What is the detection-means requirement?

Article 50(2) is usually summarised as "watermark your outputs," but the draft guidelines read it as two cumulative elements: outputs must be marked in a machine-readable way, and there must be a means of detection, a way for people exposed to the content to actually find out it's AI-generated. A mark nobody can check fails the second half.

Like the whole of Article 50(2), this is a provider duty: it binds companies offering a generative AI system under their own brand, not companies merely using AI tools. If you've established you're not a provider of a generative system, this page is informational for you.

What satisfying it looks like in practice: pointing to a working verification route for the marks you embed. If your outputs carry C2PA/Content Credentials, a public credentials inspector that resolves them is a detection means. If your model stack embeds a proprietary watermark, the vendor's detector is, provided it's actually accessible to the people who need it and you can show it works on your real outputs. The guidelines add a usability floor: detection results must be human-readable, understandable by a person, not just parseable by software.

The verification habit that makes this real: take actual production outputs, run them through the detection route you point people to, and keep dated results. A detection means that fails on your own outputs, because a pipeline stripped the marks or the vendor's detector doesn't cover your model version, is the gap to find before someone else does.

Timing nuance: the December 2, 2026 Omnibus grace period for systems already on the market before August 2, 2026 covers the Article 50(2) marking obligation (and is itself contingent on pending Official Journal publication). Its exact reach is something to re-verify against the final texts rather than assume. The conservative reading is to stand up marking and detection together rather than treating detection as indefinitely deferred.