Article 50 transparency and marking/watermark testing
We test generative and conversational AI systems against Art. 50 of Regulation (EU) 2024/1689: the machine-readable mark on synthetic audio, image, video and text under Art. 50(2), its survival under ordinary transformations, its detection by a party other than the provider, and the interaction, deep fake and public-interest text disclosures under Art. 50(1) and 50(4). The procedure is PR-50-MARK v1.0. The client receives two test reports, two assessment memos and a findings register, itemised below. Art. 50 applies from the general application date In force.
Deliverables
The set is designed to answer an enforcement query or an internal review with records: which layers mark each modality, what survives which transformation, who can detect the mark, and where each disclosure sits. Each type is specified with a synthetic sample on deliverables: the two test reports, the two assessment memos and the findings register.
| Deliverable | Type | Format | Designed to satisfy |
|---|---|---|---|
| Marking architecture description (metadata, watermark, provenance layers in use) | Assessment memo | PDF with Markdown source | |
| Marking presence and survivability test report across re-encoding, resizing, screenshot and format conversion | Test report | PDF with Markdown source; CSV result tables; JSON run manifest | |
| Third-party detectability verification report | Test report | PDF with Markdown source; CSV result tables; JSON run manifest | |
| Chatbot disclosure and deepfake labelling UX audit against Article 50(1) and 50(4) | Assessment memo | PDF with Markdown source | |
| Remediation list | Findings register | XLSX; CSV; PDF summary |
Who this is for
- Generative AI features
The product has a chatbot, an image, audio or video generator, or a feature that writes text on matters of public interest. Art. 50 asks for three things from such a product: the person is told that they interact with an AI system, the synthetic output carries a machine-readable and detectable mark, and deep fakes and AI-generated public-interest text carry a label. The marking duty under Art. 50(2) is where testing matters: metadata, watermarks and provenance manifests are removed by ordinary re-encoding, resizing and screenshots, and the provider has to show what survives and what a third party can detect. The interaction notice under Art. 50(1) is a separate check: the notice is written for the interface, and Art. 50(5) sets the timing and placement rules it has to meet.
Two regulation entries set the timing: the Art. 50 application date, and the grace period that Art. 111(4) gives the Art. 50(2) marking duty for systems that generate synthetic content and were placed on the market before that date.
- In forceArticle 50 transparency obligations
- DeferredArticle 50(2) machine-readable marking for systems placed on the market before the Article 50 date
Scope
The engagement covers three kinds of system. The first is a provider system, including a system built on a general-purpose AI model, that generates synthetic audio, image, video or text on any output path: API, user interface, SDK or batch export. The second is a provider system that interacts directly with natural persons, such as a chatbot or a voice agent. The third is a deployer surface where a deep fake or an AI-generated text on a matter of public interest is published, or where an emotion recognition or biometric categorisation system operates. The artefacts tested are the sampled outputs per modality and output path, the interaction interfaces as a new user sees them, and each distribution surface; the marking architecture description and the exemption claim register are read as inputs and checked against observed behaviour. The limits of this service are stated on what we cannot do.
The test criteria come from three published documents: Code of Practice on Transparency of AI-Generated ContentPublished for the marking layers, the detection solution commitments and the Art. 50(4) label rules; Commission guidelines on Article 50 transparency obligationsPublished for the scope of each duty, the exemption tests and the timing and accessibility reading of Art. 50(5); and C2PA Content Credentials specificationPublished as the technique reference for validating a provenance manifest. No harmonised standard is cited in the Official Journal for Art. 50, so no presumption of conformity is available for any technique set; the Code is a voluntary instrument under Art. 50(7) whose adequacy the Commission assesses, and a provider that does not adhere shows conformity with Art. 50(2) and (4) by other means. The status of each document is on standards.
