← Back to Blog
Hot TopicOn This Site

EU AI Act Article 50 Watermarking Deadline (2 December 2026): What AI Startups Must Do Before It Hits

On 2 December 2026 the grace period ends for generative AI products that were on the EU market before 2 August: their text, image, audio and video output must be machine-readably marked as AI-generated. Products launched after 2 August were already covered, and the deepfake and AI-text labelling duties have applied since August. Here is what Article 50 actually says, what Anthropic and xAI have switched on (and what they haven't), and the checklist I'd run on an AI startup's product in the next three weeks.

·10 min read

On 2 December 2026, the EU AI Act's grace period for marking AI-generated content runs out. Under Article 50(2), providers of AI systems that generate synthetic text, images, audio or video must make sure the output is "marked in a machine-readable format and detectable as artificially generated or manipulated". That duty has applied since 2 August 2026; Article 111(4) gives products that were already on the market before 2 August until 2 December to catch up. If your startup ships a feature that generates content and any of that output reaches people in the EU, three weeks is what you have left. The good news: the big model providers are adding watermarks upstream. The catch: those marks only help you if your pipeline keeps them intact, and at least one major API ships with watermarking switched off.

I'm Kunal Vohra, a fractional CTO for AI-first startups and a security researcher and cybersecurity advisor. I run ColadAI, a multi-LLM platform, so "which of our models actually marks its output?" is a question I care about directly. This is not legal advice; it is the engineering read I'd give a founder before they talk to their lawyer.

Who should care

  • AI startups selling into the EU. If your product generates text, images, audio or video for users, you are very likely a "provider" of an AI system in the Act's sense, even if the model underneath belongs to Anthropic, OpenAI, Google or xAI.
  • Non-EU startups with EU users. The Act reaches providers and deployers outside the EU when the output is used in the Union (Article 2). An Indian or US SaaS with customers in Berlin is in scope for those customers.
  • Products launched before 2 August 2026. You are the group the 2 December deadline is written for.
  • Anyone who launched after 2 August. You do not get a grace period. Article 50(2) has applied to you from day one.
  • Teams that post-process model output. Rewriting, translating, re-encoding images, or chaining a second model can strip or dilute the mark the first model added.
  • Companies publishing AI-written content or synthetic media. The labelling duties for deepfakes and AI-written text on matters of public interest are deployer duties, and they already apply.

What actually changed, with dates

The AI Act's general application date is 2 August 2026 (Article 113). Article 50, the transparency article, is not on the list of postponed provisions, so it applied from that date. The Digital Omnibus on AI, which moved the high-risk deadlines (Annex III systems to 2 December 2027, Annex I to 2 August 2028), added a narrow transitional rule for Article 50 instead of moving it.

That rule is Article 111(4): providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content "that have been placed on the market before 2 August 2026" must comply with Article 50(2) "by 2 December 2026".

Read that carefully, because a lot of coverage blurs it:

  • It covers providers only, not deployers.
  • It covers only products already on the market before 2 August 2026. Something you launched in September has no grace period.
  • It covers only Article 50(2), the machine-readable marking duty. Everything else in Article 50 has applied since 2 August.

Here is what each part of Article 50 asks, in plain terms:

  • 50(1), providers: an AI system that interacts directly with people must be designed so they are told they are dealing with an AI, unless that is obvious.
  • 50(2), providers: synthetic output must be marked in a machine-readable way and be detectable as AI-generated. The technical solution must be "effective, interoperable, robust and reliable" as far as technically feasible. It does not apply where the AI performs an assistive function for standard editing or does not substantially alter the input.
  • 50(4), deployers, deepfakes: if you use AI to generate or manipulate image, audio or video content that is a deepfake, you must disclose that it is artificial. Artistic, satirical and fictional works get a lighter disclosure duty.
  • 50(4), deployers, AI text: if you publish AI-generated text "with the purpose of informing the public on matters of public interest", you must disclose it, unless the text has gone through human review or editorial control and someone holds editorial responsibility for it. Both conditions, not one.
  • 50(5): the information must be given at the latest at the first interaction or exposure.

Fines for breaking Article 50 sit in the Article 99(4) tier: up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher, and for SMEs and start-ups, whichever is lower (Article 99(6)). The EUR 35 million or 7 percent figure you may see quoted is for the prohibited practices in Article 5, not for watermarking.

The 2 December deadline is not really about which model you picked. It is about whether the mark survives everything your product does after the model answers.

