EU AI Act — AI Content Marking & NCII/CSAM Ban

What it is

Article 50(2) requires providers of generative AI to mark their outputs (text, images, audio, video) in a machine-readable way, so downstream systems and platforms can identify content as AI-generated. Under the Digital Omnibus (Reg. (EU) 2026/1744), systems already on the market before August 2, 2026 have until December 2, 2026 to implement marking. Systems placed on the market after August 2, 2026 must comply from day one; the deferral covers legacy systems only.

December 2, 2026 is also the day a new Article 5 prohibition applies: AI systems that generate or manipulate non-consensual intimate imagery or child sexual abuse material are banned outright, in the Act's most severe penalty tier.

Does it apply to you?

If your product generates content users export, publish, or share (AI writing tools, image generators, audio and video tools, AI-drafted emails sent on a user's behalf), marking applies. If your AI only powers internal features such as search ranking or categorization, with no generated output presented as content, Art. 50(2) is not your problem.

What you must do

Implement machine-readable marking in generated outputs: metadata standards (C2PA is the emerging default for media), watermarking, or format-level markers. The Act requires the marking to be "effective, interoperable, robust and reliable" as far as technically feasible. That proportionality clause matters for small providers, but it is not an exemption.

Penalties

Marking failures fall under the transparency tier: up to €15M or 3% of global turnover. The NCII/CSAM prohibition is different — the prohibited-practices tier, up to €35M or 7%.

What SaaSalyst checks

The eu_ai_act_transparency check covers disclosure signals; it does not inspect generated-output marking, which requires analyzing your product's outputs rather than your website. Treat this page as a build-checklist item, not something a URL scan can verify.