The engagement does not determine whether Art. 50 applies to a function, which role the client holds, or whether a claimed exemption is valid; PR-CLS v1.0 under the classification and readiness assessment records that determination, and this service tests the behaviour that follows from it. It does not decide whether content is a deep fake or a matter of public interest, does not assess the lawfulness of personal data processing under Art. 50(3), and does not test adversarial removal of a watermark or a manifest. Art. 50 attaches no conformity assessment procedure of its own; where the system is also high-risk, Chapter III applies alongside under Art. 50(6), and the reports from this service feed the technical documentation without replacing the procedure in Art. 43.
Which set of marking techniques counts as adequate under Art. 50(2) is an unsettled point. The layer-set comparison in the protocol applies the working reading below and records the alternative reading next to the result.
What we test
The table lists every testable element of the Art. 50 obligation record, the protocol that covers it and the artifacts it produces for the record.
| Obligation | Testable element | Protocol | Artifacts |
|---|---|---|---|
| Art. 50 | Each function of the system is assigned to the Art. 50 paragraphs that apply to it (interaction, generation, emotion recognition or biometric categorisation, deep fake, public-interest text), and each claimed exemption under Art. 50(1), (2), (3) or (4) is checked against the observed behaviour of the function. | PR-50-MARK v1.0 |
|
| A natural person who starts an interaction sees or hears that they interact with an AI system at the latest at the first interaction, in a clear and distinguishable manner, without opening a separate page or document (Art. 50(1) with Art. 50(5)). | PR-50-MARK v1.0 | ||
| Every synthetic output of each modality (audio, image, video, text) carries a machine-readable mark on generation, verified on a sample of outputs per modality and per output path (Art. 50(2)). | PR-50-MARK v1.0 | ||
| Each marked output is detectable as artificially generated or manipulated by a detection solution that a party other than the provider can run, verified by running the detection on marked samples (Art. 50(2), detectability). | PR-50-MARK v1.0 | ||
| The mark survives a defined set of ordinary transformations for the modality (re-encoding, resizing, cropping, screenshot, format conversion, transcoding, copy and paste for text), verified per transformation with the survival result recorded (Art. 50(2), robustness). | PR-50-MARK v1.0 | ||
| The mark is readable by tools other than the provider's own, such as a provenance manifest validator or a shared detection interface, verified against at least one independent reader (Art. 50(2), interoperability). | PR-50-MARK v1.0 | ||
| The detection solution returns the correct result on marked outputs and on non-generated control samples, with the detection rate and the false-positive rate recorded against the target the provider justified (Art. 50(2), reliability and effectiveness). | PR-50-MARK v1.0 | ||
| A natural person exposed to an emotion recognition or biometric categorisation system receives the notice of its operation at the latest at the first exposure, verified on the deployment interface or premises (Art. 50(3) with Art. 50(5)). | PR-50-MARK v1.0 | ||
| Deep fake content shown to a natural person carries a disclosure that is perceivable at the latest at the first exposure, embedded so that ordinary display does not hide it, verified on each distribution surface (Art. 50(4) with Art. 50(5)). | PR-50-MARK v1.0 | ||
| Published AI-generated text on matters of public interest carries a disclosure at the point of publication, unless the editorial-control exemption is recorded for that publication, verified on the published surface (Art. 50(4) with Art. 50(5)). | PR-50-MARK v1.0 | ||
| Each disclosure under Art. 50(1), (3) and (4) conforms to the applicable accessibility requirements, verified with the accessibility checks the applicable requirement prescribes (Art. 50(5)). | PR-50-MARK v1.0 |
Art. 50 sets no numeric threshold; Art. 50(2) sets four qualitative criteria, effective, interoperable, robust and reliable, bounded by technical feasibility, the specificities of each content type, the cost of implementation and the generally acknowledged state of the art. Pass criteria follow a six-level hierarchy: a harmonised standard cited in the Official Journal (none as of the anchor date); a JTC 21 draft standard with its stage (none covers Art. 50); an ISO/IEC standard or technical report (none listed covers Art. 50); a Commission guideline or code of practice, which is the level in use here; NIST AI RMF or a sector framework; and the provider's justified state of the art. Where the Code states a quantity, the report cites the Code and the condition attached; no quantity is attributed to the Act. Where no published threshold exists, as for the detection rate, the false-positive tolerance and the transformation set, the target-setting step of PR-50-MARK v1.0 records the provider's justification against the context of use and the report compares the measured rate with that target.
