Since 2 August 2026, the transparency obligations of the EU AI Act apply. Most of the coverage so far explains what this means for photographs. Video carries the same obligations and a harder engineering problem, because a stream arrives in pieces, travels through a packager and a CDN, and reaches a player that joins in the middle. This article covers what Article 50 asks for, the dates still ahead, and how content provenance holds up inside a live pipeline.
- Article 50 has applied since 2 August 2026, and it covers synthetic audio, image, video and text.
- Providers of generative AI systems mark outputs in a machine-readable format. Deployers label deepfakes and AI-generated text on matters of public interest visibly, at first exposure.
- Two dates remain open: 2 December 2026 for systems already on the market, and 2 February 2027 for watermark detection interoperability.
- The Act stays technology neutral, and the shape it describes, signed metadata plus watermarking, matches what C2PA built as Content Credentials.
- Live streaming is where that shape gets hard, because provenance has to hold segment by segment.
What Article 50 asks for
Article 50 splits its obligations between two roles.
Providers of AI systems that generate synthetic audio, image, video or text ensure those outputs carry marking in a machine-readable format, detectable as artificially generated. The marking belongs to the system that produced the content.
Deployers who publish deepfakes disclose that the content is artificially generated or manipulated. The same applies to AI-generated text published on matters of public interest. The disclosure is visible, and it reaches the viewer at first exposure. The Commission published a standardised icon that satisfies this, and alternatives that meet the specification remain available. For audio-only formats, a spoken disclaimer serves the same purpose.
Three carve-outs matter for editorial teams. Assistive editing that leaves the content substantially intact stays outside the marking obligation, and the final Guidelines placed AI translation in that category, while summaries and rewrites stay inside it. Artistic, creative, satirical and fictional work carries a lighter form of disclosure. And AI-generated text that passed through genuine editorial responsibility falls under a narrow editorial exception.
Territorial reach deserves attention too. Content published on the openly accessible internet can fall inside scope once it reaches an audience in the EU, whatever the location of whoever produced it. And the obligations carry weight: administrative fines for Article 50 breaches reach EUR 15 million or 3% of total worldwide annual turnover, whichever figure is higher.
The three dates
| Date | What applies |
|---|---|
| 2 August 2026 | Article 50 obligations apply. Content generated from this point onward carries the marking requirement. |
| 2 December 2026 | Generative AI systems already on the market complete their machine-readable marking. |
| 2 February 2027 | Watermark detection interoperability solutions become operational. |
Content generated before 2 August 2026 stays outside the marking obligation, measured by generation date for image, audio and video, and by publication date for text on matters of public interest. Existing libraries therefore call for a policy decision rather than a retrofit.
Provider or deployer: where a media company sits
The Act defines a provider as whoever develops an AI system and places it on the market, and a deployer as whoever uses that system under their own authority. In a media chain, one company frequently occupies both roles at once.
A broadcaster running an AI upscaler, an automatic highlight generator, a synthetic voice for dubbing or a virtual presenter acts as a deployer of each of those systems. The vendor supplying them acts as the provider, and the machine-readable marking sits with that vendor. When a media company builds its own generative tooling in house and puts it to work on its own output, both roles land on the same organisation.
The Guidelines added a business-to-business carve-out worth knowing: providers may skip marking where outputs stay inside closed industrial environments protected by safeguards such as cloud isolation and access controls. Content that leaves that environment and reaches an audience returns to the general rule.
What a layered approach means in practice
The Commission published a Code of Practice on Transparency of AI-generated Content in June 2026, open to voluntary signature, and the Commission together with the AI Board confirmed it as an adequate way to demonstrate compliance. The final Guidelines on transparency obligations followed in July 2026.
Those Guidelines recommend combining digitally signed metadata with imperceptible watermarking where that combination is technically feasible. The reasoning is candid: the state of the art leaves any single technique short on at least one of the four qualities the Act asks for, which are robustness, reliability, interoperability and effectiveness. Metadata carries rich, verifiable detail and survives poorly through a re-encode. Watermarking survives transformation and carries far less information. Together they cover each other.
Inside a streaming pipeline, those two layers live in different places. Watermarking belongs close to the encoder, where pixels are still being written. Signed metadata belongs where the asset gets packaged and delivered, and it has to reach the player in a form the player can verify.
Where C2PA fits
The regulation describes a result and leaves the technique open. That result, cryptographically signed metadata travelling with the asset and verifiable by anyone downstream, describes what C2PA has been building as Content Credentials.
The ecosystem matured quickly. The specification is moving through ISO as 22144. C2PA launched a conformance program with a public Conformance Explorer, so implementers can verify which products behave to spec. And provenance reached consumer hardware this year with the Google Pixel 10 and Sony's PXW-Z300, which puts signed capture at the front of the chain.
