A Practical Guide to the EU Code of Practice on Marking and Labelling AI Content
What the Code asks of providers and deployers, what the evidence says about whether marking actually works, and how to design disclosure that builds trust instead of quietly eroding it.
When the Label Is the Easy Part
Picture the communications lead at a small patient-advocacy charity on a Friday afternoon. She has an AI-generated illustration ready for a campaign about a rare disease, an AI-drafted explainer sitting beside it, and a board meeting on Monday. Somewhere in the back of her mind is a question she has been putting off. Does any of this need a label now? And if it does, what does a label even accomplish once the image leaves her hands and starts travelling through screenshots, reposts and someone’s group chat?
That question stopped being abstract on 2 August 2026. That is the date the European Union’s transparency rules for AI-generated content become enforceable. And on 10 June 2026, the European Commission published the thing meant to help her answer it: the final Code of Practice on marking and labelling of AI-generated content (European Commission press release, IP/26/1328).
I read these documents for a living, and I want to be useful rather than alarming. So this is a practical guide. But it is also an honest one, because the tidiest part of this story, the compliance checklist, sits on top of a much messier truth about whether marking synthetic content actually does what we hope it does.
Why this matters now
Let us start with what is real and dated, because timing is where most people get confused.
The legal duty comes from Article 50 of the EU AI Act. It is a transparency provision, not a high-risk one, and that distinction matters. Much of the AI Act is aimed at a narrow set of high-risk systems. Article 50 is aimed at almost everyone. As the EU AI Act’s own explainer notes, transparency is the second most common compliance trigger across organisations after AI literacy, touching roughly a third of respondents to its compliance checker (artificialintelligenceact.eu, Article 50 guide).
Article 50 does four main things. It requires that people be told when they are interacting with an AI system, such as a chatbot. It requires providers of generative AI to mark their outputs in a machine-readable way. It requires deployers to disclose deepfakes. And it requires deployers to label AI-generated or AI-manipulated text published to inform the public on matters of public interest, unless that text has had human review and someone has taken editorial responsibility for it.
The Code of Practice does not replace any of that. It is voluntary. What it offers is a recognised way to demonstrate that you are meeting those duties, drafted by independent experts through a process the AI Office facilitated with more than 200 stakeholders (Commission FAQ on the Code). The mechanism mirrors the earlier code for general-purpose AI. If you follow the Code, regulators treat that as evidence you are compliant. If you do not, you carry the burden of proving compliance some other way.
Two dates deserve a place on a wall somewhere. The obligations bite on 2 August 2026. And to appear on the first published list of signatories, the Commission asked for completed signatory forms by 18:00 CET on 22 July 2026 (TechPolicy.Press analysis of the Code).
One nuance saves a lot of panic. The Digital Omnibus, a simplification package that reached provisional agreement on 7 May 2026, gives generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the machine-readable marking requirement specifically (artificialintelligenceact.eu). The transparency duties themselves were not postponed. So this is a short bridge for one technical obligation, not a general reprieve.
Why does any of this matter beyond a compliance calendar? Because the ground it stands on is moving fast. A Gallup and Stop Scams Alliance survey of more than 5,000 US adults, published on 1 July 2026, estimated that Americans lost around 68 billion dollars to scams in 2025, and that roughly 12 percent of those scams involved AI or a deepfake, a figure the authors themselves suspect understates the real number because victims often cannot tell (Gallup / Stop Scams Alliance, via reporting). Gartner’s September 2025 survey of 302 cybersecurity leaders found that 62 percent of their organisations had faced a deepfake attack in the previous year (Gartner, via Keepnet). And an iProov study in 2025 found that only 0.1 percent of participants could correctly sort every real and fake piece of media they were shown (iProov, via Deepstrike).
Read those together and the case for transparency writes itself. If almost nobody can tell synthetic from real by eye, we need signals in the content itself. That is the promise Article 50 is trying to keep.
The deeper problem
Here is the problem behind the problem.
Marking and labelling are two different things solving two different failures, and conflating them is where organisations go wrong.
Marking is machine-readable. It is metadata and watermarks embedded so that platforms, detectors and other systems can recognise AI origin without a human squinting at the pixels. It is mostly a provider job under Article 50(2).
Labelling is human-readable. It is the visible disclosure, the icon, the line of text that tells an actual person, this is a deepfake, or this article was written by AI. It is mostly a deployer job under Article 50(4).
