source; no row adds content the Code does not state.

Example for step 4. The YAML map below is the record layout for one synthetic Section 1 signatory that generates images and free-form text through an API and a user interface. Every measure id and binding word comes from the table above; every evidence name, step number and note is either a PR-50-MARK record name or a document the signatory holds. The protocol_step value is the protocol step that produces the record, or the fixed string documentation, no test where the measure is met by a document. The signatory name, the modalities and the file paths are synthetic.

# Synthetic example: measure-evidence-map for one Section 1 signatory.
signatory: synthetic-image-text-provider
code_section: 1
modalities: [image, free-form-text]
output_paths: [api, ui]
measures:
  - id: "1.1"
    commitment: 1
    binding: will
    in_scope: true
    evidence: [architecture-description, layer-set-comparison]
    protocol_step: "PR-50-MARK steps 4 and 38"
  - id: "1.1.1"
    commitment: 1
    binding: will
    in_scope: true            # image outputs carry metadata; free-form text cannot
    scope_note: image only
    evidence: [manifest-presence-log, manifest-validation-log, metadata-content-log]
    protocol_step: "PR-50-MARK steps 12, 13 and 14"
  - id: "1.1.2"
    commitment: 1
    binding: will
    in_scope: true
    evidence: [watermark-detection-log, text-detection-log]
    protocol_step: "PR-50-MARK steps 15 and 16"
  - id: "1.1.3"
    commitment: 1
    binding: may
    in_scope: false
    scope_note: not implemented; optional under the Code
    evidence: []
    protocol_step: "documentation, no test"
  - id: "1.2"
    commitment: 1
    binding: will
    in_scope: true
    evidence: [non-removal-record]
    protocol_step: "documentation, no test"
  - id: "2.1"
    commitment: 2
    binding: will
    in_scope: true
    evidence: [detection-access-record, external-detection-log]
    protocol_step: "PR-50-MARK steps 5 and 17"
  - id: "2.1.3"
    commitment: 2
    binding: will
    in_scope: true
    evidence: [detection-service-data-protection-statement]
    protocol_step: "documentation, no test"
  - id: "2.1.4"
    commitment: 2
    binding: will
    in_scope: true
    evidence: [detection-retirement-policy]
    protocol_step: "documentation, no test"
  - id: "2.3"
    commitment: 2
    binding: will
    in_scope: true
    evidence: [detection-result-readability-log, accessibility-check-log]
    protocol_step: "PR-50-MARK steps 18 and 33"
  - id: "3.1"
    commitment: 3
    binding: will
    in_scope: true
    evidence: [user-based-assessment-record]
    protocol_step: "documentation, no test"   # step 18 covers readability only
  - id: "3.2"
    commitment: 3
    binding: will
    in_scope: true
    evidence: [control-detection-log, detection-rate-summary]
    protocol_step: "PR-50-MARK steps 25 and 36"
  - id: "3.3"
    commitment: 3
    binding: will
    in_scope: true
    evidence: [transformation-set, survival-matrix]
    protocol_step: "PR-50-MARK steps 7, 19 to 22 and 35"
    scope_note: adversarial attacks not covered by the current protocol version
  - id: "3.4"
    commitment: 3
    binding: will
    in_scope: true
    evidence: [interoperability-record, independent-reader-log, interface-query-log]
    protocol_step: "PR-50-MARK steps 10, 23 and 24"
  - id: "4.1"
    commitment: 4
    binding: will
    in_scope: true
    evidence: [docs/code-process-description.md]
    protocol_step: "documentation, no test"
  - id: "4.2"
    commitment: 4
    binding: will
    in_scope: true
    evidence: [target-justification-record, docs/internal-test-report.md]
    protocol_step: "PR-50-MARK step 6"
  - id: "4.3"
    commitment: 4
    binding: will
    in_scope: true
    evidence: []                              # gap: no training record held
    protocol_step: "documentation, no test"
  - id: "4.4"
    commitment: 4
    binding: will
    in_scope: true
    evidence: [msa-request-log]
    protocol_step: "documentation, no test"

Example for step 10. The Python check below reads the map with PyYAML, holds the list of Section 1 measure ids the Code marks "will", and reports three kinds of gap: a mandatory id missing from the map, a mandatory in-scope measure with an empty evidence list, and a mandatory in-scope measure whose protocol_step is neither a protocol step nor the fixed string. The synthetic map above produces one gap, Measure 4.3, which goes to the remediation list. The exit code is the only pass criterion; the printed lines are the measure-coverage-report.

