The EU Code of Practice on AI-generated content: what it asks of you

Is the Code law?

No. The Commission's FAQ on signing says plainly: "Signing the code of practice is voluntary" and "Not signing it does not constitute non-compliance with the AI Act". What signing buys is a recognised way to demonstrate compliance across all Member States; what not signing costs is having to show each market surveillance authority that your own measures are adequate, with more information requests along the way (FAQ, read 12 October 2026). The Digital Omnibus removed the Commission's power to turn the Code into binding common rules and states that codes under Article 50(7) "do not grant a presumption of conformity" (Regulation (EU) 2026/1744, recitals, read 12 October 2026).

Sections can be signed separately; individual commitments cannot. Model providers and marking-technology vendors may sign Section 1 even though Article 50(2) does not bind them directly.

What does Commitment 1 require: marking?

The Code opens from a technical premise: "no single marking technique suffices to meet the four requirements in Article 50(2) AI Act, namely effectiveness, interoperability, robustness, and reliability", so "only an appropriate combination of marking techniques and associated detection mechanisms" can satisfy them (Code, recitals, read 12 October 2026). Measure 1.1 then asks for two layers.

Sub-measure 1.1.1, digitally signed metadata. "If content is generated, manipulated or exported in a data format that supports attaching metadata (e.g., an audio, image, video, or containerised text), Signatories will record information in the metadata on whether the content is AI-generated or manipulated. All recorded information will be digitally signed and time-stamped". The Code does not name a standard; it notes that for digitally signed metadata, unlike other techniques, interoperability standards already exist. C2PA Content Credentials are that standard in practice.

Sub-measure 1.1.2, imperceptible watermarking. "Signatories will ensure that AI-generated or manipulated content is marked with an imperceptible watermark, with the exception of very short text. For free-form text longer than 200 tokens, watermarking still needs to be applied, even though it may have lower reliability". "Very short text" is text shorter than 200 tokens, a threshold the Code expects to decrease. The watermark "is intended to serve as a robust mechanism to complement the digitally signed metadata", and may be applied after generation or built into the model.

Measure 1.2 covers non-removal: signatories "will make best efforts to preserve metadata markings on input data and content generated or manipulated by their AI system". Measures 1.3 and 1.4 are optional: richer provenance information and a function for perceptible marks.

What does Commitment 2 require: detection?

Measure 2.1: "Signatories will make available a detection solution, composed of one or more detection mechanisms, to enable deployers, users of their generative AI system, third-party integrators, end-users exposed to the content, and other legitimate parties ... to verify whether content has been generated or manipulated by their AI system". It can be provided as a public specification, as software, or as "a cloud-based service accessible to users in the Union through an API" (Sub-measure 2.1.1, read 12 October 2026). The duty is first-party: to detect your own system's output, not to judge anyone else's.

What is due by 2 February 2027?

Interoperability is staged, because "relevant interoperability standards and/or best practices are yet to be developed, except for digitally signed metadata". From 2 August 2026 signatories adopt established standards for metadata marking and detection, and publish how to access detection for their other techniques. Then:

"Signatories will implement an interoperability solution for their detection mechanisms by 2 February 2027 by implementing one or more of the following: i) a publicly available interoperable industry standard access method that enables detection queries to be routed to relevant detection mechanisms ... ii) a publicly readable signpost or other interoperable mechanism in the AI-generated or manipulated content that will signal to the public which detection [solution to use]" — Code, Measure 3.4, read 12 October 2026 (final words completed by us across a page break)

A C2PA manifest that carries the watermark's identifier as a soft binding is one way to be the signpost.

Who has signed?

The Commission's first list, published on 31 July 2026 and updated on 24 September 2026, names about 190 organisations: 95 in Section 1 and 192 in Section 2, with roughly half described as small and recent companies. Section 1 examples the Commission gives are Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, OpenAI and Synthesia. None of the eleven inference platforms on our platform pages appears in either section (list read 12 October 2026). The list stays open for signature.

What this means if you ship AI generation

If you sign, Section 1 is a build list: signed metadata and a watermark on every output, a public detection endpoint for your own outputs, preservation of upstream marks, and an interoperable detection mechanism by 2 February 2027. If you do not sign, Article 50(2) still applies and the Code is the clearest statement of what an authority will regard as adequate. Either way, the marks have to be yours: a mark in a supplier's name says the supplier generated it.

SignUnder implements Section 1's layers under your own name, with a per-customer detection endpoint designed to follow the interoperability mechanism when it is specified; it is pre-launch and the waitlist is on the homepage.

Changes

• 2026-10-12 — First published, from the final Code text, the Commission's FAQ and the signatory list as updated 24 September 2026.

SignUnder is not a law firm and this is not legal advice. Every measure here cites the Code with the date we read it.