Under the EU AI Act, the AI tool marks the content and the business using it discloses deepfakes. The 2 December 2026 date is when generative tools already on sale before August must embed machine-readable marks in what they produce. That deadline belongs to your vendors. Your own duty, a visible label on deepfakes and on unreviewed text about matters of public interest, has applied since 2 August 2026 with no grace period. This piece is for marketing leads and owners in Singapore whose content reaches EU audiences.
None of this was delayed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, deferred the high-risk rules but left Article 50 on its original date. For Article 50, the only relief went to tool providers, and it lasts four months.
What does Article 50 require for AI-generated content?
Article 50 of the EU AI Act splits AI content transparency between two parties. Article 50(2) makes the provider of a generative AI system mark its outputs "in a machine-readable format and detectable as artificially generated or manipulated". Article 50(4) makes the deployer, the business using the tool, disclose deepfakes and AI text on matters of public interest. Both apply from 2 August 2026; only the provider duty got a short grace for older tools.
This is general information, not legal advice.
The provider's mark is for machines: a signed record or hidden signal that software can check later. The deployer's label is for people. Article 50 of the AI Act sets out both, and Article 50(5) requires the information to be "clear and distinguishable" no later than the first exposure.
Most Singapore SMEs sit on the deployer side: you prompt a vendor's tool and publish the result. Article 2(1)(c) brings you into scope when "the output produced by the AI system is used in the Union". The Commission's Article 50 guidelines of 20 July 2026 give the exact case: a company in a third country that generates a celebrity deepfake for an advertisement shown in the EU is a deployer.
The Commission's Q&A on Article 50, updated 24 July 2026, is blunt: "deployers cannot simply rely on the machine-readable marking embedded in the content by the provider under Article 50(2) of the AI Act to fulfil their disclosure obligation."
Packaging is where agencies get caught. The guidelines say a company that modifies an existing generative system and puts it into service "under its own name or trade mark" becomes the provider of the new system. Take a hypothetical Singapore agency that wraps a model in a branded "content studio" for EU clients. It may have taken on the Article 50(2) marking duty without noticing, and a provider cannot point at the model underneath: it has to make sure every output it ships carries the marks.
What changes when the marking grace ends on 2 December 2026?
On 2 December 2026 the four-month transition for older generative tools ends. Article 111(4), inserted by the Digital Omnibus, says providers of systems "placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". Recital 38 calls it "a transitional period of four months". Nothing in it delays a deployer's duty to label.
So from December, whatever your established tools generate should carry marks. Tools launched after 2 August 2026 had to mark from day one. The same date also brings two new prohibitions inserted by the Omnibus: AI systems that generate intimate imagery of an identifiable person without consent, or child sexual abuse material.
For an owner or managing director, the exposure is bounded. Article 99(4) of the AI Act sets fines for Article 50 breaches of up to 15 million euros or 3% of worldwide turnover, and Article 99(6) applies whichever is lower to SMEs. The larger cost is commercial. An EU retailer or publisher that finds an unlabelled synthetic product shot in your campaign will ask what else you did not check.
Which marketing assets need a visible label?
A marketing asset needs a visible label when it is an AI-made deepfake, or AI text on a matter of public interest that no person really reviewed. Article 3(60) defines a deepfake as content that "resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful".
That definition is narrower than "anything made with AI" and wider than "fake celebrity videos". The Commission's July 2026 guidelines give marketing examples:
- Deepfake: "An AI-generated image of a product in advertisement or packaging that can affect the audience's perception and mislead as to the actual product appearance". Also a realistic synthetic avatar of your CEO.
- Not a deepfake: an advert in which AI mice argue "over the best type of cheese". Also a real car shot against an AI-generated background, as long as the advert does not mislead about the product.
- Not artistic, so full labelling: a realistic synthetic influencer testing a sponsored real product, "focused solely on displaying the product functionalities".
The creative exception is narrow. Evidently artistic, satirical or fictional work only gets a lighter disclosure, one "that does not hamper the display or enjoyment of the work". Where a deepfake mixes informative and creative character, the guidelines say "the informative character should always prevail".
