Since every company in the world communicates with visuals, this act affects everyone
Two months out from application, Article 50 of the EU AI Act is generating more anxiety than clarity in the teams that produce and publish visual content. The date to remember is August 2, 2026. Systems placed on the market from that date must comply immediately. Systems already in service got a tighter grace period after the May 7, 2026 Digital Omnibus agreement, three months instead of six, which sets the final deadline at December 2, 2026.
Before talking about readiness, it’s worth clearing up what Article 50 actually says, and what it doesn’t.
Four myths still circulating
Myth 1: Article 50 only applies to high-risk AI systems. Wrong. It works the other way around. Article 50 applies horizontally to any generative AI system used in four specific situations, regardless of high-risk classification. A studio producing marketing visuals with a generative tool falls within scope. You don’t need medical AI or credit scoring to be concerned.
Myth 2: The AI vendor carries the whole compliance burden. Half wrong. Article 50 distinguishes two roles with distinct obligations. The provider, OpenAI, Adobe, Mistral, Gemini and the like, must ensure machine-readable marking on the system’s outputs. The deployer, the company using the system to produce and publish content, carries three distinct duties that compound across the workflow:
First, preserve the provider’s signal: when an AI tool ships its output with a C2PA manifest or embedded watermark, the deployer must not strip it through renditions, format conversions, or platform uploads.
Second, generate a signal when the asset is itself modified with AI, a Generative Fill, a background swap, or an AI upscale: the original provenance is no longer the whole story, and the modification needs to be declared in the metadata.
Third, label visibly: for deepfakes and texts intended to inform the public require a clear, persistent visible label at publication. A brand using Firefly or Midjourney in production is a deployer for all three. The legal exposure sits with the publisher, not just the toolmaker.
Myth 3: A watermark closes the case. Wrong. The draft Code of Practice published by the Commission is explicit: no single marking technique is sufficient on its own. Compliance rests on a combination of cryptographically signed provenance metadata (C2PA is the emerging reference), invisible watermarks robust enough to survive compression and cropping, and fingerprinting or logging as a fallback. A digital watermark alone does not cover the obligation.
Myth 4: Standard photo editing is now regulated. Not systematically. The text carves out pure assistive functions, grammar correction, standard editing adjustments, that don’t substantially alter the input or its semantics. Content that is manifestly artistic, satirical or fictional gets a lighter regime. The boundary remains interpretive, and the Commission’s draft Guidelines, published on May 8, 2026, have started to sharpen it. Generative Fill, object removal, scene expansion: these can qualify as substantial manipulation. Treat them as in scope until you have a documented reason not to.
What every visual needs in place before August
For any company publishing visual content, the operational question reduces to three capabilities.
Trace origin. Every asset entering your production chain has to be qualified at ingestion: AI-generated, AI-edited, or human-origin. This requires a dedicated provenance field in your asset system, populated either by reading the C2PA manifest when it exists, or by declaration at upload. Without that field, no labeling policy is enforceable at scale. This is true whether your asset system is a full DAM, a lighter media library, a cloud bucket, or a CMS.
Preserve marking. Renditions, format conversions, automatic cropping, social-platform reuploads, all of these routinely strip watermarks and erase provenance metadata. Audit the transformation chain. If an asset loses its C2PA manifest between ingestion and publication, the deployer’s obligation becomes inapplicable, and you carry the exposure anyway.
Decide and apply the label. For content that qualifies as a deepfake, defined in Article 3(60) as an AI-generated or manipulated image, audio, or video resembling real persons, places, or events to the point of appearing authentic, a clear and persistent visible label is mandatory at publication. This is the decision point most companies are unprepared for. It should be automated from provenance metadata where possible, with human validation for edge cases.
The part most companies are missing
Article 50 is being treated as a labeling tax. It isn’t. It quietly turns whoever publishes visual content into a transparency layer for the wider information ecosystem. Companies that approach it as a compliance checkbox will make it through August 2026 without incident and fail the first serious audit. Those who treat it as a chance to rebuild their metadata layer, provenance, origin state, and manipulation status will gain infrastructure that will pay off well beyond the regulation.
The deeper shift is this: until now, a published image carried whatever credibility the publisher’s brand conferred on it. From August onward, regulation assumes the image itself should carry signals of its own making. That changes what a content operation is for. The publisher becomes accountable not just for what an image shows, but for what it is.
August 2 isn’t a finish line. It’s the moment publishing stops being a one-way broadcast and starts being held responsible for the provenance of what it puts into the world.
Author: Paul Melcher
Paul Melcher is a highly influential and visionary leader in visual tech, with 20+ years of experience in licensing, tech innovation, and entrepreneurship. He is the Managing Director of MelcherSystem and has held executive roles at Corbis, Gamma Press, Stipple, and more. Melcher received a Digital Media Licensing Association Award and has been named among the “100 most influential individuals in American photography”