Protocols used
One protocol runs in this service; its version and derivation are on its methodology page.
- PR-50-MARK v1.0Article 50 marking and detection protocolv1.0
PR-50-MARK v1.0 (full procedure) covers the eleven testable elements of the Art. 50 record: function-to-paragraph assignment and the behaviour check of each claimed exemption, the interaction notice, marking presence per modality and output path, survivability under a recorded transformation set, third-party detection, interoperability with an independent manifest validator, detection and false-positive rates against the justified target, the Art. 50(3) notice, the deep fake label, the public-interest text disclosure, and the accessibility of each disclosure. It produces the marking presence and survivability test report, the third-party detectability verification report, the interaction disclosure and label audit record and the remediation list. It shows presence and survival on the sampled outputs, paths and transformations only; it does not show survival under transformations outside the recorded set, does not test adversarial removal, and does not show that the detection solution stays available after the test date or that a market surveillance authority accepts the technique set.
Engagement shape
The engagement is fixed-scope, scoped per request, and follows the classification and readiness assessment, the entry service, which records which Art. 50 paragraphs apply to each function. The client provides access to the generating system on every output path, a test account per interaction interface with no prior session, the marking architecture description per modality, the detection solution with its third-party access terms, the provider's own detector or manifest reader, the target justification record, the exemption claim register, and the list of distribution surfaces.
The work follows the order of the protocol. Preparation records the scope, assigns each function to its paragraph, defines the transformation set, draws the sampling plan, collects control samples and installs the independent validator. Execution generates the samples, validates manifests, runs the detectors, applies each transformation, takes screenshots, pastes text, runs detection from outside the provider's environment and observes each interface and surface. Analysis computes the presence and detection rates, fills the survival matrix, compares each rate with the justified target and each layer set with the published Code. Reporting writes the two reports, the audit record, the remediation list and the run log with tool versions and sample hashes.
What we cannot do
- We do not perform conformity assessments where a notified body is required.
- We do not issue CE marking or the EU Declaration of Conformity.
- We are not a notified body.
- We do not give legal opinions on classification or liability.
- We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.
For this service that means the reports show what a mark did on the test date under the recorded transformations and readers; they do not show that the Commission or a market surveillance authority accepts the technique set, and the applicability and exemption determinations remain with the provider, the deployer and their counsel.
What the client must have ready
The documentation and process elements of the Art. 50 record are inputs to the test, and the reports cite them as received.
Art. 50Transparency obligations for providers and deployers of certain AI systems
- Record of the assessment that an interaction is obvious to a reasonably well-informed, observant and circumspect person, for each function where the provider relies on the Art. 50(1) exemption. documentation
- Marking architecture description per output modality: the metadata, watermark and provenance layers in use, the point in the pipeline where each is applied, and the detection solution that reads each layer (Art. 50(2)). documentation
- Justification of the technical solution against the four Art. 50(2) criteria (effective, interoperable, robust, reliable), stating the technical feasibility limits, the specificities of each content type, the cost of implementation and the state of the art relied on. documentation
- Exemption determination record for each generating function claimed to perform an assistive function for standard editing or not to substantially alter the input data or its semantics (Art. 50(2)). documentation
- Detection solution description available to third parties: how a party other than the provider detects the mark, on what terms, and for which modalities (Art. 50(2), detectable). documentation
- Data protection record for the personal data processed by an emotion recognition or biometric categorisation system, and the record of the Art. 3(40) ancillary-and-strictly-necessary determination where the system is treated as outside the definition of a biometric categorisation system. documentation
- Editorial responsibility record naming the natural or legal person who holds editorial responsibility, and a description of the human review or editorial control measures, for each publication where the Art. 50(4) exemption is relied on. documentation
