By Jerry Heinz, CIO
Article 50 of the EU AI Act went into effect on Sunday, August 2. The eight weeks I wrote about in June are behind us. How was your week last week? Were you ready?
Article 50’s text is surprisingly short and readable. If you haven’t read it already, please do.
The text creates two duties for two different parties. The first duty falls on the provider, the party whose system generates synthetic audio, image, video, or text: under Article 50(2), the provider marks the outputs in a machine-readable format so software can detect them as artificially generated. The second duty falls on the deployer, the party that puts the content in front of an audience: under Article 50(4), when the content is a deep fake, the deployer tells the audience the content was artificially generated or manipulated. For an evidently artistic, creative, or fictional work, the deployer’s disclosure narrows to stating that generated content exists, in a manner that does not hamper the display or enjoyment of the work; the duty narrows without disappearing. Getting either duty wrong risks a fine of up to 15 million euros or 3% of worldwide annual turnover, whichever is higher, under Article 99(4).
Metadata inside the file satisfies the provider’s duty. The deployer’s duty is owed to the people watching, and people watching do not read metadata.
Between the generator and the finished film that people watch, a shot passes through a long chain of tools, and embedded metadata does not survive a transcode or a re-encode. By the time an asset reaches its final quality check, whatever the generating tool wrote into the file is frequently gone, and the record of which frames were synthetic lives in an artist’s memory or a stale spreadsheet. You now have a legal duty to answer a question your own files can no longer answer.
Two commands, no account
We shipped a free scanner as part of our Agent Skills pack that tells you if provenance metadata exists in each of your files. Just clone the repo and run one command against a directory:
```sh
git clone https://github.com/genvid-holdings/agent-skills.git
python3 agent-skills/skills/genvid-article50-readiness/article50_scan.py /path/to/media-files -o ./article50-out
```
The scanner needs Python 3.9 or newer. It makes no network calls and never asks for a Genvid account, so your media stays on your machine. Content credentials in their JPEG, PNG, WebP, video-container, and sidecar forms are all detected, along with the IPTC digital source type and the generator metadata that common pipelines leave behind.
A scan of file contents alone can’t tell you which assets were AI-generated because transcoding strips metadata and (sadly) an absence of metadata proves nothing. The scanner pairs what the files carry with a declaration: a small JSON file named `article50.json` that sits at the root of the scanned directory. You’ll want to record in the declaration anything you already know: which assets were AI-generated, which ones contain a replaced likeness, and the exact disclosure wording your audience will see; the scanner simply validates existance of the metadata so you’ll need to provide the context. We recommend keeping the declaration in version control next to the assets because the file’s history is the record of who-said-what about the material, and when.
The scan writes two files: (1) The disclosure report is JSON, one record per asset. (2) The gap list is Markdown, one entry per problem, and each entry names its fix. A script can read the result, so an automated delivery check can block actions until the issues are resolved.
Every report prints the scanner’s limits. The scanner reports only what metadata a file holds; deciding whether you are compliant depends on judgement outside the scope of this scan, so please note that the report is not legal advice. A file with no metadata returns “undetermined” because a missing signature is not evidence of no AI-involvement. The code is Apache-2.0, so you are free to inspect the rationale and to customize to your needs.
Where we stand
Genvid is a provider under Article 50(2) for the assets generated through our boundary, and we sign them. The Article 50(4) disclosure to your audience stays with you as the deployer, because we are not the party putting the work in front of the public. No vendor can take the deployer’s duty off your hands.
For the assets we do sign, every asset gets a label that says how we know what we know about it, and that label travels with the asset. A finished shot mixes frames Genvid witnessed being made with material you provided. The whole tier model is written out at [genvid.com/what-we-sign](https://genvid.com/what-we-sign/). The table at [genvid.com/docs](https://genvid.com/docs/) lists all 27 supported tools with their risk classifications, and the same source file drives our smoke tests, so the page and the boundary cannot quietly drift apart.
August 2nd has come and gone. In June, I wrote that the date that really matters is the first time your system hands you back an asset with this metadata stripped.
You can run the scan on one directory today and, in a couple of minutes, you’ll know exactly where you stand.
If the report shows a gap you think is wrong, please open an issue, and I will read it so we can improve the tool for all.