A marketing team finishes a product video. Part of the footage came from an AI tool. The voice is synthetic. A model drafted the script, and a person rewrote it. Do they have to label this, and how?
Two documents from the European Commission answer that. They do not carry the same weight. Article 50 of the EU AI Act is law. The Code of Practice is voluntary.
A code of practice is not the law
The law is Article 50 of the AI Act. The Code of Practice is a voluntary guide on how to meet it.
The duty sits in Article 50 of the AI Act, Regulation (EU) 2024/1689. The Commission's transparency guidelines page sums it up, and so does our earlier post. Article 50 says what must happen. It does not say exactly how.
The how is the Code of Practice on marking and labelling AI-generated content. Its final version came out on 10 June 2026. The Commission's FAQ states: "Adherence to the code of practice is voluntary." It adds no duties beyond the AI Act. By the end of July 2026 about 190 organisations had signed it.
Signing still has a use. The Commission and the AI Board confirmed the Code is an adequate voluntary tool for showing compliance. Anyone taking another route must show the authorities that their own measures are adequate. Even so, the Code says adherence "does not constitute conclusive evidence of compliance".
Provider or deployer: which one are you
Providers build the AI tools. Deployers use the tools and publish the result. The Code gives each group its own section.
Section 1 covers providers of generative AI systems, under Article 50(2) and (5). Their job is marking and detection.
Section 2 is for deployers (the companies that use the systems), under Article 50(4) and (5). Their job is labelling deep fakes and AI-generated text on matters of public interest. The video team is a deployer.
What providers commit to: two layers of marking
Providers must mark their output in two machine-readable ways: signed metadata and a hidden watermark.
Measure 1.1 asks providers for "at least two layers of machine-readable marking". The first layer is digitally signed metadata. The Code says "All recorded information will be digitally signed and time-stamped". The second layer is a watermark hidden inside the content. Fingerprinting or logging may be added. But "relying on fingerprinting or logging alone is not considered sufficient".
Text is the exception, because "free-form text cannot transport metadata". So for text the watermark alone is enough. Very short text is exempt. Anything longer than 200 tokens still needs the watermark.
What deployers commit to: the icon, and the exemption for edited text
Deep fakes need a visible AI label. Published AI text needs a label too, unless a named person has reviewed it.
For deep fakes, the answer is a visible label. It is the EU icon in Annex 1 of the Code "or through an equivalent icon or label". The icon has the capitalised acronym "AI" as its main element. It must be recognised "without requiring user (inter)action or sustained attention". It must be "directly embedded into the content", unless an equivalent overlay is used. And it must be perceivable "at the latest at the time of first exposure".
Published text has its own path. Article 50(4) covers AI-generated text "published with the purpose of informing the public on matters of public interest". The deployer must disclose that the text was artificially generated or manipulated. The duty does not apply where the content "has undergone a process of human review or editorial control". There is a second condition: "a natural or legal person holds editorial responsibility for the publication".
Commitment 4 of the Code builds on this. Media companies already under editorial standards may rely on their existing procedures. Every other signatory names "the natural or legal person with editorial responsibility (name, role and contact details)". They also publish those contact details.
So for the video: is any part a deep fake, and is the AI label visible at first exposure? For the script: is there human review and a named, published person?
The dates that matter
Article 50 applies from 2 August 2026. Older systems get until 2 December 2026 for the marking duty (re-checked on the Commission's page, 15 October 2026).
Providers of systems already on the market got extra time. Regulation (EU) 2026/1744 of 8 July 2026 added Article 111(4) to the AI Act (re-checked on EUR-Lex, 15 October 2026). The new paragraph covers providers of systems generating synthetic audio, image, video or text content "that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". That deadline covers the marking duty of providers, not the labelling duty of deployers (re-checked on EUR-Lex, 15 October 2026).
The Commission also published Guidelines on the Article 50 transparency obligations on 20 July 2026 (re-checked on the Commission's library page, 15 October 2026). They are practical guidance, not law.
The limit, stated plainly
The seal gives a dated self-declaration. It is not the Article 50 marking, and it adds no AI icon to your content.
Swiss Trust Layer offers six content labels: HUMAN AUTHORED, HUMAN APPROVED, AI FREE, AI ASSISTED, AI MODIFIED and AI GENERATED. Exactly one AI label applies per content and version. The two HUMAN labels need a verified identity (explained here). Sealing locks the declarations. The certificate of proof lists each file with its hash and its AI Declaration.
The labels are a self-declaration by the user, and the portal says so where you set them. They are not the machine-readable marking Article 50(2) asks of providers.
What the seal gives a publisher is narrower. A cryptographic fingerprint of the file, not the file, goes to Swisscom Trust Services, the qualified trust service provider. It signs the fingerprint with a key that never leaves its hardware. It attaches a timestamp under RFC 3161. The result is a dated record of what you declared about the content. For human-made content, it also shows the file existed in that form on that day.
Under Article 41(2) of the eIDAS Regulation, a qualified timestamp is presumed accurate as to date, time and data integrity. Anyone can check the sealed PDF at swisstrustlayer.com/validate without an account. The record does not prove who wrote the file, whether the declaration is true, or who holds the rights.
One step this week
Name the person with editorial responsibility, then declare and seal one piece of content you published this month.
If you publish AI-assisted text, settle who holds editorial responsibility. Have their name, role and contact details ready to publish. Then take one piece of content, declare its labels honestly, and seal it. The seal will not make it compliant with Article 50. It dates what you declared. The mechanism is on how it works. How the declaration appears on the certificate is in this post.
Seal your first document on Swiss Trust Layer and date what you declared.