The deeper problem is that both depend on the signal surviving a journey it was never designed to survive. Content does not stay where it is made. It gets screenshotted, re-uploaded, cropped, compressed, translated, quoted and stripped of its metadata by the very platforms people share it on. A label a user can peel off is not really a label. And that is not a cynical take, it is the Commission’s own reasoning. The Code deliberately asks for a layered approach, metadata plus watermarking plus logging, precisely because it accepts that metadata alone is easily removed (aibuzz.blog on the Code’s multi-layer approach).
So the real question for any organisation is not “did I put a label on it”. It is “will anyone downstream still know the truth about this content after it has been through the wringer”. That reframing changes everything about how you should implement the Code.
What the evidence shows
Let us look honestly at whether the technical machinery holds up.
The good news first. Watermarking at scale is no longer theoretical. Google’s SynthID has now been applied to more than 20 billion pieces of AI-generated content, by far the largest deployment of its kind, and it was open-sourced for text (aibuzz.blog). The watermark is spread across the content rather than sitting in one place, which helps it survive cropping, compression and format changes. The C2PA standard, backed by a broad industry coalition, adds cryptographically signed provenance data that records how a file was made and edited. Combine SynthID-style watermarking with C2PA credentials, as Google now does, and you get identification that survives more of the journey than either method alone.
Now the honest news. None of this is robust against a determined adversary. A group of computer scientists, Christ and colleagues, proved that a watermark that is genuinely undetectable requires cryptographic secrecy, and that no watermark is secure against a dedicated white-box attacker who can inspect the model (arXiv survey citing Christ et al.). Metadata is routinely stripped by social platforms on upload. Credentials can be forged if the signing keys are ever compromised, and a single compromised key could mint unlimited fake credentials (Editors Weblog on C2PA limits). AI detection tools, the retroactive fallback, are probabilistic and, by several accounts, getting less reliable as models improve.
Put plainly: these systems are good at keeping honest content honest. They are weak against someone who actively wants to deceive. That is a real limitation, and any guide that pretends otherwise is selling something.
Then there is the part almost no compliance memo mentions: what labels do to people.
You would assume a label helps a reader. Sometimes it does the opposite. Researchers have documented an “implied truth effect”, first named by Pennycook and colleagues in 2020: when you flag only some false content as false, people infer that the unflagged content must be fine, which raises their trust in the false things you did not catch (Pennycook et al., 2020, Management Science, summarised via MIT GenAI). A 2026 study from the Hertie School found the same asymmetry for AI labels specifically, calling it an “implied authenticity effect”. Label some AI images and unlabelled content, including unlabelled AI content, gets a quiet credibility boost (Hertie School).
There is more. People tend to distrust content labelled “AI-generated” even when it is accurate, an instance of what researchers call algorithm aversion (arXiv, AI labelling and perceived accuracy). Part of the reason is that “AI-generated” reads to many people as “fully automated, no human involved”, so they discount honest, carefully human-edited work that happens to carry the label (PNAS Nexus study).
I find this genuinely uncomfortable, because it complicates the clean story. The whole point of a label is to inform. The evidence says a label can misinform by implication, and can penalise the very transparency it rewards. That does not mean labelling is pointless. It means labelling has to be done thoughtfully, and coverage matters enormously. The studies are consistent on one thing: the more comprehensive and consistent the labelling, the less room there is for the implied-truth asymmetry to do damage.
Different sides of the debate
Reasonable people disagree here, and I want to represent the strongest version of each view rather than a strawman.
Get Anjula Weeranayake’s stories in your inbox
Join Medium for free to get updates from this writer.
The case for the Code and for marking in general. Almost nobody can spot synthetic media by eye, fraud losses are large and rising, and doing nothing leaves the field to bad actors by default. A shared, EU-wide framework beats a patchwork of national rules and gives honest organisations a defined path instead of an open-ended “are we doing enough” anxiety. Even imperfect friction has value. If marking makes casual deception a little harder and gives platforms and journalists a signal to work with, that is a public good. Perfect is not the standard. Better than nothing, at scale, is.