Marketing text is often over-labelled. The guidelines place "AI-manipulated text that is part of a company's advertisement or product descriptions" outside the duty, but only when it carries no claims about "health, consumer safety or sustainability". A blog post about what a supplement does to blood pressure is public-interest text. If AI drafted it, either a person with relevant knowledge reviews the substance and someone takes editorial responsibility, or it carries a label. Spell-checking does not count as review, the Commission's Q&A says.
Our working rule, which is a reading of those examples and not a test from the text: if the realism of an AI-made asset is what persuades the buyer, label it. If the AI part is scenery or obvious fantasy, keep the marks and log the call.
Illustrative example: a Singapore skincare brand ships 40 AI-assisted assets a month to shoppers in France and Germany. Thirty are real product photos placed in AI-generated settings: no label, keep the marks. Six show AI-rendered "after" skin on a model who does not exist, which could mislead about what the product does: label them visibly or reshoot with real photography. Four are AI-drafted articles on skin health: a qualified reviewer signs them off and the brand holds editorial responsibility, or they carry the AI label. The fix is one review queue, not a new tool.
40 assets a month, three different calls
One Singapore skincare brand’s EU-facing assets, one month. Illustrative, not measured data.
Decision tool
Does this asset need an EU AI label?
Up to five questions per asset. A guide, not legal advice. Nothing you enter leaves your browser.
- Modified or offer an AI generator under your own name: you may be a provider with the Article 50(2) marking duty. Make sure every output carries marks and check with counsel.
- Image, audio or video that a viewer could not take as an authentic real person, product, place or event: a visible label is likely not required. Keep the marks and log the decision.
- Realistic deepfake that is evidently artistic, satirical or fictional: disclose the AI origin without spoiling the work, such as in credits.
- Realistic deepfake with an informative or product-demonstration purpose: label it visibly at first exposure, embedded so it survives resharing.
- Ad copy or product description without health, safety or sustainability claims: a label is likely not required.
- Public-interest text reviewed by a knowledgeable person under named editorial responsibility: a label is likely not required. Keep the review record.
- Public-interest text without that review: label it as AI-generated or send it through substantive review first.
What are C2PA Content Credentials, and does the law require them?
C2PA Content Credentials are a signed, tamper-evident record of who or what made a file and how it was edited, and EU law does not require them by name. The open standard comes from the Coalition for Content Provenance and Authenticity (C2PA). Article 50(2) asks for machine-readable marking that works across systems, and the Commission's voluntary code names no standard either.
What the Code of Practice on Transparency of AI-generated Content, published on 10 June 2026, does specify is layering. Signatory providers commit to at least two machine-readable layers for audiovisual content: digitally signed metadata, and an imperceptible watermark woven into the content itself. Free-form text gets the watermark alone. Very short text is excepted; anything over 200 tokens is not. On 8 July 2026 the Commission judged the code adequate for Articles 50(2), (4) and (5), and about 190 organisations had signed it by the end of July 2026.
The code is voluntary; Article 50 is not. Recital 41 of the Omnibus says codes of practice "do not grant a presumption of conformity". A vendor that has signed has an easier story for a regulator; one that has not must prove its own method works.
If your vendor's signed metadata follows C2PA, its weakness is well known. The C2PA's own explainer, version 2.4, answers it directly: "Can the provenance metadata be removed? Yes it can." That is why the code pairs it with a watermark, embedded so it is hard to separate from the content.
For a CTO or technical lead, the distinction is practical. Stripping metadata usually leaves the watermark layer in place, although heavy compression and resizing can degrade a watermark too. What stripping destroys is the open, verifiable part: the signed record any newsroom, platform or customer can check without asking the vendor. Your publishing stack, not your AI tool, decides whether that record reaches the reader.
How should your content workflow handle marks and labels?
A compliant content workflow keeps the provider's marks intact and adds a visible label where Article 50(4) requires one. The first one fails quietly in many pipelines, because compression, CDN resizing or a social scheduler can discard embedded metadata before anyone checks. For the content production side, see content marketing at leapbuzz, our marketing consultancy brand.