- Artistic-work determination record for each deep fake use where the limited disclosure under Art. 50(4) is relied on. documentation
- Law-enforcement authorisation record for any function that relies on the criminal-offence exception in Art. 50(1), (2), (3) or (4). documentation
- Obligation register entry that lists the Chapter III requirements and the other Union or national transparency duties that apply alongside Art. 50 (Art. 50(6)). documentation
- Record of adherence to the Code of Practice on Transparency of AI-Generated Content, or of the alternative means used to show conformity with Art. 50(2) and (4) (Art. 50(7)). documentation
- Grace-period record for a system placed on the market before the Art. 50 application date: the steps taken to meet Art. 50(2) and the date each step completed (Art. 111(4)). documentation
- Re-run the marking presence, survivability and detectability tests after each change to the model, the output encoder, the distribution surface or the marking library (Art. 50(2)). process
- Review the marking technique against the generally acknowledged state of the art and relevant technical standards at a set interval, and record the review outcome (Art. 50(2)). process
- Keep the detection solution available and operating for the outputs of every version of the system that remains in use (Art. 50(2), detectable). process
- Process the personal data of persons exposed to an emotion recognition or biometric categorisation system under the applicable data protection law throughout the use of the system (Art. 50(3)). process
- Operate the human review or editorial control workflow for public-interest text, and keep the named editorial responsibility current, wherever the Art. 50(4) exemption is relied on. process
- Operate the labelling workflow that attaches the deep fake or text disclosure before publication on each distribution surface (Art. 50(4)). process
- Monitor the Commission's adequacy assessment of the Code of Practice and any implementing act with common rules, and update the marking and labelling measures when either changes (Art. 50(7)). process
- Complete the steps to bring a system placed on the market before the Art. 50 application date into conformity with Art. 50(2) within the Art. 111(4) grace period. process
The marking architecture description names each layer per modality, the pipeline point where it is applied and the reader for it. The exemption claim register is a table with one row per function: the paragraph relied on and the reasoning. Where the editorial-control exemption under Art. 50(4) is claimed, the editorial responsibility record and a review record per publication are supplied before the disclosure checks run.
Questions
What is an AI watermark?
An AI watermark is a signal embedded in a generated output, imperceptible to a person, that a detector reads to state that the output is artificially generated or manipulated. The published Code of Practice on Transparency of AI-Generated Content lists imperceptible watermarking as one of the two machine-readable marking layers it expects under Art. 50(2), next to digitally signed metadata. PR-50-MARK runs the provider's detector on sampled outputs and on transformed copies of them and records survival per transformation in the survival matrix.
How do you verify C2PA Content Credentials?
Content Credentials are a provenance manifest bound to the file. Verification under PR-50-MARK follows the validation sections of the published C2PA Content Credentials specification: locate the active manifest, validate the claim signature, the time-stamp and the hard binding, and check that the assertion states the content is AI-generated. The protocol runs an independent open-source validator with a recorded version and trust list and compares its result with the provider's own reader. The result per sample goes into the manifest-validation-log of the third-party detectability verification report.
What does EU AI Act Article 50 require for content labelling?
Art. 50(4) requires a deployer that generates or manipulates a deep fake to disclose that the content is artificially generated or manipulated. The same paragraph requires a disclosure on AI-generated text published to inform the public on a matter of public interest, unless human review or editorial control applies and a person holds editorial responsibility. Under Art. 50(5) the label comes at the latest at the first exposure. PR-50-MARK records the label on each surface and whether it survives download, crop and re-share.
How does the AI Act apply to chatbots?
Art. 50(1) requires the provider of a system that interacts directly with natural persons to design it so that those persons are informed that they interact with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person. Under Art. 50(5) the notice comes at the latest at the first interaction. PR-50-MARK opens each interface as a new user and records when the notice appears and where it sits; the published Commission guidelines on Article 50 do not accept a notice placed only in terms or a help page.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.