AI Act Article 50(2) grace period ends 2 December 2026: what to finish before then

Most of the AI Act's transparency rules in Article 50 have applied since 2 August 2026. One part got extra time. If your business provides a generative AI tool that was already on the EU market before 2 August 2026, you have until 2 December 2026 to make its output marked in a machine-readable way as AI-generated (Art. 50(2), with the transition period in Art. 111(4) added by the Digital Omnibus, Regulation (EU) 2026/1744).

That's less than two months away. Here's how to tell whether it applies to you, and what needs to be in place by then.

Does the grace period apply to you?

It covers providers, not users. Under the Act, a provider is a business that develops an AI system, or has one developed, and offers it or puts it into use under its own name or trademark, whether it charges for it or not (Art. 3(3)). The Commission's guidelines on Article 50 confirm that a business that builds a chatbot or generator in-house and uses it under its own name is a provider too.

A few examples. A Dublin agency that built its own AI copywriting tool and sells access to clients under its brand is a provider. A software company that added a "generate product description" or "create image" feature to its product, built on a third-party model, is very likely the provider of that feature. A shop that uses a well-known AI assistant to draft its newsletters is a deployer, not a provider. The marking duty in Art. 50(2) isn't yours, and neither is the grace period.

Being outside the EU doesn't take you out of scope. The Act covers providers outside the EU whose AI output is used in the EU (Art. 2(1)(c)). This matters for UK businesses selling AI tools into Ireland.

What has to be in place by 2 December

The duty is that outputs, whether audio, images, video or text, are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution has to be effective, interoperable, robust and reliable as far as is technically feasible, taking account of the type of content, the cost and the state of the art (Art. 50(2)).

The Act gives examples of techniques: watermarks, metadata, cryptographic methods for proving where content came from, logging and fingerprints, or a combination (Recital 133). You can rely on marking applied by the model provider you build on, or by a third-party service, as long as it meets the Art. 50(2) standard. The responsibility for showing compliance stays with you, as the provider of the AI system (Commission Art. 50 guidelines, para. 74).

Marking alone isn't the whole job. People need a way to check it. Providers must make sure detection of their marked content is available (guidelines, para. 75).

There is a narrow exception. The duty doesn't apply where the AI only performs an assistive function for standard editing, or doesn't substantially alter what the user put in (Art. 50(2)). Fixing spelling or tidying the layout of someone's own text is the kind of thing the guidelines treat as standard editing (para. 90). Writing a new product description from three keywords is not.

What the grace period does not cover

Telling people they're talking to AI. If your tool is a chatbot that also generates content, the grace period only applies to the marking duty. The duty to tell users they're interacting with AI has applied since 2 August 2026 (Art. 50(1); guidelines, para. 153).

Anything you launched on or after 2 August 2026. The extra time is only for systems already on the market before that date (Art. 111(4)).

Deployers' labelling duties. If your business publishes realistic AI-generated images, audio or video (deepfakes), or AI-generated text meant to inform the public on matters of public interest, the duty to disclose that has applied since 2 August 2026 (Art. 50(4)). There's no grace period for this. Text that a person has reviewed and takes editorial responsibility for is exempt.

The good news on old content: outputs generated before 2 August 2026 don't need to be marked or labelled after the fact. One catch: AI-generated public-interest text written before that date but published after it does need a label (guidelines, para. 154).

Where the code of practice fits

The Commission's AI Office facilitated a Code of Practice on Transparency of AI-generated Content. It was finalised in June 2026, and the Commission and the AI Board have confirmed it is an adequate voluntary tool for showing compliance. Section 1 covers providers (marking and detection). Section 2 covers deployers (labelling deepfakes and certain text), and the EU has published a set of icons deployers can use as labels.

Signing is voluntary, and businesses of any size can sign. Signatories can rely on the code's measures to show they comply. If you don't sign, you'll need to show your own measures are adequate if a market surveillance authority asks. About 190 organisations had signed by the end of July 2026. Even if you don't sign, Section 1 is a practical checklist of what "good enough" marking looks like.

What to do before 2 December

1. List every product or feature you offer that generates or alters text, images, audio or video, and note when each one first went on the EU market.

2. For each one, decide whether you're the provider or a deployer. If you put it out under your own name, assume you're the provider until you've checked.

3. Ask your model vendor in writing what marking they apply to outputs and what detection they offer. Then check that your own processing, such as resizing, compressing or reformatting, doesn't strip it out.

4. Read Section 1 of the code of practice and decide whether to sign it or document your own approach.

5. Check that your chatbot or assistant already tells users they're dealing with AI. That has been required since August, not December.

6. Write down what you decided for each tool and why. It's the first thing you'd be asked for.

What's at stake

Breaching Article 50 can bring a fine of up to €15 million or 3% of worldwide annual turnover. For SMEs and start-ups, the cap is whichever of the two is lower (Art. 99(4) and 99(6)). For most small providers, though, the practical risk is a customer or platform asking whether your output is marked, and you not having an answer.