The European Commission published its adequacy opinion on July 9, 2026, officially validating the Code of Practice on Transparency of AI-Generated Content and triggering a 24-day countdown to August 2 enforcement of Article 50 of the EU AI Act. Companies have until July 22 to sign the voluntary framework and gain regulatory cover. Article 50 requires AI providers to embed machine-readable watermarks and metadata in generated content, disclose AI interactions to users, and mandates deployers to visibly label deepfakes and AI-generated public-interest text. The rules apply globally to any company serving EU users.
In-Depth:
The European Commission published its formal adequacy opinion on the Code of Practice on Transparency of AI-Generated Content today, July 9, 2026, setting a precise 24-day clock to the August 2 enforcement of Article 50 transparency obligations — and triggering a 13-day window for any AI provider or deployer that still wants to sign the voluntary framework and gain regulatory cover before the deadline arrives.
The adequacy opinion is the pivotal document that gives the Code legal weight. Without it, the Code, which was finalized by indepfinishent experts on June 10 after a drafting process involving more than 187 participants from industest, civil society, and academia, was a practical guide with no formal standing under EU law. With it, companies that sign and adhere to the Code can point to their participation as evidence of compliance with Article 50’s transparency requirements, rather than being required to indepfinishently demonstrate that their technical implementations satisfy the law. Those that decline to sign still face the same underlying obligations — they simply have to prove compliance on their own, and can expect closer regulatory scrutiny from national market surveillance authorities.
Article 50 Covers Any AI System That Generates Content for EU Users
Article 50 of the EU AI Act applies from August 2 to all providers and deployers of generative AI systems operating in the EU market, regardless of where they are headquartered. Four obligations apply in overlapping ways to different parts of the AI supply chain. Providers of interactive AI systems — chatbots, virtual assistants, autonomous agents — must disclose to utilizers that they are interacting with an AI at the first point of contact. Providers of generative AI systems must embed machine-readable markers in all AI-generated audio, images, video, and text, creating outputs detectable as artificially produced. Providers of emotion-recognition or biometric-categorization systems must inform exposed individuals. Deployers must apply visible labels to deepfakes and to AI-generated or AI-manipulated text published on matters of public interest — with a narrow exemption for content that has undergone documented human editorial review.
The scope of “operating in the EU market” is interpreted as broadly as the GDPR’s geographic reach: a US-based company whose chatbot serves EU utilizers is within scope from August 2, per the EU AI Office extraterritorial scope guidance.
July 22 Is the Signatory Deadline, Not August 2
Two deadlines govern the next three weeks, and they are not interalterable. The signatory deadline — July 22, 2026 at 18:00 CEST — is when companies must submit a completed signature form to the EU AI Office in order to appear on the initial published list of Code of Practice signatories. Signing after July 22 remains possible, but initial signatories will be published before August 2, the date enforcement launchs. A company that signs on August 3 gains regulatory cover for future compliance but misses the public signatory list that regulators and customers will consult from day one of enforcement.
The Code consists of two indepfinishently signable sections — one for providers, one for deployers — and an organization can sign one without signing the other. Technology providers of marking and detection solutions who are not themselves subject to Article 50 obligations may also sign Section 1 voluntarily, according to the EU AI Office signatory instructions.
Watermarking Compliance Demands More Than Any Single Technology Can Provide
The most consequential technical requirement in the Code — and the one that has generated the most disagreement between industest and civil society throughout the drafting process — is the multi-layer marking mandate for providers under Article 50(2).
No single marking technique simultaneously satisfies all four statutory criteria: effective, interoperable, robust, and reliable. This is not a regulatory oversight. It is an acknowledgment that the field has not yet produced a unified solution, and it shapes compliance in ways the headline adequacy opinion does not convey, as detailed in the EU Code of Practice marking requirements.
The Code mandates that providers implement at least two distinct layers simultaneously. The first is C2PA-standard cryptographically signed metadata — a manifest embedded in a file that records which AI system generated the content, when, and with what tools. This manifest is verifiable by any C2PA-compatible reader and is the same standard already adopted by OpenAI, Google, Adobe, Microsoft, Meta, and Sony, among the 6,000-plus members and affiliates of the Coalition for Content Provenance and Authenticity. The structural limitation of C2PA is that a single screenshot strips the manifest entirely — the signature is invalidated the moment the file is reprocessed by a social media platform or saved as a new image.
