The attention gap
Nobody was watching the right deadline
On 2 August 2026, a law started applying to your product and almost nobody in engineering noticed. It wasn't hidden. Three weeks earlier a different deadline moved, and the industry read that headline instead.
The EU's Digital Omnibus on AI entered into force on 27 July 2026. It pushed the Annex III high-risk obligations, the biometrics and hiring rules everyone had been sprinting at, from 2 August 2026 out to 2 December 2027.
Article 50's date did not move. In the Commission's own words it applies “as from 2 August 2026”. That is the part of the AI Act aimed at what you shipped: the chat widget, the “generate” button, the summarizer.
Sweep the 1,492 Hacker News stories above 60 points between 20 July and 14 August 2026 for “AI Act”, “Omnibus”, “high-risk”, and the regulation number. The deferral produced nothing above that floor. Article 50 landing produced a 446-point story and a 117-point story inside a single week.
Reddit is worse, and the split is clean. The subreddits that would have to implement this ignored it. The ones carrying no implementation burden at all ran up close to fifteen thousand upvotes across three threads.
That r/technology thread, about chatbots having to identify themselves, drew 53 comments. Not one of them is about implementing it.
Attention is not the same as action, and none of this proves a single team made a decision. The people who would have to build this were not the ones arguing about it.
On 22 June 2026, in r/LocalLLaMA, u/muntaxitome corrected someone by citing the Council's May press release.
The measures were postponed for at least 16 months and they will take a new look at which measures to actually include. Text watermarking is likely to be completely gone.
Six weeks later it was false. The top comment, at 171 points, predicted vendors would “ignore it until a month before the deadline and then say they can't do it,” and regulators would back down.
Both were the reasonable read of the news that summer. Both were wrong, and being upvoted did not help.
The obligation
Which half of Article 50 applies to you
Article 50 splits four ways, and none of them asks how big you are. Ship a system under your own name and you are a provider: 50(1) says tell people they are talking to an AI; 50(2) says mark synthetic output in a machine-readable format and make it detectable. Run somebody else's system inside your product and you are a deployer: 50(3) says notify anyone subject to emotion recognition or biometric categorisation; 50(4) says label deepfakes and AI-generated text published on matters of public interest without human review. Most teams reading this are both.
- Annex III high-risk
- 2 Dec 2027
- deferred sixteen months by the Omnibus
- Article 50 transparency
- 2 Aug 2026
- applied on schedule, with no deferral
- The one grace period
- 2 Dec 2026
- Article 50(2) only, and only for systems already on the market
On a 557-point Hacker News thread in April, one commenter noted that the Act defines a provider as anyone who places a system on the market “under its own name or trademark.” Wrap somebody else's model API in your product, and you are the provider of that system.
The one piece of relief comes from the Omnibus. Paragraph 153 of the Commission's Guidelines calls it a “targeted grandfathering rule only with regard to the marking and detection obligations under Article 50(2) AI Act for generative AI systems placed on the market or put into service before 2 August 2026,” giving those systems until 2 December 2026.
It covers Article 50(2), and nothing else. Chatbot disclosure, deepfake labelling and emotion-recognition notice got no grace period. Paragraph 153 buys you time on marking only: telling people they are talking to an AI “must be ensured as of 2 August 2026.” Ship a generative feature on or after 2 August 2026 and none of it reaches you. The ceiling is €15 million or 3% of worldwide annual turnover, whichever is higher.
The vendor
Anthropic shipped half of it on the day
A frontier lab honoured this deadline in silence.
Anthropic's help center states that “Marking will apply to output from supported models wherever Claude is offered, worldwide”. Text gets a watermark “woven” into it; generated .svg, .png and .jpg files get signed provenance metadata. Coverage spans the API, Claude and Claude Code, and models launched on or after 2 August 2026 mark at launch.
Someone read the support doc and asked the obvious question on a 446-point thread: “So, they've been doing this for over a week without telling anyone?” Another commenter had the answer: “The true reason is legal.”
The Commission's Guidelines are explicit that 50(2) is two obligations, not one. Paragraph 70 leaves no wiggle room: “Fulfilling only one element (e.g. for machine-readable marking of outputs without the means for their detection being available) will not suffice to comply with that provision.” Paragraph 75 adds that the means of detection must be available “to the persons potentially exposed to the content.”
Anthropic's own documentation says detection is coming, with details “in forthcoming technical documentation.” An engineer on the Claude Code team said publicly on 11 August that a text detection API would ship.
The most visible act of Article 50 compliance is half of a two-part obligation. That is not an accusation; the marking half is more than most companies have done.
The exemption
Your source code was never in scope
The loudest developer reaction was territorial. A post from Nick Dobos at The Browser Company on 10 August collected 1,264 likes: “Claude adding invisible watermarks? / inside MY codebase??? / total bullshit / Diabolical precedent.”
The anger is legitimate. The premise is not.
Paragraph 68 of those same Guidelines lists what falls outside Article 50(2), and the second item is source code: content “written in a programming, scripting, markup, query or configuration language that is intended to be interpreted, compiled or executed by a computing system.” It also excludes “natural-language comments and contextual information that form an integral part of the source code,” plus SDKs, SQL and configuration.
The EU did not ask anyone to watermark your repository. As one Reddit commenter put it on 12 August: “It's not, they're choosing this. The law has explicit exceptions for code. They're not required to do this.”
The same paragraph exempts short sequences like UI labels and alt text, and machine-to-machine output including agent-to-agent communication. Article 50 itself carves out more, as a 101-point comment quoted correctly: the obligation “shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data.”
The physics
The mark comes off in one paraphrase
The mechanism, explained in a 1,539-point comment on an 8,821-point r/europe thread, is statistical: the model prefers “a specific cryprographically selected token when the next token can be chosen from multiples that have the same probability.”
