AI Act Article 50 Marking: What the Law Demands on Dec 2, 2026 — and Why Current Watermarking Cannot Meet It Yet

On December 2, 2026, the last grace period for the AI Act's marking obligation expires. Providers of generative AI systems placed on the market before August 2, 2026 must then comply with Article 50(2) — machine-readable marking of synthetic outputs — without further extension.¹ That much is simple. Everything else sits in an uncomfortable gap: the law demands marking that is "effective, interoperable, robust and reliable as far as this is technically feasible", while the peer-reviewed literature shows every deployed watermarking class can be stripped or spoofed by a motivated attacker for the cost of a dinner for two.

This guide lays out both sides precisely: the statutory text and who it binds, the actual state of the watermarking art in September 2026, the published removal attacks with their measured success rates, and what a Mittelstand company, public authority, or medical organization should do before December 2. It complements the general AI Act and GDPR guide for self-hosted LLMs.

1. What Article 50 actually requires

Two boundaries matter for reading the table correctly.

Providers mark; deployers disclose. Article 50(2) is a provider obligation: whoever places the generative system on the market must ensure its outputs carry the machine-readable mark — Google marks Gemini outputs, not the Mittelstand company calling the API. The deployer-facing duties are the disclosure ones: Article 50(1)'s first-interaction disclosure stays with the provider; Article 50(3)/(4) bind the deployer, and for deepfakes and synthetic public-interest text the duty in Article 50(4) falls explicitly on the deployer.² A hospital publishing an AI-drafted patient information page, or an authority publishing a synthetic explainer video, owes disclosure regardless of what the model provider does.

The grace period is narrow, and it ends December 2, 2026. The Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) inserted a new Article 111(4): providers of generative AI systems already placed on the market before August 2, 2026 must comply with Article 50(2) by December 2, 2026.¹ Note the scope precisely. The transitional rule covers only the machine-readable marking duty of Article 50(2) — not the interaction disclosure of 50(1), not the deployer duties of 50(3) and (4), all of which have applied since August 2, 2026. And it applies only to systems placed on the market before the August 2, 2026 cutoff; anything newer needed compliant marking from day one. There is no general "AI Act grace period" ending December 2 — that date is the boundary for one obligation held by one role.

What counts as compliant marking? Article 50(2) demands that providers' technical solutions be "effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content [and] the costs of implementation".² That qualifier — as far as technically feasible — is where the entire practical dispute lives, and section 3 explains why it is not an escape hatch: the state of the art matters, and the state of the art has been measured against adversarial attackers.

Enforcement is national, by member-state market surveillance authorities, and the fine ceiling for Article 50 violations sits in the middle penalty tier: up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4), which names the Article 50 transparency obligations explicitly). For SMEs and start-ups the formula inverts — whichever is lower — so a company with €2 million in turnover faces a statutory ceiling of EUR 60,000, not EUR 15 million; the Digital Omnibus extended the same protection to small mid-caps.³ These are ceilings, not tariffs, and Article 99(7) requires authorities to weigh intent, mitigation, and cooperation.

2. The technical bar the statute sets

Stripped of legalese, Article 50(2) asks for a signal inside generated content that (a) a machine can read later, (b) survives benign handling between generation and inspection — cropping, re-encoding, upload pipelines — and (c) ideally survives a hostile party who wants it gone. The law does not say the mark must survive a hostile party. But "effective, robust and reliable" has no other defensible reading at scale, because on an open internet a mark that any screenshot defeats is a suggestion, not a marking. Whether the qualifier "as far as this is technically feasible" was drafted to acknowledge this gap or to paper over it is a fair question; either way, the feasibility cliff is real.

