EU Code of Practice — Second Draft
3 March 2026 · what changed, what's next, how to prepare

The EU Code of Practice on AI-Generated Content is a standard-setting instrument developed under the EU AI Pact framework. It specifies the technical and operational requirements for satisfying Article 50 transparency obligations. Draft 1 was published in late 2025. Draft 2 was published on 3 March 2026. The final version is expected in June 2026. While compliance with the Code is technically voluntary (Article 50 itself is the law), the Code establishes the accepted standard of compliance — following the Code provides a presumption of conformity; deviating from it requires the provider to demonstrate equivalent effectiveness to the regulator.

The explicit two-layer marking mandate. Draft 1 suggested machine-readable marking as a best practice. Draft 2 requires at least two active layers — specifically C2PA v2.3 provenance metadata plus an imperceptible watermark. This change makes single-layer solutions (C2PA-only or watermark-only) effectively non-compliant under the draft Code. Providers who invested in single-layer solutions between draft 1 and draft 2 now need to add the second layer before enforcement begins.

The European Commission aims to publish the final version in June 2026 — approximately 8 weeks before the 2 August 2026 enforcement date for new systems. Our analysis suggests the final version will: harden the two-layer requirement (potentially making it explicit instead of 'preferred'), standardise watermark algorithms via ISO reference, specify a standardised attestation format, add cross-platform interoperability requirements, and introduce stricter rules for deepfake and political content. Text marking requirements may also tighten if the technology matures.

Four concrete steps: (1) Implement a two-layer marking solution now (C2PA + invisible watermark) — this is the bulk of the work and is net-new whether or not the final version changes minor details. (2) Build an audit trail pipeline that logs every generation event with marking status — the draft 2 attestation requirement is likely to harden, not soften. (3) Design your deployer disclosure workflow with prominence and persistence in mind — visible labels should be proximate, clearly distinguishable, and persistent across sharing. (4) Subscribe to the Code of Practice revision tracker — our Pro subscription includes automatic updates to the marking pipeline as the standard evolves.

The Code of Practice applies to all providers of generative AI systems and all deployers within the scope of the EU AI Act. There is no size-based exemption for Article 50 transparency obligations. Small and medium enterprises are subject to the same marking, disclosure, and attestation requirements. However, the Code may include phased implementation or proportionality provisions in the final version — these are not yet confirmed. Our £9 Quick Kit exists specifically to give smaller teams a low-cost compliance validation path.

The final version will be the reference standard for compliance assessment. If it introduces new requirements beyond draft 2, providers and deployers will need to update their implementations within the transition period (if any) specified in the final text. Our kit is designed for upgradeability: the C2PA signing layer is spec-compliant and future-proof; the watermark layer can be swapped or extended; and the audit/attestation pipeline uses a flexible schema that can accommodate standardised formats. Pro and Enterprise subscribers receive all final-version updates at no additional cost.

The draft 2 text confirms enforcement expectations: national supervisory authorities will begin compliance monitoring from 2 August 2026 for new systems. Graduated enforcement is expected — initial notices and corrective orders rather than immediate maximum fines — but non-compliance from day one creates legal exposure and attracts regulatory scrutiny. Several EU member states (Ireland, Germany, France, Netherlands) are actively building AI Act enforcement capacity, including dedicated AI inspectorates. First penalty actions are expected within the first 6-12 months of enforcement.