The case against, version one: this regulates the compliant. The people who will dutifully sign the Code and watermark their outputs are, almost by definition, not the ones running industrialised deepfake fraud. A sophisticated attacker strips the mark, forges the credential, or uses a model with no watermarking scheme at all, and the vast majority of AI tools currently have none. So the honest carry the cost and the dishonest are untouched. There is force in this. It is the same critique levelled at gun registries and DRM. The counter is that transparency is not primarily an anti-fraud tool, it is a trust infrastructure, and infrastructure is judged over years, not by whether it stops the cleverest criminal on day one.
The case against, version two: labels can make things worse. Given the implied-truth and algorithm-aversion findings, mandatory labelling could reduce trust in legitimate, carefully-produced AI-assisted content while inadvertently boosting trust in unlabelled junk. If you get the design wrong, you have paid a compliance cost to degrade your own credibility. This is the most serious objection, in my view, because it is empirical and specific. The answer is not to abandon labelling but to design it well and push for comprehensive coverage, which is exactly where the research points.
The case against, version three: proportionality. For a three-person NGO producing a handful of AI-assisted graphics a year, the operational overhead of provenance pipelines and signatory paperwork can feel wildly out of scale with any harm it might cause. The AI Act does build in SME proportionality on fines, and much AI-assisted work will not need a visible label at all, but the fear of getting it wrong is itself a cost. This one deserves sympathy rather than a lecture.
What most discussions miss
Most coverage of the Code fixates on the icon and the deadline. Three things get missed, and they are the things that actually matter in practice.
First, the human-review carve-out is the most important sentence in the whole regime for most organisations. AI-generated or AI-manipulated text published on matters of public interest does not need an AI label if a human has reviewed it and taken editorial responsibility for it (artificialintelligenceact.eu). That is the difference between an AI draft your editor signs off on, which is generally fine, and an unreviewed AI feed publishing straight to the public, which needs labelling. For an NGO or a marketing team, building a genuine human-review step into the workflow does two jobs at once. It improves the content and it sidesteps much of the text-labelling problem. This is a design win hiding inside a compliance rule.
Second, deepfake disclosure for deployers does not depend on whether the upstream tool marked the content. If you generate or manipulate image, audio or video that could plausibly pass as real people, places or events, you owe the disclosure, full stop, whatever your vendor did or did not do (ComplianceHub.Wiki). You cannot outsource that duty to the model provider.
Third, the Commission gave you an off-the-shelf label. Annex I of the Code includes an optional EU icon in three variants, so you do not have to design or defend your own (Commission FAQ). For audio-only content, where a visual icon makes no sense, the Code contemplates spoken disclaimers. Using the standard icon buys you consistency and defensibility for free.
Possible solutions and how to actually comply
Here is the practical part. I will treat each step as an intervention: what it is, why it works, who has to act, what could go wrong, and how you would know it worked.
1. Inventory your AI content, honestly. What it is: Map every workflow where AI touches something you publish externally. Website copy, social posts, campaign images, chatbot, reports, newsletters. Why it works: You cannot label what you have not found. Most compliance failures here are failures of visibility, not intent. Shadow AI use across teams is the usual culprit. Who acts: Whoever owns content operations, with input from every team that publishes. What could go wrong: People forget the tools they use casually, and the map goes stale within a month. How you measure success: A living register that a new joiner could read and understand, reviewed quarterly.
2. Classify by role and content type. What it is: For each item, decide whether you are a provider or a deployer, and whether the content is a deepfake, public-interest text, a chatbot, or something outside scope. Why it works: The obligations differ sharply by category. There is no single blanket rule for every AI-assisted advert or blog post, so classification is what tells you which rule applies. Who acts: Compliance or legal, with content leads. What could go wrong: Over-labelling everything out of caution, which, given the implied-truth research, can quietly harm your credibility. How you measure success: Every published item has a recorded classification and a one-line rationale.
3. Build a real human-review step for text. What it is: A named person reviews AI-drafted public-interest text and takes editorial responsibility. Why it works: It triggers the carve-out and improves quality at the same time. Who acts: Editors, comms leads. What could go wrong: “Review” becomes a rubber stamp, which fails both the spirit and, if tested, the letter. How you measure success: An audit trail showing who reviewed what, and evidence that reviews change things.
4. Adopt provenance at the point of creation. What it is: Turn on Content Credentials (C2PA) in the tools that support it, and prefer models that watermark, such as SynthID-enabled ones. Why it works: Provenance established at creation is far more durable than anything bolted on later. It travels with the file and survives more of the journey. Who acts: Whoever configures your creative and publishing tools. What could go wrong: Platforms strip the metadata on upload, so credentials alone are not enough. Combine them with a durable watermark and a visible label. How you measure success: Spot-check your own published assets. Can you still verify their origin after they have gone through your main distribution channels?
