European Commission publishes Code of Practice on Transparency of AI-generated Content

The Code of Practice on Transparency of AI-generated Content is a voluntary tool published by the European Commission to help providers and deployers of generative AI systems meet the transparency duties in Article 50 of the EU AI Act. The final Code was published on June 10, 2026, and the European Commission and the European AI Board must assess its adequacy before adherence carries its full evidentiary weight.

What it is

It helps providers and deployers of generative AI systems to comply with the AI Act's obligations for labelling and marking of AI-generated content. Even though adherence to the code is voluntary, the transparency requirements under article 50 of the AI Act are legal obligations. The obligations address risks of deception and manipulation, fostering the integrity of the information ecosystem. By the end of July 2026, about 190 companies organisations have signed the code.

What it requires

Section 1 of the Code covers providers of generative AI systems, who must mark outputs in a machine-readable format and ensure they are detectable as artificially generated or manipulated. Section 2 covers deployers, who must disclose that AI-generated deepfakes have been artificially generated or manipulated. These transparency obligations, applicable from 2 August 2026, complement other rules like those for high-risk AI systems. The AI Omnibus provisional agreement of May 2026 grants generative AI systems already on the market before that date until 2 December 2026 to meet the machine-readable marking requirement under Article 50(2). The deployers' disclosure duties under Article 50(4) apply from August 2, 2026 without deferral, and the watermark-detection interoperability commitment follows on February 2, 2027. Providers and deployers who sign it can rely on its measures to demonstrate compliance with the AI Act's rules for labeling and detection of AI-generated content. Providers and deployers that decide to comply through other means will have to demonstrate that those measures are adequate.

What security leaders should do

Security and compliance teams should inventory every generative AI system that produces audio, image, video or text output and confirm which ones reach users inside the EU before the Article 50 deadlines take effect. Teams should decide whether to sign the Code of Practice or build an independent adequacy case, since non-signatories carry the burden of proving their own marking and labelling measures to market surveillance authorities. Vendor-risk and procurement reviews should confirm that third-party generative AI tools already support machine-readable marking, since the December 2, 2026 extension only covers systems that were already on the market before August 2, 2026. Teams overseeing customer-facing chatbots, deepfake-capable tools or public-interest publishing should finalize disclosure language now, because deployer labelling duties carry no extension past August 2, 2026, and the interoperable watermark-detection commitment arrives soon after in February 2027.