The Code of Practice

Article 50(7) asks the Commission to facilitate codes of practice on detecting, marking and labelling AI content. The Commission's second draft, published in March 2026, describes a voluntary code with a section for providers built on "a revised two-layered marking approach involving secured metadata and watermarking", and a section for deployers on labelling deepfakes and public-interest text. At that point the Commission expected to finalise it by the start of June. The Cloud Security Alliance reports that it was finalised in June with about 190 signatories by the end of July, and Anthropic says it signed. I could not open a final version on the Commission's site, so treat the final details as reported, not confirmed. Signing is voluntary; the Article 50 duty is not.

What the model providers have switched on

Anthropic published how Claude's text watermark works in August 2026 and said future models would carry it to comply with the AI Act. Its release notes for 3 November 2026 say text generated by Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 now carries the watermark on the listed platforms. Its support page lists the text watermark for current models (the Fable 5.x, Mythos 5.x, Opus 4.7 to 5.5, Sonnet 4.6 to 5.5 and Haiku 5.5 families), C2PA only for some older models, says the Amazon Bedrock rollout completes by 10 November, and notes that Sonnet 4.6 may not carry the mark when temperature, top_p or top_k are set to non-default values. Detection is in private preview.

xAI documents text watermarking for grok-4.3 through grok-4.7 and the grok-4.20 family, on both the Responses and Chat Completions APIs. Some coverage this week said it is on by default. xAI's own documentation (updated 9 November) says the opposite: "Text watermarking is off by default." A team admin turns it on per model in the console, each response carries an x-watermark header (true means the output was watermarked), and turning it off for a model requires confirming that a legal exception applies to you. Both Anthropic and xAI say their text watermark is based on Google DeepMind's SynthID Text approach.

I could not confirm a current OpenAI or Google announcement on this from their own pages for this post, so check those providers' documentation directly if you use them.

The practical core: a checklist for the next three weeks

1. Inventory every feature that generates content

List every place your product produces text, images, audio or video with AI, and where that output goes: shown in the app, emailed, exported, published, posted to a customer's channels. Note whether EU users or EU customers' end users can receive it. Most teams find two or three generation paths they had forgotten, such as AI-written notification emails or support replies.

2. Decide your role for each feature

If your product generates content for users, treat yourself as the provider of that AI system for Article 50(2). If your team uses AI to create content that you publish yourself (marketing, news-style posts, synthetic video ads), treat that as deployer use under 50(4). Many startups are both. This is my engineering reading; confirm it with counsel for your specific product.

3. Check the launch date

Was the feature on the EU market before 2 August 2026? Then 2 December is your deadline. Launched after? You are already expected to comply. Either way, the work is the same.

4. Map the upstream mark for each model

For each model in each feature, write down: does the provider mark this model's output today, by what method (text watermark, C2PA metadata, both), and is anything required from you to keep it on? Concretely:

  • Anthropic models: check the model against Anthropic's support table. On Sonnet 4.6, leave temperature, top_p and top_k at their defaults if you rely on the mark; Anthropic's guidance is to omit all three.
  • xAI Grok models: turn watermarking on in the console for every model you use, then verify it on live traffic.
  • Open-weight models you host yourself (Kimi, Mistral, Llama and so on): nobody marks the output for you. You are the provider of the system, so the marking is your job. See my Kimi K3.1 Pro post for why self-hosting has other costs too.
  • Older models with no text mark: plan the migration now.

5. Verify on live traffic, not in a slide

For xAI, the header makes this a one-line check you can log on every request:

import os, httpx

resp = httpx.post(
    "https://api.x.ai/v1/chat/completions",
    headers={"Authorization": f"Bearer {os.environ['XAI_API_KEY']}"},
    json={
        "model": os.environ.get("XAI_MODEL", "grok-4.7"),
        "messages": [{"role": "user", "content": "Write a two-line product update."}],
    },
    timeout=60,
)
marked = resp.headers.get("x-watermark") == "true"
print("watermarked:", marked)  # log this per request, alert if it flips to False

For Anthropic, add a guard in your client wrapper so nobody quietly reintroduces sampling parameters on a model that needs defaults:

const NEEDS_DEFAULT_SAMPLING = new Set(["claude-sonnet-4-6"]); // check model ids against Anthropic's docs

export function buildRequest(model: string, params: Record<string, unknown>) {
  if (NEEDS_DEFAULT_SAMPLING.has(model)) {
    for (const key of ["temperature", "top_p", "top_k"]) {
      if (key in params) throw new Error(`${key} breaks the text watermark on ${model}`);
    }
  }
  return { model, ...params };
}

Both snippets are starting points, not tested drop-ins; adjust them to your SDK and model ids.

