By Rafael Luque Ocaña

The code of practice on AI content transparency gets the green light: what it is and what it isn't

The Commission and the AI Board have confirmed the code of practice on AI-generated content as an adequate tool for demonstrating the transparency obligations. What signatories gain, and the nuance no signatory should forget.

Three weeks before 2 August — the date the transparency obligations under Article 50 start to apply —, the European Commission has moved an important piece: together with the AI Board, it has confirmed through a formal opinion that the code of practice on the transparency of AI-generated content is an adequate voluntary tool for demonstrating compliance with those obligations. It is the formal assessment the Code needed to move from an interesting document to a reference instrument. It's worth understanding what that means — and, with the same care, what it doesn't. It concerns those who provide generative systems and those who publish content generated with them.

What the Code is

The Code is a voluntary instrument drawn up under the AI Act to translate into concrete measures the detection, marking and labelling obligations of Article 50 — those in its paragraphs 2 and 4: how to mark synthetic content and how to label deep fakes and text of public interest. Its structure mirrors the allocation of roles under the Regulation itself:

  • Section 1, for providers: the measures for those who develop the systems — the technical marking of content.
  • Section 2, for deployers: the measures for those who use the systems and publish content — the labelling of deepfakes, the declaration of text of public interest.

A practical detail worth noting: you can sign just one of the two sections. A company that doesn't develop AI but does publish content generated with it can adhere to Section 2 alone, since that's the one that reflects its actual role in the chain.

Article 50: who owes each transparency dutyArticle 50(1) to (4) of Regulation (EU) 2024/1689EACH PARAGRAPH HAS ITS OWN SUBJECT: TWO FALL ON THE PROVIDER, TWO ON THE DEPLOYERYESYESYESYESYour AI system · each question is answered on its ownDoes it interactwith people?ART.50(1)Providerdesign it so peopleknow they areinteracting with AI,unless that is obviousDoes it generatesyntheticcontent?ART.50(2)Providermark outputs in amachine-readable,detectable format;except standardediting support or notsubstantially alteringthe input dataEmotionrecognition orcategorisation?ART.50(3)Deployerinform the peopleexposed of how thesystem operates andprocess data under theGDPRDeep fake ortext on publicmatters?ART.50(4)Deployerdisclose it isartificial; for text,unless human review oreditorial control anda person holdseditorialresponsibilityArt.50(1)-(4) of Regulation (EU) 2024/1689 · Regulation (EU) 2026/1744 only replaces paragraph 7
Each paragraph of Article 50 binds a different subject, and the same system may trigger several or none. All four exempt uses authorised by law for criminal-law purposes — in Article 50(1), unless the system is available for the public to report a criminal offence — and for evidently artistic, creative, satirical, fictional or analogous works the Article 50(4) duty is limited to disclosing that the content exists. When each one applies is on the calendar.

The figure allocates the four duties of Article 50: the notice that people are interacting with an AI system and the marking of synthetic content fall to the provider; the information on emotion recognition or biometric categorisation and the disclosure of deep fakes and of text published to inform the public on matters of public interest, to the deployer.

What changes with the opinion

Until now, the Code was a published text with an aspiration to become a reference. With the favourable opinion of the Commission and the AI Board, its status moves up a notch: signatories can rely on its measures to demonstrate compliance with the transparency obligations — without adherence granting a presumption of conformity. For a signatory, that translates into a more predictable path: instead of defending to an authority that your home-grown labelling solution is adequate, you demonstrate that you follow the measures of an instrument the Commission has already assessed.

What the Code is not

Here is the nuance that separates a serious reading from a commercial one, and we say it with the same clarity the Commission itself uses: signing the Code does not, by itself, establish legal compliance. Signing is not complying; it's committing to a set of measures whose real application will have to be demonstrable. A signatory who mislabels its content falls short just as much as a non-signatory — with the aggravating factor of having promised otherwise in writing.

And the reverse is also true: not signing exempts no one from anything. The obligations of Article 50 apply from 2 August 2026 to whoever they concern according to their role, Code or no Code. The Code is a facilitated route to demonstrating compliance, not the source of the obligation nor its only form of compliance.

In the vocabulary we always use on this blog: the Code is a best practice — voluntary, valuable, and with no presumption of conformity: recital 41 of Regulation (EU) 2026/1744 says of the codes of practice under Article 50(7) that they "have limited legal effect, and in particular do not grant a presumption of conformity" —; the underlying obligations of Article 50 are applicable law from August. Conflating the two levels leads to two mirror-image errors: believing that without signing you're outside the law (no), or believing that by signing you already comply (not that either).

What to do, depending on your situation

Article 50 series → the four paragraphs on one page.

If you're an SME that uses generative AI and publishes content — the situation most companies are in —, the decision to sign Section 2 deserves calm consideration: it gives you an already-assessed framework of measures and a public signal of commitment; in return, it requires you to actually apply it and be able to demonstrate that you do. For many small companies, the reasonable alternative is not to sign yet but to align your practices with the Code's measures — you benefit from the criteria without taking on the formal commitment, leaving the signature for when your operations are more mature.

Either way, what isn't optional is the usual: knowing what content you generate, labelling it wherever Article 50 requires it, and keeping evidence of how you do it. To put it into practice, there are the official icons the EU has published for labelling and the editorial-review route for text. The Code gives you a framework; the work, as always, is yours.

This article is for informational purposes only and does not constitute legal advice.

Frequently asked questions

What is the Transparency Code?

A voluntary code of practice for applying the detection, marking and labelling obligations of Article 50(2) and (4). The Commission encourages its drawing up and assesses whether adherence to it is adequate (Article 50(7)).

Does signing it give a presumption of conformity?

No. According to recital 41 of Regulation (EU) 2026/1744, these codes have limited legal effect and do not grant a presumption of conformity.

What happens if I don't sign it?

Nothing different: the Article 50 obligations apply all the same, with or without the code, according to each party's role.

Get analysis like this in your inbox

Alethexis regulatory and product news. No noise.

I agree to receive communications from Alethexis: content about AI and regulation, and product news. I can unsubscribe at any time.

Data protection — newsletter

Controller: ALETHEXIS, S.L. (NIF B88758057). Purpose: to send you the Alethexis newsletter (content about AI and regulation, and product news). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Recipients and transfers: we use providers acting on behalf of Alethexis for hosting, security and email delivery. No disclosure of your data to third parties for their own purposes is planned, except where required by law. Some providers may process data outside the EEA with the safeguards set out in the additional information. Rights of access, rectification, erasure, objection, restriction and portability: [email protected]. You may lodge a complaint with the Spanish Data Protection Authority (AEPD, www.aepd.es) or with the supervisory authority of your Member State (Article 77 GDPR). More information in the privacy policy.