Three technologies are routinely conflated under "marking", and the differences decide everything:

C2PA is not a watermark. The C2PA standard (Coalition for Content Provenance and Authenticity, founded 2021 by Adobe, Arm, BBC, Intel and Microsoft) defines a signed manifest of assertions — generating tool, edit history, whether AI was involved — cryptographically bound to the file's bytes and signed with an X.509 certificate chain.⁴ As tamper-evident provenance it is excellent, and a growing list of generators (OpenAI, Adobe Firefly, and Google alongside SynthID) attach credentials by default. But a manifest is metadata: it travels with the container, not the content. A screenshot, a re-encoding CDN, or one line of code removes it without touching a pixel. The C2PA specification itself acknowledges this by defining durable credentials that pair a soft binding (a watermark) with the signed manifest — an admission that the metadata layer alone was never expected to survive the open internet.⁴ For the December deadline, C2PA metadata and a watermark are complements, and only the watermark class is even a candidate for "robust".

How generation-embedded watermarks actually work. For images and video, the watermark is a trained perturbation: the generator's output is nudged imperceptibly toward a pattern that a paired detector network recognises (Google's SynthID embeds into the pixels of every generated video frame this way).⁵ For text, the watermark lives in the sampling process: at generation time the model's token probability distribution is modulated — SynthID-Text, deployed in Gemini and open-sourced in 2024, runs a "tournament sampling" scheme; the academic green-list family biases generation toward a keyed subset of tokens. Detection then asks a statistical question: "does this text/image carry the expected pattern?" with a p-value attached.⁵ Both families are probabilistic detectors, not cryptographic proofs. Google's own documentation states the failure modes plainly: SynthID for text works best on long, diverse outputs, holds up under mild paraphrasing, and loses most of its confidence "when an AI-generated text is thoroughly rewritten or translated to another language".⁵

Keyed versus unkeyed. A detector that classifies statistical residue without a secret (post-hoc deepfake detectors, unkeyed watermarks) can be defeated by anyone, using only the attacked content. A keyed scheme — the watermark depends on a secret green-list or an unpublished detector — forces the attacker to first learn the key. That is a real barrier, and it is the design behind every serious production proposal. The next section is what that barrier turned out to be worth in practice.

3. The adversarial reality: what published attacks actually achieve

The headline numbers first, then the mechanism.

Text: watermarks can be stolen for under $50 and then scrubbed or spoofed at over 80% success. ETH Zurich's SRI Lab (Jovanović, Staab, Vechev) showed in Watermark Stealing in Large Language Models (ICML 2024) that an attacker with only black-box API access can reverse-engineer an approximate copy of a model's secret watermark rules for a one-time cost of under $50 in API pricing. With that approximation, the attacker can spoof — forge the watermark onto human-written text so it tests as AI-generated, over 80% success against the then state-of-the-art KGW2-SelfHash scheme, previously considered safe — and scrub: using the stolen key to guide a paraphraser, scrubbing success on the same scheme in long texts rose from almost 0% to over 80%, where no baseline method reached 25%.⁶ The authors' conclusion is blunt: spoofing at scale "nullifies the value of the watermark".

Images: diffusion purification strips low-perturbation watermarks with minimal visible change. Saberi et al. (University of Maryland), Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024), showed theoretically and empirically that a diffusion purification attack — adding noise to a watermarked image and reconstructing it with an off-the-shelf diffusion model — effectively removes low-perturbation watermarks while barely changing the image; high-perturbation watermarks such as TreeRing instead fall to a model-substitution adversarial attack (detector AUROC drops to 0.14), while StegaStamp is partially vulnerable to both. The theory is the uncomfortable part: a fundamental trade-off between the false-negative rate (watermarked images the detector misses) and the false-positive rate (clean images it falsely flags) under purification — you cannot push both to zero.⁷ A 2025 preprint pushes further, removing Stable Diffusion-embedded watermarks without any access to the watermark decoder (a "no-box" setting), degrading detection to roughly coin-flip level at approximately 47.92% using blur-based and fine-tuning attacks; treat that specific figure as preprint-reported, not peer-reviewed.⁸

