From 2 December 2026, Regulation (EU) 2026/1744 requires operators of AI systems that generate synthetic content to apply machine-readable markings to that content, giving effect to Article 50(2) of the EU AI Act. The obligation extends to systems already placed on the market before 2 August 2026, meaning many businesses operating today will need to act before the deadline rather than waiting for a new product cycle. At the same time, a new prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material enters force on the same date under amendments introduced by the Digital Omnibus package.
What Changed and When
The EU AI Act has been in force since August 2024, but its obligations are being phased in over several years. The watermarking requirement under Article 50(2) – which mandates that AI-generated audio, image, video and text content be marked in a machine-readable format – becomes enforceable on 2 December 2026.
Critically, Regulation (EU) 2026/1744 closes what might otherwise have been a significant gap: it confirms that systems already on the market before 2 August 2026 are not grandfathered out of the obligation. If your platform or product was live before that earlier date, the 2 December 2026 deadline still applies to you in full.
On the same date, a prohibition introduced by the Digital Omnibus package takes effect against the generation of non-consensual intimate imagery and child sexual abuse material through AI systems. This is a hard prohibition – not a transparency or labelling measure – and it applies regardless of whether the system is classified as high-risk.
Who Is Affected
The watermarking obligation under Article 50(2) applies to providers and deployers of AI systems that produce synthetic content intended for distribution or public-facing use. In practical terms, this covers a broad range of business sectors:
- Media, advertising and marketing platforms that use generative AI to produce images, audio or video at scale.
- Financial services firms – including those supervised by ESMA or the EBA – that deploy AI-generated reports, customer communications or automated advisory content.
- Technology and SaaS providers offering general-purpose AI models or APIs to downstream business users within the EU.
- E-commerce and retail operators using AI to generate product descriptions, reviews or promotional materials.
- Professional services firms deploying AI to draft documents, correspondence or analytical outputs shared externally.
Businesses established outside the EU are not automatically exempt. Where an AI system is placed on the EU market or its output is directed at persons in the EU, the territorial reach of the AI Act and Regulation (EU) 2026/1744 will apply. International companies should not assume that operating through a non-EU entity is sufficient to avoid the obligation.
For a detailed analysis of how algorithmic transparency requirements interact with deployment decisions in a specific jurisdiction, our guide on AI Act Article 50 and EU transparency obligations sets out the key legal considerations.
The Watermarking Requirement in Practice
Article 50(2) of the AI Act requires that synthetic content be marked in a machine-readable format – not merely labelled for human readers. The precise technical standards are being developed by the European Commission and the AI Office, and businesses should monitor EUR-Lex and the AI Office's published guidance for updates as standards are finalised.
Several practical points deserve attention:
- The obligation sits on both the provider of the AI system and, in some circumstances, the deployer. Contractual arrangements between providers and their business customers should clearly allocate responsibility for compliance.
- Where content passes through multiple systems before publication, each party in the chain must understand its role. Deployers cannot simply rely on their technology supplier to have handled the requirement.
- For high-risk AI systems, watermarking obligations layer on top of – and do not replace – the more extensive requirements applicable to that category, including conformity assessments and ongoing monitoring obligations.
- The AI Office, established within the European Commission, holds supervisory authority over general-purpose AI models and will be a key enforcement reference point. Firms providing or using general-purpose AI should engage with the AI Office's published documentation.
If you are assessing how these obligations apply to your existing systems or supply chain, we are available to assist. Please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
The New Content Prohibition
Separately from the watermarking obligation, the Digital Omnibus package introduces a prohibition – effective 2 December 2026 – on the use of AI systems to generate non-consensual intimate imagery and child sexual abuse material. Unlike the transparency and marking requirements, this is a categorical ban. There is no threshold of risk or market position that brings a business within or outside it: the prohibition applies to providers and deployers across the board.
Businesses that operate platforms enabling user-generated AI content should review their terms of service, acceptable use policies and technical safeguards well before the December deadline. Relying on post-publication moderation alone is unlikely to constitute a sufficient compliance posture under this prohibition.
Immediate Action Items for International Companies
Given the 2 December 2026 deadline, the window for preparation is narrower than it may appear. The following steps represent a proportionate starting point for businesses that have not yet begun a structured compliance review:
- Map your AI systems. Identify all systems within your organisation that generate audio, image, video or text content directed at EU users or placed on the EU market. Include systems operated by third-party providers on your behalf.
- Assess market entry dates. Determine which systems were on the market before 2 August 2026 and confirm that Regulation (EU) 2026/1744 applies to them in full from 2 December 2026.
- Review contracts with AI suppliers. Ensure that agreements with technology providers clearly allocate watermarking responsibility and include representations as to technical compliance with Article 50(2) requirements.
- Monitor technical standards. The machine-readable marking standards are being developed by the European Commission and the AI Office. Assign a responsible individual or team to track updates on EUR-Lex and the AI Office portal.
- Update content policies. Review and revise acceptable use policies, platform terms and internal governance documents to reflect the new prohibition on non-consensual intimate imagery and CSAM-related AI content.
Companies with operations in multiple EU jurisdictions should bear in mind that national competent authorities will play a role in enforcement. Where national implementation details remain pending, businesses should plan conservatively and seek jurisdiction-specific advice. Our team's work on AI Act compliance in Italy illustrates the kind of national-level analysis that may be needed across your EU footprint.
Interaction with Employment and HR Practices
For businesses that deploy AI tools in the context of human resources – for example, AI-generated candidate assessments, performance reviews or employee communications – the watermarking and transparency obligations under Article 50 interact with existing employment law frameworks. HR-facing AI tools may also qualify as high-risk AI systems under Annex III of the AI Act, triggering a separate and more demanding set of obligations. Companies should assess these two regulatory tracks together rather than in isolation. Our employment law practice can assist in mapping the intersection of AI Act obligations and workforce-related deployments.
Looking Ahead
The 2 December 2026 deadline is not the final stage of AI Act implementation, but it is a significant one. Businesses that establish robust internal processes for Article 50 compliance now will be better placed to absorb future phases of the regulation's rollout. The AI Office and the European Commission are expected to publish further guidance and technical specifications in the months ahead; building the internal infrastructure to monitor and act on that guidance is itself a compliance task.
Enforcement posture across EU member states will vary, but the legal obligation is uniform. Businesses that operate at scale should not expect a grace period beyond the stated deadline on the basis of ongoing standard-setting: the obligation applies from 2 December 2026.
For a confidential discussion of how these requirements apply to your organisation's specific AI deployments, please write to us at info@ferrazwhitmore.com or use our contacts page to request a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.