5. Use the standard EU icon and consistent disclosure. What it is: Apply the Annex I icon or an equivalent, and use it comprehensively rather than on a random subset. Why it works: Consistency is the single best defence against the implied-authenticity asymmetry. Coverage is the fix the research keeps pointing to. Who acts: Design and comms. What could go wrong: Labelling only your image posts and not your text creates exactly the asymmetry you are trying to avoid. How you measure success: A reader could not reasonably infer that your unlabelled content is “the trustworthy stuff”.
6. Decide on signing, and keep an evidence file either way. What it is: Choose whether to sign the relevant section of the Code, and regardless, document how you meet Article 50. Why it works: Signing converts an open-ended question into a checklist and gives you a presumption of good faith. Not signing is defensible only if your own approach is demonstrably at least as rigorous. Who acts: Leadership and legal. What could go wrong: Treating the signature as the finish line rather than the paperwork on top of real practice. How you measure success: You could hand a regulator a folder tomorrow and feel calm about it.
Risks and trade-offs
No honest guide ends without the downsides.
The penalties are real but not the top tier. A breach of Article 50 can draw a fine of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher, under Article 99, enforced by national market surveillance authorities, with the lower figure applying to SMEs (aiactblog.nl on Article 50 enforcement). That is serious money, though it sits below the 35 million euro or 7 percent reserved for the prohibited practices in Article 5. Enforcement will also depend on national rules, the facts of a breach, and proportionality. This is not automatic liability. It is exposure that rewards preparation.
The trade-off inside the Code itself is the one I keep returning to. Follow it well and you may still not have earned trust, because the label can be stripped, ignored, or read as a red flag on honest work. Over-comply and you risk the implied-truth effect. Under-comply and you risk both a fine and the erosion of your own credibility when the AI origin comes out anyway. There is no setting that removes all risk, only a setting that is defensible and thoughtful.
And there is a quieter risk. If every organisation labels everything mechanically, “AI-generated” becomes background noise, a cookie banner people click past. The label survives, the meaning dies. Avoiding that is not a legal problem. It is a communication one, and it is on us.
My conclusion
After weighing all of it, here is where I land, and I will be honest about my uncertainty.
Sign or align with the Code. For the large majority of organisations that publish AI content, it is the cleanest, most defensible route to a duty you cannot escape, and it saves you from inventing your own compliance story from scratch. That part I am confident about.
But do not mistake the Code for the goal. The goal is a public that can still tell what is real, and the evidence says marking and labelling contribute to that goal without guaranteeing it. The technology is strong against the careless and weak against the determined. The psychology of labels is more double-edged than anyone drafting a compliance memo wants to admit. So treat the Code as a floor you build trust on top of, through consistent disclosure, genuine human review, provenance at creation, and content you would stand behind with your name on it.
What would change my mind? Two things. If robust, adversary-resistant watermarking became standard across most AI tools rather than a handful, the “this only regulates the compliant” objection would weaken sharply, and marking would start to bite where it currently does not. And if larger, better-powered studies showed that comprehensive labelling reliably improves reader discernment without the implied-truth backfire, I would push organisations to label far more aggressively than I do now. The research is not there yet. I am watching for it.
Practical next steps
If you do nothing else this month, do these five things.
Map where AI touches your published content. Classify each item by your role and its type. Build one real human-review step for public-interest text. Turn on provenance in the tools that support it and add the standard EU icon consistently. Decide on signing before the 22 July signatory window if you want to be on the first list, and start an evidence file regardless.
None of this requires a large budget. Most of it requires an afternoon, a register, and the discipline to keep it current.
A closing thought
The comms lead from the beginning will get through her Friday. She will add the icon, note the human review, and post the campaign. The harder question is not whether she complied. It is whether, six months from now, when that image has been reshared a thousand times and the metadata is long gone, anyone will still be able to tell it apart from the thing designed to deceive them.
We are building the labels first and the trust second. Maybe that is the only order history allows. But if a label is only as good as the honesty of the person applying it, then the most important part of this Code is not in the Code at all.
So here is the question I would leave you with. When marking synthetic content becomes as routine as a cookie banner, will we have made truth easier to find, or just made the label easier to ignore?