Why this cannot be fully prevented — the structural argument. These papers are not one-off bugs; they express the geometry of the problem. A watermark must be embedded before knowing what transforms the content will undergo, and it must be invisible — a small statistical tip in a high-dimensional space. But "reconstruct something visually indistinguishable from this image" and "preserve an invisible statistical pattern in this image" are competing objectives whenever the reconstruction model is not the one that planted the pattern: pass a watermarked image through an unrelated diffusion model, and the purification is precisely a small, unknown transform — unknown to the embedder, as required — that regenerates the pixels from content alone. Robustness against benign edits and robustness against adversarial regeneration are the same property, just with a hostile choice of transform. Keyed schemes raise the bar: the attacker first needs the key. But the key is not physics — it is information, and every API response leaks a little of it, which is the ETH result: keys that must be usable through a public-facing API can be approximated with a modest query budget, and open-weight releases of the detector trivially end keyed security for that model. None of this says watermarking is useless — section 5 is the case for it — but "robust" in Article 50(2) cannot honestly be read as "cannot be removed by an adversary". The statute's wording and the measured state of the art align only in the statute's own qualifier: as far as this is technically feasible.

4. What to actually do before December 2, 2026

If you are a deployer — not the provider of the generative model — your Article 50(2) exposure is indirect: you cannot fail to embed a watermark you were never obliged to embed. Your obligations are the disclosure duties, plus procurement diligence over providers whose outputs you publish. Concretely, before December 2, 2026:

Two things not to do. First, do not roll your own watermark: detector calibration, false-positive control against human text, and key management are exactly where published schemes spent their research effort, and a home-grown scheme gives you compliance theatre plus a false sense of safety. Second, do not assume C2PA metadata on your provider's exports satisfies Article 50(2) alone — a mark a screenshot removes is weak evidence of "robust", even if it is a strong start.

The honest risk frame: the ceiling is 3% of worldwide turnover or EUR 15 million, whichever is higher (lower of the two for SMEs and, since the Omnibus, small mid-caps).³ For a €50 million Mittelstand firm, the statutory ceiling is €15 million — the higher of 3% of turnover (€1.5 million) and the €15 million floor — before the Article 99(7) factors pull the realistic number far down for a cooperating, documented, first-time offender. The rational response is proportionate: a two-to-four week documentation and disclosure-hardening exercise, not a compliance panic.

5. The critical view — and the case for the EU approach anyway

Article 50 is a legal mandate for a technology that its own qualifier admits is at research stage: "robust and reliable as far as this is technically feasible" is, read against the attack literature, a confession that the feasibility boundary is set by an arms race the regulator does not control. A determined adversary with API access and a small budget can scrub the current text SOTA most of the time; a diffusion model on a gaming GPU erases image watermarks invisibly. No honest technologist reads December 2, 2026 as "synthetic content will now be detectable". It will not be.

The defensible answer is that this was never the honest-majority problem. The overwhelming majority of synthetic content is produced and re-shared by people with no motive and no skill to run diffusion purification or steal green-list keys. A defence-in-depth stack — C2PA manifests for provenance on controlled pipelines, generation-embedded watermarks for durability in the wild, platform-side detectors for the residue — marks the honest majority near-completely. And marking regardless of adversarial robustness creates accountability asymmetry: an attacker who deliberately strips a watermark from content they publish is provably acting in bad faith in a way an unmarked file never proves — which turns intent questions, which courts handle well, into decidable ones. The EU's bet is that mandating an imperfect mechanism beats encouraging none, and that Union codes of practice on marking (facilitation moved to the Commission by the Omnibus) will pull the market onto a common signal faster than voluntary adoption did for email authentication, which took two decades and still fails. The mandate is clunky; the alternative was nothing.

The deadline stands regardless of the metaphysics. December 2, 2026 is a fixed calendar date in adopted law, a new Article 111(4), and it binds providers of pre-existing generative systems. Everything a deployer can be fined for under Article 50 binds now. Do the disclosure work, write the assessment down, and ask your provider what changed on their side — then you have met the law at the level it can actually be met, which in September 2026 is the only honest definition of compliance.

This article is general information on the legal and technical state of play as of September 24, 2026, not legal advice. Binding classification of your specific system requires individual review. For the broader framework — risk tiers, self-hosting role allocation, GDPR interplay — see the AI Act self-hosting guide.