Marking of AI-generated content in the EU: Code of Practice published

17.06.2026

In just a few months, for many companies using generative AI, the issue of content marking will no longer be a matter of voluntary compliance.

Starting August 2, 2026, the provisions of the EU AI Act regarding the transparency of AI-generated content will take effect. In practice, this means that developers and users of AI systems will be required to disclose the use of artificial intelligence when creating images, videos, audio, and, in certain cases, text.

To help businesses prepare for the new requirements, the European Commission has published a Code of Practice on Transparency of AI-Generated Content.

What does the Code stipulate?

The Code of Practice consists of two sections:

 

• Section 1: Providers of Generative AI Systems – Rules for marking and detection of AI-generated and manipulated content;
• Section 2: Deployers of AI Systems – Rules for labeling deep fakes and AI-generated and manipulated published text.

Main provisions

1)    Focus on “non-removable” marking of AI-generated content and editorial control

Once the rules take effect, a simple notice saying “created by AI” will no longer suffice. The Code recommends using a two-tier system:

 

1. hidden watermarks embedded directly into the image, video, audio, or text;
2. cryptographically signed digital metadata.

Particular attention is paid to protecting the markings from removal. Providers must preserve and refrain from intentionally altering or removing existing metadata tags, and must include in their AI acceptable use policies a prohibition on the intentional removal of or tampering with metadata markings by deployers or any other third party.

In addition, the marking must be resilient to typical processing operations.

Providers of generative AI systems, with the exception of media service providers, undertake to establish, adapt, or maintain appropriate policies regarding human review or editorial control prior to publication, and to ensure that a natural or legal person bears editorial responsibility for the publication of AI-generated text.

2)    Prohibition on creating methods and tools for removing markings

Providers are encouraged not only to preserve existing markings but also to refrain from distributing tools that allow such markings to be circumvented or removed.
Providers are responsible for not placing

or offering on the market, as well as not promoting or advertising the use of tools designed to circumvent markings added to AI-generated content.

3)    A Consistent Approach to Labeling

When using AI to generate content, a consistent approach to labeling deep fakes and AI-generated text is proposed:

 

• It is recommended to disclose information about what has been altered by the AI system (for example, text or an icon indicating that a face has been altered);
• An icon or equivalent label may be displayed in different sizes depending on the context, provided that the disclosure is clear and distinguishable to users.

If a visual label cannot be displayed, a brief audio warning in clear and simple natural language, either in the same language as the content or in English, should clearly indicate the artificial origin of the audio deep fake.

A set of icons has also been developed that can be used to label content created using AI.

The full text of the Code of Practice is available at the following link.

Why is this important for business?

Although compliance with the Code of Practice is voluntary, the transparency requirements set forth in Article 50 of the EU AI Act are legal obligations. In addition, the Code of Practice will be supplemented by guidelines regarding the scope of the transparency obligations set forth in Article 50 of the EU AI Act.

Once the Code of Practice has been positively assessed, all providers and deployers who have signed it may rely on the measures contained therein to demonstrate compliance with the EU AI Act’s rules on marking and detection of content generated by AI. 

This will reduce the administrative burden and ensure predictability, legal certainty, and trust across all EU Member States. However, providers and deployers who choose to comply through other means will need to demonstrate the adequacy of those measures.