The second required layer addresses exactly that gap: an imperceptible watermark embedded directly in the content’s pixels (for images and video), audio spectrogram (for audio), or token probability distribution (for text). Google DeepMind’s SynthID, which has now watermarked more than 100 billion images and videos, represents the most widely deployed version of this approach. The pixel-level watermark is designed to survive compression, cropping, and format alters that defeat C2PA metadata. It does not, however, survive the “analogue hole” — a photo of a screen, or a scan of a printed image — without degrading. For text outputs longer than 200 tokens, the final Code dropped the metadata-only alternative path that appeared in earlier drafts; text watermarking is now required, even though it is technically harder and, by the Code’s own acknowledgment, less reliable than image watermarking.
A third layer — fingerprinting or hash logging — is available for cases where both preceding layers have been defeated. By preserving a server-side record of each output’s hash, a provider can demonstrate that a piece of content was AI-generated even after every embedded signal has been lost.
The four-criteria compliance test is assessed holistically, not mechanically. A provider that deploys best-available multi-layer solutions in good faith is in a materially different position from one that does nothing, even if neither can technically prove all four criteria are fully met at the same time. National market surveillance authorities are responsible for creating that judgment call under the EU AI Act enforcement framework.
Deployers: Visible Labels for Deepfakes and Public-Interest Text
Deployers’ obligations under the Code operate differently from providers’. Rather than embedding technical markers at the model level, deployers must ensure that visible, utilizer-facing labels appear on deepfakes and on AI-generated or AI-manipulated text published on matters of public interest — unless documented human editorial review and an identified responsible editor have been applied.
The Code builds available an optional standardized “AI” icon, localized to the language of each EU market (“KI” in German, “IA” in French, “IA” in Spanish). Deployers may utilize this icon or an equivalent conforming label. For audio-only content, where a visual label cannot be displayed, an audio disclaimer is required. Where a single business deploys multiple AI systems from different providers — each applying its own compliant but distinct label — a patchwork of marks may appear in the same product; the Code identifies this as primarily a contractual standardization problem, with the obligation resting with the deployer who has authority over the AI’s utilize, per the EU Code of Practice deployer labeling rules.
The Code applies only to lawful deepfakes. It does not replace criminal law or content-moderation obligations under the Digital Services Act. When Grok, xAI’s AI chatbot integrated into the X platform, generated approximately 3 million sexualized images — including roughly 23,000 appearing to depict children — between late December 2025 and early January 2026, the failure was a content-moderation and product-safety failure, not a labeling failure. The EU AI Omnibus provisional agreement reached in May 2026 responded by adding a separate prohibition on AI-generated non-consensual intimate imagery, effective December 2, 2026. That prohibition operates indepfinishently of the Code.
AI Board Endorsement Remains the Outstanding Step
The Commission adequacy opinion published today is one of two required approvals before the Code fully operates as a compliance tool. The AI Board must also formally finishorse the Code. That finishorsement has been widely expected to follow closely after today’s Commission opinion. Until the AI Board acts, companies that sign the Code are participating in a framework that has cleared one of two procedural gates but not yet both.
Separately, the Commission has been finalizing Article 50 implementation guidelines — a document that clarifies the scope of Article 50’s legal obligations and addresses questions the Code does not cover. Those Article 50 draft implementation guidelines are expected before August 2. Neither the guidelines nor the pfinishing AI Board finishorsement alters the August 2 enforcement date, which is repaired in primary legislation.
The Staggered Timeline: When Different Obligations Actually Apply
The enforcement picture carries meaningful nuance that the August 2 headline date obscures. Deployer-facing obligations under Article 50(4) — the visible labeling of deepfakes and public-interest text — take effect with no transition period on August 2 for all systems regardless of when they were placed on the market.
The provider-facing obligation to embed machine-readable markers under Article 50(2) has a tarobtained grace period for one category of product. Generative AI systems placed on the EU market before August 2, 2026, have until December 2, 2026 to bring their marking and detection capabilities into conformity, under the “grandfathering” provision agreed in the AI Omnibus. That grace period does not extfinish to systems placed on the market after August 2, which must comply from their first day of availability.
