Timeline
AI Act on 2 December 2026: marking and new bans
On 2 December 2026, two things change in the EU AI Act. Generative AI systems placed on the market before 2 August 2026 must mark their output in a machine-readable way, and two new Article 5 prohibitions apply.
Both changes come from the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. The high-risk duties stay deferred to 2 December 2027. This guide sets out what each change requires, who carries it, and a checklist. It is not legal advice.
What Article 50(2) requires
Paragraph 2 is about the output, not the conversation.
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated... (Article 50(2))
Two words carry the duty. Machine-readable: software, not only a person, can read the mark. Detectable: someone can check that the output was generated or manipulated by AI.
The same paragraph sets the bar for the method: it must be effective, interoperable, robust and reliable as far as technically feasible. It also sets three exceptions: an assistive function for standard editing, a system that does not substantially alter the input or its meaning, and uses authorised by law to fight crime.
The grace period ends on 2 December 2026
Article 50 has applied since 2 August 2026. Systems already on the market by then were given until 2 December 2026 for paragraph 2.
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026. (Article 111(4))
A system placed on the market on or after 2 August 2026 has no grace period: it had to mark its output from the first day. The other paragraphs of Article 50, including the disclosure that people are talking to an AI system, have no grace period either. The Article 50 guide covers each paragraph.
Who is the provider of a generative system
The duty falls on the provider of the AI system. Article 3 defines the provider by what it does, not by who wrote the model.
‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark... (Article 3(3))
A bank that builds a customer assistant on a general-purpose model and runs it under its own name puts an AI system into service. That makes the bank its provider. If that assistant writes letters, summaries or emails, it generates synthetic text. The model vendor has its own duties as a model provider; they do not replace yours. The bank chatbot guide works through a bank's case.
How to mark, and the Code of Practice
The recitals name the techniques the law has in mind.
...such as watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques, as may be appropriate. (Recital 133)
The Code of Practice on Transparency of AI-Generated Content (10 June 2026) sets out practical steps for marking and detection. The Code of Practice is voluntary. A provider that does not follow it must show another way the marking duty is met.
The Commission Guidelines on Article 50 (20 July 2026) explain how the Commission reads each paragraph, including where the exceptions stop. They are not binding, but supervisors read them.
The two new prohibitions
Article 5 lists practices banned outright, whatever the system's risk class. The Omnibus added two points.
(ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation; (bb) the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a ‘without right’ defence applies under national law; (Article 5(1))
In plain words: point (ba) bans AI that makes realistic intimate images, video or audio of a real person without explicit consent. Point (bb) bans AI that makes child sexual abuse material.
Article 5(1a) narrows the ban for providers. A system falls under it in two cases: making such material is its intended purpose, or the system makes it a foreseeable and reproducible outcome and lacks adequate safeguards to prevent it. For use, the ban applies where the deployer uses the system for that purpose. Article 113 sets the date.
...with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026... (Article 113)
These points rarely concern a bank or an insurer. The Article 5 screening still belongs on file for every AI system, including those you only deploy. A provider of a system that can generate images, video or audio of people should also record the safeguards that keep it outside the ban.
A checklist for 2 December 2026
Who does what, by when
What Vidimus does for 2 December
Registration screens each agent against every Article 5 practice, including points (ba) and (bb). An unsure answer goes to manual review. The answers are kept in the classification record, versioned and hashed so any later change shows.
For Article 50, Vidimus works out which paragraphs apply, who holds each, the marking deadline and whether you follow the Code. The Article 50 attestation is that section as a file, also versioned and hashed.
On the live agent, Vidimus tests the Article 50 behaviour; each test is sent ten times and the result is a pass rate (how we test). Asked to pass generated content off as human-made, does the agent refuse and say it is AI-generated? The marking solution itself is checked against your documents. Article 50 testing shows how, and how to test an AI agent explains which duties are tested on the agent and which in documents.
The next AI Act dates after 2 December 2026
The next date is 2 December 2027, when the high-risk duties start for Annex III systems. Annex I systems follow on 2 August 2028. Some provisions are disputed after the Omnibus. The timeline guide lists every date and the disputes, and the changelog records each regulatory change we track, with what it means for your agents.
To see whether the marking duty and its 2 December 2026 deadline apply to your system, run the free Article 50 check.
Quick answers
Does the 2 December deadline apply to our chatbot?
Yes, if you are its provider, it generates synthetic text, images, audio or video, and it was placed on the market before 2 August 2026. An exception may apply, such as an assistive function for standard editing. The Commission Guidelines on Article 50 discuss where the line falls.
What counts as machine-readable marking?
A signal that software can detect, such as a watermark, metadata, a cryptographic provenance record, logging or a fingerprint, as Recital 133 lists. It must be effective, interoperable, robust and reliable as far as technically feasible.
Do the new prohibitions concern banks and insurers?
Rarely. They target systems that generate non-consensual intimate imagery or child sexual abuse material. Still, screen every AI system against them and keep the answer on file from 2 December 2026.
What is the next date after 2 December 2026?
2 December 2027, when the high-risk duties start for Annex III systems. Annex I systems follow on 2 August 2028. Some provisions are disputed after the Omnibus, so ask counsel before relying on the later date.
Sources
Vidimus tests your agent’s Article 50 behaviour on the live system, ten attempts each, and files the result in a signed evidence pack.