Article 50 applies to your dub, and the watermark it asks for dies in your mix

What changed on 2 August 2026

Article 50 of Regulation (EU) 2024/1689 became applicable on 2 August 2026, and the European Commission's AI Office and national market surveillance authorities took up enforcement powers the same day. Two provisions land on a dubbing workflow, and they land on different parties.

Article 50(2) binds the provider: "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." A text-to-speech or speech-to-speech vendor is squarely inside that sentence. So is a localization company that builds its own voice stack and puts it on the EU market under its own name.

Article 50(4) binds the deployer: a deployer of a system that generates or manipulates image, audio or video content constituting a deep fake "shall disclose that the content has been artificially generated or manipulated." The AI Act defines a deep fake as AI-generated or manipulated content "that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful." A dub that clones the original presenter's voice into Spanish is exactly that, whether or not the presenter consented. Consent settles the rights question. It does not settle the disclosure question. Article 50(5) fixes the timing: the disclosure must be clear and distinguishable, at the latest at the time of first exposure.

The Commission published a voluntary Code of Practice on marking and labelling AI-generated content on 10 June 2026, following a first draft on 17 December 2025 and stakeholder workshops in January 2026. Signing it lets you rely on its measures to demonstrate compliance. Not signing keeps the obligation and moves the burden of proving adequacy onto you, in front of a market surveillance authority. Article 99 puts Article 50 breaches in a tier with fines up to 15 million euro or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. A limited grace period runs to 2 December 2026 for marking obligations on systems placed on the market before August 2026.

The Code is voluntary. The article is not, and it is in force now.

How well does the machine-readable mark actually hold?

Article 50(2) asks for a mark that is detectable. It does not say detectable after what. That gap is where the compliance story and the engineering story separate. Two evaluations give usable numbers.

The attack is not exotic. Self voice conversion means running the audio through a voice conversion model that targets the same speaker, so the output sounds like the same person saying the same words. Under kNN-VC the five systems land at 0.496, 0.498, 0.502, 0.539 and 0.496. Under RVC they land between 0.490 and 0.501. A dubbing house does not need to be adversarial to trigger this. Any speech-to-speech cleanup, accent smoothing, or timbre-matching pass late in the chain does the same thing to the mark.

Ordinary signal processing is less total but still uneven. A survey of nine schemes across 22 removal attacks and 109 configurations, posted March 2025, concluded that none of the surveyed schemes withstood all tested distortions.

That last row matters more than it looks. Both evaluations test MP3. Neither publishes numbers for the codecs your delivery actually uses. If you cannot cite a figure for your own encode ladder, you do not have evidence that your mark is detectable at the point a regulator would look, which is the file the viewer received.

Where the mark dies in a real dubbing chain

The mark is embedded once, early, by the voice model. Everything downstream is a chance to destroy it, and a normal localization pipeline has six or seven such chances before the file reaches a viewer.

Read that flow backwards and the design conclusion is forced. A single embedded watermark is a signal in the waveform, and every stage after the voice model is free to rewrite the waveform. A disclosure is a label attached to the delivery, and no encoder touches it. The two duties in Article 50 have opposite failure profiles, which is why treating them as one checkbox fails.

Three marking layers, and which duty each one actually discharges

C2PA covers this with what it calls durable Content Credentials: a signed manifest, an invisible watermark, and a fingerprint that lets a credential be recovered from a repository after the embedded copy has been stripped. Specification 2.4 was released in April 2026 and supports audio containers including MP3, WAV and AIFF; Deployment Guidance 1.0 followed on 8 July 2026 and is explicit that platforms strip embedded metadata during upload, transcoding and re-encoding. The three layers are not alternatives. They fail in different places.

What this means if you run a dubbing pipeline

Four decisions follow, and they are decisions about contracts and delivery specs more than about models.

Establish which party you are, per contract. If you license a voice model and dub for a client, you are a deployer under 50(4) and your vendor is the provider under 50(2). If you built the voice stack and put it on the EU market under your own name, you are both. Most localization MSAs signed before 2026 do not name either role, which means the duty is unallocated and both parties are exposed. That is a contract amendment, not an engineering ticket.

Move disclosure out of the file. Article 50(4) wants the viewer told at first exposure. A watermark cannot tell a viewer anything. The compliant artefact is a label in the player, an on-screen card at the head of the asset, or a field in the delivery manifest that the platform renders. Build the disclosure into the deliverable spec and it survives every transcode in the diagram above.

Measure the mark on the delivered file, not the master. The evaluations test the master. Regulators and viewers see the platform's output. Add a detection step after the final encode, on the same ladder the platform uses, and record the detection probability per language and per title. If that number is not in your QC report, you are asserting compliance you have not tested.

Do not let a cleanup pass run after the mark is embedded. This is the cheapest fix on the list. Any speech-to-speech model in the chain, including accent smoothing and timbre matching, is a voice conversion pass, and the January 2026 numbers say it takes the mark to random. Either embed the mark last, after every waveform-touching stage, or re-embed after each one.

None of this removes the reason to license consented voice data. It changes what consent buys you. Consent settles whether you may clone the voice. Article 50 settles whether the audience is told, and it applies to the consented clone exactly as it applies to the unconsented one.