# Synthetic example: coverage check over measure-evidence-map.yaml (Section 1).
import re
import sys

import yaml  # PyYAML, version recorded in tool-register

MANDATORY_SECTION_1 = [
    "1.1", "1.1.1", "1.1.2", "1.2",
    "2.1", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.3",
    "3.1", "3.2", "3.3", "3.4",
    "4.1", "4.2", "4.3", "4.4",
]
NO_TEST = "documentation, no test"
STEP_RE = re.compile(r"^PR-50-MARK steps? \d")

with open("measure-evidence-map.yaml", encoding="utf-8") as fh:
    doc = yaml.safe_load(fh)

by_id = {m["id"]: m for m in doc["measures"]}
gaps = []

for mid in MANDATORY_SECTION_1:
    m = by_id.get(mid)
    if m is None:
        # A sub-measure may be recorded under its parent measure row.
        parent = mid.rsplit(".", 1)[0]
        if parent in by_id and by_id[parent].get("in_scope"):
            continue
        gaps.append((mid, "missing from map"))
        continue
    if not m.get("in_scope"):
        if not m.get("scope_note"):
            gaps.append((mid, "out of scope without a reason"))
        continue
    if not m.get("evidence"):
        gaps.append((mid, "no evidence record"))
    step = m.get("protocol_step", "")
    if step != NO_TEST and not STEP_RE.match(step):
        gaps.append((mid, f"protocol_step not resolvable: {step!r}"))

for m in doc["measures"]:
    if m["binding"] != "will" and m.get("in_scope") and not m.get("evidence"):
        print(f"note  {m['id']}: optional measure in scope without a record")

for mid, reason in gaps:
    print(f"GAP   {mid}: {reason}")
print(f"checked {len(MANDATORY_SECTION_1)} mandatory ids, {len(gaps)} gap(s)")
sys.exit(1 if gaps else 0)

# Synthetic run on the map above.
python3 check_coverage.py
# GAP   4.3: no evidence record
# checked 18 mandatory ids, 1 gap(s)

A pitfall that vendor documentation omits

The documentation of a watermarking library, a provenance SDK or an upstream model describes a technique and, at most, the measures the technique serves. Measure 4.1 of the Code lets a signatory leverage documentation provided by a third party or at the model level, and Measure 4.2 lets a downstream provider rely on an upstream provider's test results, in both cases "without prejudice to the ultimate responsibility of the Signatory". The evidence record is the document the signatory holds that names the vendor's result, the version it applies to and the modality and output path it covers; every evidence entry in the map is therefore a record in the signatory's own file. A second omission concerns the binding words. The Code's interpretation paragraph, repeated in both sections, states that only "will" measures are mandatory and monitored by market surveillance authorities, while "encouraged" and "may" measures are voluntary. A Measure 4.1 process document that describes the optional measures a vendor's product supports (richer provenance under Measure 1.3, a label function under Measure 1.4, forensic detection under Measure 2.2) and leaves a "will" measure such as the training record of Measure 4.3 or the retirement policy of Sub-measure 2.1.4 without a record is the gap the coverage check surfaces. Point (a) of the objectives of each section adds the boundary that applies to the whole map: adherence to the Code is a guiding document and not conclusive evidence, and no harmonised standard is cited in the Official Journal for Art. 50 as of the anchor date, so no presumption of conformity attaches to adherence; the Code sits at the code-of-practice level of the source hierarchy stated on the standards page.

The one quantity the marking measures state is a length. Sub-measure 1.1.2 requires a watermark on free-form text longer than 200 tokens even where its reliability is lower than on long text, and the Glossary defines "very short text" as text shorter than 200 tokens at the time of publication, with the expectation that the threshold decreases as methods improve. Sub-measure 2.1.2 permits access to the free-form text detector to be restricted to verified expert users for as long as that lower reliability lasts. A text watermarking library reports its detection rate at the lengths its authors chose, often far above that boundary. The row for Sub-measure 1.1.2 in the map therefore carries the provider's declared minimum length, and the text-detection-log of protocol step 16 records the result at that declared length. Regulation (EU) 2024/1689 sets no length, no rate and no technique; the number is the Code's and conditional on its publication date.

What the result shows and what it does not

The measure-to-evidence map and the coverage report show that a record exists for every mandatory in-scope measure of the signed section and which protocol step or document produced it. They do not show that the content of a record meets the measure: presence, survivability, detectability and the rates come from the protocol steps the map points to, on the sampled outputs, the recorded transformation set and the control samples of that run only, as the protocol's Limitations section states. The map does not show that the Commission or a market surveillance authority accepts the signatory's layer set or technique; the adequacy assessment under Art. 50(7) covers the Code as an instrument, and the layer-set question remains unsettled. A record of adherence, or of the alternative means a non-signatory uses, is evidence for the provider's or deployer's own file; the decision whether the measures meet Art. 50(2) and Art. 50(4) remains with the provider or deployer and their counsel. The Article 50 transparency and marking/watermark testing service runs the protocol steps the map names; its limits are on what we cannot do. The map is filed in the evidence pack with the run log.

Related pages

The two guides on the tests the map points to, the watermark survivability guide for Measure 3.3 and the manifest validation guide for Sub-measure 1.1.1, the obligation, the protocol and the hub for the role this guide serves are listed below.

Obligations

• Art. 50

Protocols

• PR-50-MARK v1.0

Related guides

• EU AI Act watermark survivability: testing a watermark against re-encoding
• Verify content credentials: C2PA manifest validation step by step
• Transparency obligations under Article 50: implementing each of the four

ICP hubs

• Generative AI features

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com