Live video is the hard part
Content Credentials grew up around still images and files at rest. Sign once, embed once, verify once.
Streaming works on other terms. A live stream arrives as a sequence of fMP4 segments, in several bitrate renditions, through a CDN, into a player that joins mid-stream and switches renditions as bandwidth moves. Provenance in that setting has to hold at segment level, survive the packager and the cache, and give the player something it can verify in the milliseconds available between segments. A viewer who tunes in twenty minutes late deserves the same answer as one who watched from the first frame.
What we learned signing live streams
Qualabs built a live signing proxy and a client-side validator together with EZDRM.
Signatures and hashes go into a custom uuid box inside each segment rather than a sidecar manifest, which keeps existing CDN and player setups working as they are. A hash chain links every segment to the one before it, with anchor point resets every ten segments so a player joining late can still validate. The full cycle of pull, hash, sign and embed runs under 500 ms per segment, playback holds at 1080p and 720p, and the chain reveals segments that were tampered with, dropped or reordered.
At NAB Show 2026 we took it further with EZDRM, Ateme and Cloudflare: a live workflow where Ateme's packager encrypts with EZDRM keys, EZDRM's C2PA Live Signer stamps each segment in real time inside a MoQ relay, and Cloudflare's global relay delivers it. Three open source projects grew along the way: moq-relay to sign as segments arrive, c2pa-rs to handle live CMAF streams, and c2pa-js for verification in the player.
That demo answers the question most teams ask first, which is whether provenance and DRM can share a pipeline. They can. Encryption protects access, provenance answers origin, and each layer keeps doing its own job. We walked through that split in more detail at a Qualabs Tech Meetup with EZDRM.
Building it surfaced gaps of our own around key management, IV resets and ABR chaining. Those went back to the C2PA working group as proposals. Qualabs is a contributor member of C2PA, and this part of the work is the one we enjoy most.
A checklist by role
Streaming platforms and broadcasters. Map every generative AI system already in the workflow, from dubbing to highlights to graphics. Confirm which vendor carries the provider obligation for each. Decide where a visible label appears in the player for deepfake and public-interest content. Set a policy for the pre-August library.
Encoding and packaging vendors. Establish where signing sits relative to encryption and packaging, and verify that the signature survives ABR ladder generation and CDN caching.
Player and app teams. Plan for verification at join time and across rendition switches, and design what the viewer sees when a signature validates, and when it comes back inconclusive.
Frequently asked questions
Does the EU AI Act require C2PA?
The Act stays technology neutral. It describes a result, machine-readable marking that a third party can detect, and leaves the technique to the implementer. C2PA is the interoperable standard that already produces that result, which is why it appears in most compliance conversations.
What does Article 50 require for AI-generated video?
The provider of the generative system marks the output in a machine-readable format, detectable as AI generated. The deployer who publishes it applies a visible label when the content is a deepfake, at the moment a viewer first sees it.
Who is the provider and who is the deployer in a broadcast chain?
The provider develops the AI system and places it on the market, so it is usually the vendor supplying the upscaler, the synthetic voice or the generation tool. The deployer uses that system under its own authority, so it is usually the broadcaster or platform publishing the result. A company that builds its own tooling in house holds both roles.
What are the fines for breaching Article 50?
Administrative fines reach EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever figure is higher. Small and medium enterprises and start-ups face the lower of the two.
Does content produced before 2 August 2026 need marking?
Content generated before that date stays outside the marking obligation. Image, audio and video are measured by generation date, and text on matters of public interest by publication date.
Does a C2PA signature survive transcoding and CDN delivery?
A signature covers the exact bytes it signed, so a re-encode after signing invalidates it. The practical answer is to sign after the transformation that produces the delivered rendition, and to keep the signature inside the segment so caches and players handle it as ordinary media. That is the approach behind the uuid box and the segment level hash chain described above.
What happens on 2 December 2026 and 2 February 2027?
Generative AI systems already on the market complete their machine-readable marking by 2 December 2026. Watermark detection interoperability solutions become operational by 2 February 2027.
Do AI translations and dubbing need marking?
The final Guidelines treat AI translation as standard editing, which leaves it outside the marking obligation, while summaries and rewrites stay inside it. Synthetic voice dubbing deserves a closer look with counsel, since it produces new synthetic audio rather than translated text.
Provenance moved from a principle to a delivery requirement, and the interesting part now is speed: how fast a signature can be produced, embedded and verified inside a live pipeline.
Signing live segments is what we build, and everything we learn goes back into C2PA and the open source libraries. Tell us what your pipeline looks like and we will work out together where the signing and the labels belong.