Check it yourself

Reproduce the codec half of the claim in about ten minutes. AudioSeal is MIT licensed including the model weights, so no access request is needed.

pip install audioseal

# 1. embed a 16-bit watermark in a speech file
python - <<'PY'
import torchaudio, torch
from audioseal import AudioSeal
wav, sr = torchaudio.load("speech.wav")
wav = wav.unsqueeze(0)
gen = AudioSeal.load_generator("audioseal_wm_16bits")
wm = gen.get_watermark(wav, sr)
torchaudio.save("wm.wav", (wav + wm).squeeze(0), sr)
PY

# 2. push it through a delivery-shaped encode ladder
ffmpeg -y -i wm.wav -c:a aac -b:a 128k wm.m4a
ffmpeg -y -i wm.m4a wm_aac.wav
ffmpeg -y -i wm.wav -c:a libopus -b:a 96k wm.opus
ffmpeg -y -i wm.opus wm_opus.wav

# 3. detect on each, and compare to the master
python - <<'PY'
import torchaudio
from audioseal import AudioSeal
det = AudioSeal.load_detector("audioseal_detector_16bits")
for f in ["wm.wav", "wm_aac.wav", "wm_opus.wav"]:
    w, sr = torchaudio.load(f)
    result, message = det.detect_watermark(w.unsqueeze(0), sr)
    print(f, float(result))
PY

The third number is the one to write down. Neither published evaluation reports Opus, so whatever you get there is new information about your own pipeline. Then repeat step 2 with a speech-to-speech pass instead of a codec and compare against the 0.490 to 0.539 band in Table 1.

Primary texts to read rather than summaries of: Article 50 in full, including paragraph 5 on timing and the artistic-works carve-out; the Commission FAQ on Article 50 for the provider and deployer definitions and the 2 December 2026 grace period; and the C2PA Deployment Guidance 1.0 for the metadata-stripping behaviour of platforms.

What would prove this wrong

The claim under test is that no single embedded mark survives a production dubbing chain well enough to satisfy Article 50(2) on the delivered file. It is wrong if, by 1 June 2027, a published evaluation shows an audio watermarking scheme holding bit recovery accuracy above 0.9 through all four of: a voice conversion pass, loudness normalisation, mixing against a music and effects bed, and a platform-side Opus or AAC re-transcode, measured on the delivered file rather than the master. As of today no such result exists in either evaluation cited here, and the strongest reported figure on a single stage, MP3, is above 0.7 for four of nine schemes.

A second, softer prediction, marked as judgement rather than finding: the first Article 50 enforcement action against a dub will be brought under 50(4) for a missing viewer disclosure, not under 50(2) for a missing mark, because a missing label is observable from the outside and a missing watermark requires the authority to run a detector. If the first action instead turns on marking, the technical half of this article matters more than the contractual half, not less.

FAQ

Does the EU AI Act require AI dubbing to be labelled?

Yes, in two separate ways since 2 August 2026. Article 50(2) requires the provider of the generative system to mark synthetic audio in a machine-readable format. Article 50(4) requires the deployer to disclose a deepfake, which includes a dub cloning a real speaker's voice, clearly and at the latest at first exposure. Shipping one without the other does not satisfy the article.

Do audio watermarks survive a dubbing and delivery pipeline?

Not reliably. A self voice conversion pass moved DCT, AudioSeal, Timbre, WMCodec and VoiceMark from 0.000 to 0.148 bit error rate when clean to between 0.490 and 0.539 after the attack, where 0.50 is random, while keeping word error rate at 0.115 (arXiv:2601.20432, 14 January 2026). An earlier survey of nine schemes found none withstood all 22 tested removal attacks.

What are the penalties for breaching Article 50?

Up to 15 million euro or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher, under Article 99. Enforcement sits with national market surveillance authorities and the European AI Office. A limited grace period runs to 2 December 2026 for marking obligations on systems placed on the market before August 2026.

Does consent from the voice talent remove the disclosure duty?

No. Consent governs whether you may clone the voice. Article 50(4) governs whether the audience is told, and it applies to a consented clone on the same terms as an unconsented one. Both are needed, and they are separate documents in a compliance file.

Sources

1. European Commission, Transparency obligations under Article 50 of the AI Act. Provider and deployer definitions, 2 August 2026 application date, grace period to 2 December 2026, penalty ceiling.
2. Article 50, Regulation (EU) 2024/1689. Text of paragraphs 2, 4 and 5 and the deep fake definition.
3. Article 99, Penalties. Fine tier of 15 million euro or 3% of worldwide annual turnover.
4. European Commission, Commission publishes Code of Practice on marking and labelling AI-generated content, 10 June 2026. Voluntary status and scope.
5. European Commission, First draft of the Code of Practice, 17 December 2025.
6. Y. Özer, W. Ge, Z. Zhang, X. Wang, J. Yamagishi, Self Voice Conversion as an Attack against Neural Audio Watermarking, arXiv:2601.20432, 14 January 2026. Bit error rates for DCT, AudioSeal, Timbre, WMCodec and VoiceMark under kNN-VC and RVC; speaker similarity, WER and UTMOS.
7. Y. Wen, A. Innuganti, A. B. Ramos, H. Guo, Q. Yan, SoK paper systematising audio watermarking survival under attack in generative AI models, arXiv:2503.19176, 24 March 2025. Nine schemes, 22 removal attacks, 109 configurations; MP3, resampling, pitch shift and re-recording results.
8. C2PA, Content Credentials Deployment Guidance 1.0, 8 July 2026, and the C2PA Technical Specification 2.4, April 2026. Durable Content Credentials, supported audio containers, platform metadata stripping.
9. Meta AI, AudioSeal. MIT licence covering model weights, generator and detector API used in the reproduction steps.

Related BLOMEGA guides: Localization is the new default · Consented AI training data providers · Data provenance and chain of title.