6. Find the steps that strip the mark

This is where most products will fail quietly. Walk each generation path and flag:

  • A second, unmarked model that rewrites, summarises or translates the first model's output.
  • Heavy templating or human-style "humaniser" passes that rewrite most of the text.
  • Image pipelines that re-encode or resize and drop embedded metadata such as C2PA manifests. If your image provider attaches C2PA, make sure your CDN, resizer and storage keep it.
  • Exports (PDF, DOCX, CSV) where metadata does not travel at all.

If a step strips the mark, either remove the step, move it before the marked model, or add your own marking at the end.

7. Add the human-facing disclosures you already owe

Chat interfaces should say plainly that the user is talking to an AI (50(1)). Synthetic video, voice or images that could pass as real need a visible label (50(4)). AI-written posts on matters of public interest need a disclosure unless a named person edits and takes editorial responsibility. These have applied since 2 August, with no grace period.

8. Write it down

One page per feature: what generates content, which model, how output is marked, how you verify it, who owns it, and the date you checked. If a customer's procurement team or a regulator asks, this page is your answer. It also feeds the same governance file I recommend in my AI agent security guide.

9. Put it in your contracts and your sales answers

Enterprise buyers in the EU will start asking "is your AI output marked?" in security questionnaires. Have a short, accurate answer ready, and do not claim more than your checks show.

What I'd do as a CTO

With three weeks to go, I would not start a compliance programme. I would run a two-day sprint: day one for the inventory, role decision and model map (steps 1 to 4), day two for live verification and the strip-points review (steps 5 and 6), then a week to fix whatever the review finds. The disclosures in step 7 are usually a few lines of UI copy, so do them now, because they are already overdue if you have EU users.

I would also use this as the moment to put every model call behind one internal client, if you have not already. It is the cheapest way to enforce watermark settings, log the x-watermark header, block bad sampling parameters and switch models when a provider changes its policy. I made the same argument for cost and vendor reasons in my AI API comparison for business; now there is a regulatory reason too.

Indian founders will recognise the pattern from the DPDP Act: the law sets a duty, the engineering decides whether you meet it. If no one on your team owns AI governance, that is a gap a fractional CTO or a technical advisor can close quickly, and it is part of what I describe in what a fractional AI officer does.

Frequently asked questions

Is 2 December 2026 the deadline for every AI company? No. Under Article 111(4) it applies to providers of generative AI systems placed on the EU market before 2 August 2026, and only for the Article 50(2) marking duty. Products launched on or after 2 August have had to comply since launch, and the deployer duties in Article 50(4) have applied since 2 August.

Does the EU AI Act watermarking rule apply to startups outside the EU? It can. The Act covers providers and deployers outside the EU where the AI system's output is used in the Union. If EU users receive your generated content, assume the rule applies to that content.

I use the Claude or Grok API. Isn't marking the model provider's job? Partly. Anthropic now marks output from a list of models, and xAI offers marking if you switch it on. But you are the provider of your own product, and the duty is that its output is marked. If you use a model without a mark, turn the mark off, or strip it in post-processing, the provider's watermark does not help you.

What are the fines for not marking AI content? Article 50 breaches fall under Article 99(4): up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher. For SMEs and start-ups, the lower of the two applies.

Do I have to sign the EU Code of Practice on AI-generated content? No, the code is voluntary. It is a way to show how you meet Article 50, but the obligation applies whether you sign or not.

Does a chatbot need a watermark? A chatbot has two duties: telling users they are talking to an AI (50(1)), and, if it generates text, image, audio or video content, marking that output in a machine-readable way (50(2)). An assistive feature that only does standard editing, or does not substantially alter the input, is exempt from the marking duty.

If you want a second pair of eyes on your generation paths before 2 December, book a 30-minute call. Bring the list of features that generate content and the models behind them, and we'll find the strip points together.

Sources

Written By

Kunal Vohra

Kunal Vohra

Technical Co-Founder & Fractional CTO

I've co-founded 6+ startups across India, the UAE, and the US, spanning AI, Web3, fintech, and cybersecurity. I write about the technical and strategic decisions that determine whether a startup thrives or stalls.

Work With MeMedium →LinkedIn →

Comments

Loading comments…

Enjoyed this article?

More writing on AI, Web3, and building startups.

← All ArticlesWork With Me