That signal survives copy-paste. It does not survive a rewrite. A 17 July 2026 preprint ran hundreds of paraphrase attacks against three schemes. For KGW and Unigram, “paraphrasing wiped it out in every single case.” For SynthID, “58 out of 59 initially-detected texts lost their watermark—98.3%.” The caveat has to travel with that number: they tested the open-source MarkLLM implementation, “not Google's proprietary production system,” on 50-token texts with small models, and cannot speak to how production performs.
Images are not better. MarkNull, published 10 August 2026, drives average watermark bit accuracy against SynthID-Image down to 53.14%, where random guessing is 50%. In May 2026, a commenter on a 332-point thread reported stripping SynthID with “Stable Diffusion with 10%~15% denoising strength. Done,” and it was still working months later. He added his own honest caveat: the process “will introduce the typical artifacts from SD models and that might be detected by other methods.”
Sean Goedecke argued the same for text in a 2 July 2026 essay: “re-wording the content will remove it.” He offers no measurements, so treat it as argument rather than evidence.
Nobody outside the labs can currently check any of this. On 12 August, John Wang exported 1,206 of his own Claude Code sessions spanning the 2 August cutoff and ran black-box detection across thousands of trials. Green/red list tests returned p-values of 0.677, 0.556 and 0.886. His conclusion: “I unfortunately couldn't figure out the exact scheme that Anthropic is running.”
The market's answer
Six thousand stars for the eraser, three for the marker
On 11 August 2026, the day after Anthropic's marking surfaced, a repository called watermarks-remover appeared. It strips Unicode carriers plus C2PA, EXIF and XMP metadata. As of 14 August 2026 it has 6,017 stars and 643 forks.
A week earlier, on 4 August, c2patxt appeared: a Python implementation of C2PA text marking, built to help providers comply with Article 50(2). As of 14 August 2026 it has three stars.
Two thousand to one, in favour of the eraser.
Public repositories are a poor census of compliance work, most of which happens in private ones, and three is a small enough number to be noise. The asymmetry in attention is not. An audit published 18 March 2026 ran three generators across five platforms and found labelling applied to 67% of uploads on LinkedIn and Pinterest and to 15 of 105 on Instagram. Meta sits on the C2PA steering committee.
Even correct implementations leak. Tian Pan, a staff engineer at Airbnb, wrote in April 2026 that “a C2PA implementation alone will not satisfy EU AI Act Article 50,” because the JUMBF metadata block carrying the manifest “is routinely removed by social platforms,” and by transcoding CDNs. His read of the field: “Most engineering teams building AI products are vaguely aware of this. Far fewer have actually stood up the infrastructure to comply.”
The resolution
What the law already knew
The Guidelines define robustness as the capability to identify AI-generated content “under varying conditions, covering both common alterations and adversarial attacks,” naming the exact threat model the research just demonstrated it fails. IPTC's June 2026 assessment says the Act requires solutions to be effective, reliable, robust and interoperable, but “the reality is that no technical solution currently meets all four of those criteria.” Its verdict on the least-bad option: “While it is not named specifically, the only technology that meets these criteria is C2PA.” IPTC puts interoperable detection at 2 February 2027.
So the Commission wrote a robustness requirement that nothing on the market currently satisfies. Gotcha. Except the same document saw you coming.
Paragraph 80 requires compliance only “insofar as this is technically feasible,” in light of “the generally acknowledged state of the art.” Paragraph 81 is blunter: a provider “is not obliged to make use of a technical solution that is not yet developed or available on the market.” Paragraph 83 delivers the instruction: “Providers must continuously adapt their marking and detection solutions in a timely and proportionate manner as the technology and state of the art evolves.”
Article 50 does not demand an unbreakable watermark. It demands a maintained control, closer to certificate rotation than to a compliance ticket. That is why the deferral logic that worked for high-risk does not transfer. High-risk had nothing to build against: zero CEN-CENELEC JTC 21 standards published as of 29 June 2026, and only nine of twenty-seven Member States with both required authorities designated by mid-June. Article 50 has guidelines, a code of practice with about 190 signatories, and shipping implementations.
A paper from April 2026 argues that removal attacks are not free: they “leave distinct statistical artifacts that betray the removal attempt,” detectable at a 0.1% false-positive rate across every method tested. A practitioner in media and model IP put the trade-off plainly on 14 August: watermarking has “inherently weak security guarantees,” and yet “as much as I like to take shots at poor technical choices by corps and govs, this one is unjustified. Sure, inserting glyphs is bad but biased sampling is as good as it gets in 2026.”
Best available, honestly implemented, publicly checkable, continuously updated. That is the whole ask.
- DiscloseEvery surface where your product talks to a person says it is an AI. A string change, due 2 August 2026, with no grace period
- MarkMachine-readable marks on generated text, image, audio and video, using your model provider's solution if it has one
- Let people checkMarking without available detection does not comply, and paragraph 74 keeps the burden of proof on you
Find every surface where your product talks to a person or hands them generated media, and add the disclosure; it is a string change. Mark the media with your provider's solution if it has one; paragraph 74 keeps the responsibility to demonstrate compliance with you. Publish a way to check. Skip the code, the config and the agent chatter, which paragraph 68 already exempted. Then put calendar entries on 2 December 2026, when the grandfathering expires, and 2 February 2027, when detection has to interoperate.
The deadline everyone watched moved by sixteen months. The one that didn't move is the one wired into your product. It went live on 2 August, and the most popular thing anyone has built in response is designed to defeat it. Provenance on the internet stopped being voluntary on a Sunday in August, and most engineers spent it reading about a different law.