Providers of systems that generate synthetic text, images, audio or video must mark that output in a machine-readable way under Article 50. For agents, that covers drafted documents, synthetic voice and generated images, not field updates or routine edits. Marks survive best when an embedded tag is backed by a signed record kept outside the content.
What does the marking duty require, in plain words?
Under Article 50 of the EU AI Act, providers of AI systems that generate synthetic audio, image, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solutions must be effective, interoperable and reliable as far as technically feasible, taking account of the type of content, the cost of implementation and the generally acknowledged state of the art.
There are exceptions. The duty does not apply where the system performs an assistive function for standard editing, or does not substantially alter the input data or its meaning. Separate deployer duties require disclosure of deep fakes and of AI-generated text published to inform the public on matters of public interest. The full set of Article 50 duties is in Article 50 transparency for AI agents.
Who does the marking duty apply to?
It sits with the provider: whoever builds the generating system or places it on the market under its name. A firm that builds its own agent on top of a model is likely the provider of that agent, and may need to mark its outputs even though the underlying model provider marks too. A firm that deploys a vendor's agent unchanged relies on the vendor's marking and must not remove it.
That last point is easy to break. Templates, document converters and email systems often strip metadata as a side effect, so a deployer can defeat a provider's marking without meaning to.
Which agent outputs need marking?
Sort agent outputs into three groups.
Generated content. Letters, reports, summaries for external use, synthetic voice on calls, generated images. These are synthetic text, audio or images and fall within the duty unless an exception applies.
Assistive edits. Correcting spelling, reformatting a table, translating a fixed template field by field. These typically fall within the exception for standard editing or for not substantially altering the input.
Actions, not content. Updating a field in a CRM, posting a ledger entry, calling an API, routing a ticket. These are acts, not synthetic content, and marking does not fit them. They need an action record instead, which is a different duty and a different control, as we argue in Article 12 logging is not enough for agents.
Customer letters drafted by an agent and reviewed by a person are still generated text. Review changes who the customer is dealing with, as explained in Article 50 and agents that write to customers, but not how the text was produced.
How do you mark agent output so the mark survives?
No single technique survives every route a document takes. Text watermarks are weak, metadata is stripped by copying and conversion, and visible labels are cropped. Combine three layers.
- Embedded mark in the content where the format allows: document properties, email headers, audio watermarks, image metadata.
- Signed provenance manifest attached to the file, stating that it was generated, by which system and when, signed so tampering is detectable.
- External record of every generated output, stored with a fingerprint of the content, so anyone holding a copy can check it against your record even if the embedded mark is gone.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Machine-readable marking | Embedded tags in documents, headers and media for every generated output | Sample outputs showing tags |
| Detectable as AI-generated | Signed provenance manifest attached; verification tool available | Manifest and verification results |
| Effective and reliable | Marks tested through real channels: email, PDF conversion, print, forwarding | Survival test results per channel |
| Interoperable | Open, documented formats used for marks and manifests | Format specification on file |
| Exceptions applied correctly | Each output type classified as generated, assistive or action | Output classification register |
| Deployer does not strip marks | Templates and converters reviewed for metadata loss | Channel review record |
What will a supervisor or auditor ask?
- Which outputs do your agents generate, and which are marked?
- Which output types have you treated as exempt, and why?
- Show us a marked letter after it has been converted to PDF and emailed. Is the mark still there?
- If a customer sends you a document claiming it came from you, can you tell whether your agent produced it?
- Who reviewed your channels for metadata stripping?
The fourth question shows why the external record matters. It is the one layer you control entirely, and it also guards against forged documents that claim to be yours.
What does the marking duty not cover?
It does not require a visible label to the reader; that is the disclosure duty. It does not mark actions, which need an action record. It does not cover content a person writes with an agent's light assistance, where the editing exception applies. And it does not settle how good marking must be; further guidance and codes of practice are expected to shape what counts as effective. For the wider control map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Can text really be watermarked?
Statistical watermarks for text exist but are fragile, especially after editing or translation. That is why metadata, signed manifests and an external record are needed alongside any text mark.
Do internal documents need marking?
The duty is framed around the output, not its audience, so internally used generated content can be in scope. Internal-only use also makes marking easier, since you control every channel.
Does a person editing the draft remove the need to mark it?
Light edits do not change that the text was generated. If a person rewrites it substantially, the result is closer to human-authored content, but record the original draft and the edits so the history is clear.