Most of the attention after the Digital Omnibus went to the dates that moved furthest: Annex III high-risk systems to 2 December 2027, Annex I products to 2 August 2028. The next date that actually bites is much closer. On 2 December 2026, two things happen at once: the grace period for machine-readable marking of AI-generated content ends for generative systems that were already on the market, and new prohibitions on AI that generates non-consensual intimate imagery and child sexual abuse material start to apply. If you ship anything that generates images, audio, video or text, here is what changes and what to check before then.
1. The legacy marking grace period ends
Article 50(2) requires providers of generative AI systems to mark their output as artificially generated or manipulated, in a machine-readable format that can be detected. For systems placed on the market from 2 August 2026, that obligation already applies. For generative systems that were already on the market before 2 August 2026, the Digital Omnibus (Regulation (EU) 2026/1744) granted a grace period that ends on 2 December 2026. We explained the background in our earlier post on the watermarking extension.
What is new since then is that the practical bar is much clearer. The Commission published the final Code of Practice on marking and labelling of AI-generated content in June 2026 and its Article 50 guidelines in July. The Code is voluntary, but it is the most concrete statement available of what "machine-readable and detectable" means in practice, and signing it is the easiest way to show you took the obligation seriously.
What the Code of Practice expects from providers
Section 1 of the Code covers providers (Article 50(2)). In summary:
- At least two marking layers. Typically signed, tamper-evident metadata plus an imperceptible watermark embedded in the content itself. One layer alone is not considered enough, because metadata is easily stripped and watermarks can be degraded.
- Fingerprinting and logging are supplementary. They can support detection but do not satisfy the marking obligation on their own.
- No stripping by users. Providers are expected to prohibit users from removing the marks, for example in their terms of use.
- A detection mechanism. Providers should offer a way to check whether content came from their system, as a rule free of charge, with free access for regulators, media and researchers.
- Practical exceptions. Very short text output (under roughly 200 tokens) is not expected to carry a watermark, and free-form text, which cannot carry metadata, is handled differently from images, audio and video.
Interoperability of watermark detection across providers has a later target, 2 February 2027, so on 2 December the focus is that your output is marked at all, robustly and in more than one way.
What does not change on 2 December
The grace period only ever covered provider-side marking. Two related duties have applied since 2 August 2026, with no transition:
- Deployer labelling under Article 50(4). If you publish deepfakes, or AI-generated text that informs the public on matters of public interest, you must label it so people notice at first exposure. Section 2 of the Code covers this and offers optional EU "AI" icons for fully generated and AI-modified content. A provider's invisible watermark does not discharge the deployer's duty to label.
- Telling people they are talking to AI (Article 50(1)) for chatbots and voice assistants.
Content generated and published before 2 August 2026 does not need to be labelled retroactively.
2. New prohibitions apply
The Omnibus also added prohibitions on AI systems that generate realistic non-consensual intimate imagery of real people (so-called nudifier apps) and child sexual abuse material. The Commission's enforcement page confirms these apply from 2 December 2026. Prohibited practices sit in the highest fine tier of the Act: up to €35 million or 7% of worldwide annual turnover, whichever is higher.
For most legitimate image and video products the practical question is not whether you intend to offer this, but whether your safeguards actually prevent it: prompt and output filtering for sexual content involving real, identifiable people, refusal of any request involving minors, and abuse reporting that someone actually reads. If your product can edit uploaded photos of people, this is the part to test hardest.
Checklist for the next three weeks
- Find out which side of 2 August 2026 your generator launched on. Launched after: marking should already be live. Launched before: you have until 2 December.
- Confirm you mark output with at least two layers (for example C2PA-style signed metadata plus a watermark), and that your terms forbid users from removing them.
- Check you have a way to verify your own output, even a basic one, and decide who can access it.
- Check deployer-facing labels if you or your customers publish deepfakes or public-interest text. Our free AI disclosure generator writes the notice in 8 languages and includes an IPTC metadata snippet.
- Test your safeguards against the new prohibitions, especially image editing of real people.
- Write down what you did and when. If an authority sends a request for information, a dated record is your best answer.
The AI content generation guide covers the full set of obligations for generative products, and the AI Act deadlines timeline (subscribable as a calendar) lists every remaining date. To confirm which tier and obligations apply to your specific system, run EuroComply's free EU AI Act assessment: about 3 minutes, with the article behind every finding.