The failure is usually a default setting. Cloudflare's image documentation, updated 26 May 2026, says that when its Preserve Content Credentials setting is disabled, "any existing Content Credentials will always be discarded" on transformed images. Its default metadata option keeps only the EXIF copyright tag. Find the equivalent switch in every tool between your designer and the reader before you assume anything survives.
The table follows one asset from prompt to post: where the mark is at risk and who owns each fix.
| Stage (owner) | Risk to the mark | What to do |
|---|---|---|
| Generate (marketing lead) | Tool may not mark at all | Get written confirmation that it marks, and from when |
| Edit (designer) | Some editors drop metadata on save | Use editors that keep Content Credentials; re-check labels after big edits |
| Classify (marketing lead) | None yet | Tag: AI-made, deepfake, public-interest text, EU audience |
| Label (editor or compliance) | Marks are for machines only | Embed a visible label in deepfakes; send public-interest text to a named reviewer |
| Publish (web lead) | CDNs and optimisers strip metadata | Turn stripping off for AI assets, then test what survives |
| Record (approver) | Evidence fades | Log tool, date, class, reviewer and label decision |
Two parts of that table need a decision, not a setting. First, the code commits signatory providers to put "a prohibition of the intentional removal of or tampering with metadata markings by deployers" into their terms or documentation. Whether a CDN that strips all metadata by default counts as intentional removal has not been tested. Do not plan on default metadata stripping being harmless.
Second, the EU icons for labelling AI-generated content, updated 24 September 2026, are optional, but the page is clear that "the labelling requirements under Article 50 AI Act are not." Where you use the icon, embed it in the asset; it "must be visible when content is reshared or downloaded". A caption under a video does not travel with the file.
Before December, ask each AI tool vendor five questions in writing:
- Do your outputs carry machine-readable marks today, and if not, from what date?
- Which methods: signed metadata, a watermark, or both? Is the metadata C2PA?
- Have you signed the EU Code of Practice on Transparency of AI-generated Content?
- What do your terms say about removing or altering the marks?
- How can we, or our EU customers, check whether a file was made with your tool?
A vendor that cannot answer the first question by now has told you something.
Self-assessment
Will your marks survive, and will your labels show?
Tick what is true today. Heavier items count more. A guide, not an audit. Nothing you enter leaves your browser.
- 0 to 39%: Marks at risk. Start with the five vendor questions and a before-and-after test of five images.
- 40 to 74%: Partly covered. Close the pipeline gaps first: a stripped mark cannot be put back.
- 75% and above: Covered. Re-test after any change to your editor, CDN or scheduler.
Weights are illustrative; total 25 points. Based on Article 50, the Commission’s July 2026 guidelines and the voluntary Code of Practice. Not legal advice. Nothing you enter leaves your browser.
Singapore has no general mandate to label AI-generated content. Its targeted rule sits in election law: the Elections (Integrity of Online Advertising) (Amendment) Bill, No. 29/2024, makes it an offence to publish online election advertising, during an election period, that realistically shows a candidate saying or doing something they did not. That is a ban on one kind of content, not a labelling duty. In a written parliamentary answer on 5 August 2026, the Ministry of Digital Development and Information said it will "keep track of the maturity of technical standards, such as watermarking and digital provenance approaches, and assess if they should be mandated." A pipeline that keeps marks today is ready either way. Our chatbot disclosure guide covers the separate Article 50(1) duty for bots, and the EU AI Act overview for Singapore SMEs covers the rest of the Act.
Where Origin Pi stands
The 2 December deadline tests your vendors. The visible label has been your job since August, and we think most SMEs should spend their effort on the content workflow rather than on a detection product.
We design AI content pipelines for marketing teams that build the marking and labelling steps into the workflow instead of leaving them to memory. In those designs, an agent-ready layer tags each asset at generation with its source tool, date and classification. A confirm step holds a deepfake or an unreviewed health article until a named person applies the label or signs the review. We build the audit trail so that decision stays attached to the asset, ready for a question from an EU retailer in 2027.
We do not treat a vendor's watermark as your compliance.
Your first action this week: take last month's EU-facing assets, upload five AI-made images to a Content Credentials checker before and after your publishing step, and see which ones still carry their marks. If none do, fix the pipeline before you buy anything.