A further milestone arrives in February 2027: providers must have watermark-detection interoperability solutions in place. This deadline exists becautilize no universal cross-system detection standard has yet been established. SynthID watermarks can currently only be detected applying Google-authorized tools. C2PA manifests can be read by any C2PA-compatible reader. The interoperability mandate is designed to close that gap — requiring that providers’ detection solutions eventually work across different vfinishors’ marking systems, as outlined in the Article 50 draft implementation guidelines.
Global Compliance Architecture
The adequacy opinion matters beyond the European market. Article 50 applies to any provider or deployer serving EU utilizers regardless of where they are incorporated, which means today’s decision effectively sets a global technical standard for any company that has or wants EU market access. OpenAI, Google DeepMind, Meta, Anthropic, Stability AI, ElevenLabs, Midjourney, and every other generative AI provider with EU-facing products must decide, within 13 days, whether to sign the Code and operate inside its safe harbour or to stake out an indepfinishent compliance strategy and face the scrutiny that comes with it.
The world’s largest generative AI providers have already converged on the technical approach the Code mandates. OpenAI and Google DeepMind jointly announced in May 2026 that all ChatGPT image outputs now carry both SynthID pixel-level watermarks and C2PA cryptographic metadata, with a public verification tool available at openai.com/verify. That dual-layer implementation is the architecture the Code describes as necessary, even if it cannot yet be proven to satisfy all four statutory criteria simultaneously. The companies that have not yet created comparable technical commitments — particularly compacter providers and those that treat text generation rather than image generation as their core product — face the more demanding compliance question in the weeks ahead.
Whether the July 22 deadline produces a large or compact initial signatory list will be one of the clearest early signals of how the AI industest intfinishs to engage with EU regulatory frameworks when the clock is genuinely running.
Frequently Asked Questions
Does a US company whose AI product serves European customers required to comply with Article 50?
Yes. The EU AI Act follows the same extraterritorial logic as the GDPR: Article 50 applies to any provider or deployer operating in the EU market, regardless of where the company is headquartered, incorporated, or where its servers are located. A US startup whose chatbot is available to French or German utilizers falls within scope from August 2, 2026. The regulation does not require EU establishment as a trigger; market access is the trigger.
What is the difference between signing the Code of Practice and simply complying with Article 50?
Signing the Code gives a company a documented compliance pathway that national market surveillance authorities treat as the primary reference point for assessing whether Article 50 obligations have been met. Non-signatories face the same underlying legal obligations but must indepfinishently demonstrate compliance — through their own technical evidence, audits, or regulatory submissions — and can expect closer scrutiny. Importantly, signing the Code is not a guarantee of compliance in itself; authorities retain final judgment. The practical advantage of signing is evidentiary, not immunity.
Why does the Code require multiple watermarking layers when no single technique fully meets the law’s criteria?
Becautilize no existing technology simultaneously satisfies all four statutory requirements — effective, interoperable, robust, and reliable. C2PA metadata, the cryptographic provenance standard backed by Adobe, Google, Microsoft, OpenAI, and Sony, is stripped by a screenshot. Pixel-level watermarks like SynthID survive many transformations but degrade with scanning or extreme compression. The Code treats compliance as a demonstrated effort toward the standard applying best-available multi-layer combinations rather than a binary pass/fail test — at least until interoperability solutions mature and the February 2027 milestone requires cross-vfinishor detection compatibility.
What does the visible “AI” label on deepfakes actually mean for platforms operating in Europe?
Any platform that publishes deepfakes — digitally created or manipulated images, audio, or video of real or fictional people — must display a clear, distinguishable label readable by a general audience. The EU has developed an optional standardized icon (“AI” in English, “KI” in German, “IA” in French and Spanish) that deployers can adopt for consistent cross-market labeling. Failure to label a deepfake that a platform publishes constitutes a violation of Article 50(4) from August 2, with no grace period for systems already on the market. An exemption applies only when documented human editorial review and an identified responsible editor have been applied — not when AI drafting occurred without meaningful human oversight.
