From 2 August 2026, Article 50 of the EU Artificial Intelligence Act requires AI-generated and AI-manipulated content to be marked and, in certain cases, disclosed to the people who see it. Studios, agencies, newsrooms and the platforms that serve them are now building workflows to label their content, and many of them ask the same question: how do we prove, later, that we did it?
This article sets out what Article 50 actually requires, what it does not require, and where a qualified electronic timestamp fits in: not as a legal requirement of the AI Act, but as independent evidence, with a legal presumption under the eIDAS Regulation, of when a piece of content, its label and its review record existed, and that they have not been changed since.
It is written for video and audio producers, creative and advertising agencies, publishers and newsrooms, and for the developers of compliance and content-provenance platforms.
What Article 50 requires
Article 50 of Regulation (EU) 2024/1689 (the AI Act) sets transparency obligations for providers and deployers of certain AI systems. Two of its paragraphs concern generated content directly.
Article 50(2), for providers: “Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.” The technical solutions must be “effective, interoperable, robust and reliable as far as this is technically feasible”. The obligation does not apply to the extent the systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or its semantics.
Article 50(4), for deployers: “Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated.” Article 3(60) defines a deep fake as “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful”. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the obligation is limited to disclosing the existence of such content “in an appropriate manner that does not hamper the display or enjoyment of the work”.
The second subparagraph of Article 50(4) covers text: deployers of an AI system that generates or manipulates text published “with the purpose of informing the public on matters of public interest” must disclose that the text has been artificially generated or manipulated, unless the content “has undergone a process of human review or editorial control” and a natural or legal person holds editorial responsibility for the publication.
Article 50(5) adds that the information must be provided “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”. Under Article 50(7), the Commission encourages and facilitates codes of practice at Union level on the detection, marking and labelling of artificially generated or manipulated content, and may adopt implementing acts specifying common rules.
Who has which obligation
| Role | Obligation in Article 50 | Typical examples |
|---|---|---|
| Provider of a generative AI system | Mark the outputs in a machine-readable format, detectable as artificially generated or manipulated (Article 50(2)) | The companies that develop and offer image, video, audio or text generation tools |
| Deployer generating or manipulating deep fakes | Disclose that the content is artificially generated or manipulated; limited disclosure for evidently artistic, creative, satirical or fictional works (Article 50(4), first subparagraph) | Production companies, agencies and brands that publish such content |
| Deployer publishing AI-generated text on matters of public interest | Disclose it, unless there was human review or editorial control and someone holds editorial responsibility (Article 50(4), second subparagraph) | Publishers, newsrooms, communication teams |
A production company that uses generative tools is usually a deployer of those tools. Whether a given asset falls under Article 50(4) depends on the content itself, for example whether it constitutes a deep fake as defined in Article 3(60). That assessment is a legal one and is not covered by this article.
When it applies, and the penalties
The AI Act applies from 2 August 2026 (Article 113), and Article 50 is not among the provisions with a different date. Regulation (EU) 2026/1744 (the Digital Omnibus on AI) added Article 111(4): providers of generative AI systems that were placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026.
Under Article 99(4)(g), non-compliance with the transparency obligations of Article 50 is subject to administrative fines of up to EUR 15 000 000 or, for an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. Member States lay down the rules on penalties (Article 99(1)).
What Article 50 does not require
Article 50 does not prescribe a technology. It does not mention timestamps, and it does not require any qualified trust service. Recital 133 of the original text of the AI Act lists, as examples, the kind of techniques providers may use for marking and detection: “watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques, as may be appropriate”.
So a qualified timestamp does not make content compliant with the AI Act, and nobody should sell it as such. Its value is different: it is evidence.
Where a qualified timestamp helps
Once content is labelled, questions follow. A client asks when a disclosure was added. A platform disputes whether the delivered file carried the marking. A regulator asks how the labelling process works and whether it was followed. In each case, your own records are only as credible as your ability to show that they were not created or edited after the fact.
A qualified electronic time stamp answers exactly that. Under the eIDAS Regulation (EU) No 910/2014, an electronic time stamp is “data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time” (Article 3(33)), and a qualified one meets the requirements of Article 42. Article 41(2) gives it legal weight: “A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.” Article 24a(6), inserted by Regulation (EU) 2024/1183, requires every Member State to recognise a qualified electronic time stamp provided in another Member State.
In an Article 50 workflow, the records worth timestamping are:
- The marked or labelled output as delivered. The hash of the final file proves that this exact file, with its embedded marking or visible disclosure, existed at that time.
- The label or disclosure record. The text of the disclosure, where and how it is shown, and the asset it applies to.
- The provenance record. A manifest or a log entry describing which tool generated or manipulated the content, so that the description cannot be rewritten later.
- The review and sign-off record. For text published on matters of public interest, the exception in Article 50(4) depends on human review or editorial control; a timestamped review record documents when that review took place and what was approved.
Only the hashes are sent to the time-stamping authority. The videos, images and texts themselves, including unreleased material and personal data, never leave your infrastructure.
What a timestamp proves, and what it does not
A qualified timestamp proves that a given set of data existed at a given time and has not been changed since. It does not prove:
- that content was or was not generated by AI;
- that a marking is technically robust, or that a disclosure is adequate under Article 50;
- who created the content, unless that information is part of the record you timestamp.
Those questions are answered by your process, your tools and, where needed, legal advice. The timestamp makes the records of that process independently verifiable.
Timestamps in C2PA Content Credentials
Many marking and provenance solutions build on the C2PA specification (Content Credentials), which binds a signed manifest to a media file. Version 2.2 of the specification states, in section 10.3.2.5.1: “If possible, the claim generator should use a RFC 3161-compliant Time Stamp Authority (TSA) (RFC 3161) to obtain a trusted time-stamp proving that the signature itself actually existed at a certain date and time”.
Our service is a standard RFC 3161 endpoint, so it can be used by any software that sends RFC 3161 requests. Note that C2PA validators decide which time-stamping authorities they trust through their own trust lists; before relying on a qualified timestamp inside a C2PA manifest, check how the validators your clients use treat it. Independently of C2PA, you can always timestamp the hash of the final file and of its records yourself, as described below.
A practical workflow
- Produce and label. Generate or edit the content, apply the marking and the disclosure your process requires, and complete the human review where relevant.
- Freeze the records. Compute the SHA-256 hash of the delivered file, and write a small record (for example JSON) with the asset identifier, the disclosure text, the tool used, the reviewer and the hash of the file.
- Timestamp. Send the hash of the file and the hash of the record to the qualified TSA in RFC 3161 requests. Each request returns a timestamp token.
- Store. Keep the token with the asset in your archive or DAM. The token, the file and the record are all that is needed to verify the evidence later, with standard tools such as OpenSSL.
- Verify on demand. When a client, a platform or an authority asks, recompute the hashes and verify the tokens. Our integration guides show how, step by step.
Planning the volume
The number of timestamps follows the number of assets and records. A studio that delivers 1,000 AI-assisted assets a month and timestamps, for each one, the delivered file and its record needs about 2,000 timestamps a month, or 24,000 a year. Platforms that timestamp each review step or each version of an asset need more, and can reduce the count by grouping several records in one hash. Our prepaid volume packages are designed for this kind of predictable, high-volume use.
Test it on your own content
The simplest way to evaluate the workflow is to try it on a few real assets. Request 50 free qualified timestamps, hash a delivered file and its label record, and verify the tokens with OpenSSL or the tool of your choice.
Get 50 free eIDAS qualified timestamps → | See volume packages →
This article is a simplified explanation of the legal texts cited, based on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 and on Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183. It is not legal advice. Whether a given piece of content falls under Article 50, and how it must be marked or disclosed, should be assessed for your specific case.
Frequently asked questions
Does the AI Act require qualified timestamps?
No. Article 50 requires machine-readable marking by providers and disclosure by deployers in certain cases, but it does not prescribe any technology and does not mention timestamps. Qualified timestamps are a way to make the records of your labelling process independently verifiable, with a legal presumption under Article 41(2) of the eIDAS Regulation.
From when does Article 50 apply?
From 2 August 2026, the general date of application of the AI Act (Article 113). Providers of generative AI systems placed on the market before that date have until 2 December 2026 to comply with Article 50(2) (Article 111(4), added by Regulation (EU) 2026/1744).
Do you receive our videos or images?
No. Only the SHA-256 hash of each file or record is sent in the RFC 3161 request. The content itself never leaves your infrastructure.
Is a qualified timestamp recognised in other EU countries?
Yes. Under Article 24a(6) of the eIDAS Regulation, as amended by Regulation (EU) 2024/1183, a qualified electronic time stamp provided in one Member State is recognised as a qualified electronic time stamp in all other Member States.
Can a timestamp prove that content was not made with AI?
No. A timestamp proves that specific data existed at a specific time and has not changed since. It says nothing about how the content was created.
Can we use the timestamps with C2PA Content Credentials?
The C2PA specification recommends an RFC 3161-compliant time-stamping authority for the manifest signature, and our endpoint is a standard RFC 3161 service. Whether a C2PA validator shows the timestamp as trusted depends on that validator's own trust list, so check it with the tools your clients use.