2 August 2026. €15 Million. Does Your CMS Know What It Published?

On 2 August 2026, the EU AI Act's Article 50 transparency obligations become enforceable law. The fines are real: up to €15 million, or 3% of your global annual turnover, whichever hurts more.

Note: This page describes regulatory frameworks in general terms only. Nothing here is legal advice. Requirements vary by jurisdiction, organisation type, and use case. Consult qualified legal specialists for guidance specific to your situation.

Here is what the regulation actually requires: if your system generates, assists, or significantly shapes content intended for the public, it must carry machine-readable proof of its origin. Not a disclaimer in small print. Not a policy page. Machine-readable. Detectable by other systems. Verifiable.

For most enterprise CMS platforms, that requirement lands somewhere between "difficult" and "architecturally impossible." Not because the content teams are careless. Because the systems underneath them were never designed to track the origin of a sentence.

The provenance problem is a structural one.

Modern content pipelines are multi-handed. A product description might start as a brief drafted by a human, refined by an LLM, reviewed by an editor, localised by an AI translation service, and published through a headless CMS into five markets simultaneously. Ask that system which parts are "AI-generated" and it'll look at you blankly.

Article 50 doesn't care about the complexity of your pipeline. It cares about the output. If an AI was materially involved, the content must be marked. Machine-readably. At publication. Not retrospectively.

What machine-readable provenance actually looks like.

The European Commission's Code of Practice on Transparency of AI-Generated Content, published in June 2026, points toward technical standards like C2PA (Coalition for Content Provenance and Authenticity) as the implementation mechanism. C2PA works by attaching signed, verifiable metadata to content at the point of creation or modification: a chain of custody that survives republication, aggregation, and AI scraping.

This is precisely the problem REGINALD was designed to solve.

REGINALD (the Registry for Genuine Information, Notarised Authentication, and Legitimate Documentation) issues an Ed25519-signed attestation for each COG submitted to it. The attestation binds a digest of the submitted content to the registry's signing key, published as a DID document any verifier can resolve, and records when the registry received it. A verifier re-hashes the content, resolves the key, and checks the signature without asking the registry to vouch for the answer. What the attestation dates is the submission. When a document was written, revised, or AI-assisted is the publisher's own claim, carried inside the content and covered by the digest rather than observed by the registry.

For a CMS publisher, this means each submitted document has a dated, signed record a third party can check against the bytes. Origin, revision history, reviewers, and any AI involvement travel in the document's own metadata, which the publisher hosts and the attestation covers by digest, so the evidence stays with the file rather than in a database somebody else controls. Submitting is the publisher's act, and that's the honest limit: the registry holds what it was sent, and a document nobody submits leaves no record of its own absence.

The compliance question is really a content infrastructure question.

"Are we compliant with Article 50?" is the wrong question. The right question is: does our content infrastructure know what it published, who created it, and how it came to exist?

If your documents carry their own provenance, Article 50 compliance is a byproduct, not a project. If they don't, the August deadline arrives with no plan from most legacy CMS vendors to meet it.

The companies that will navigate this cleanly are the ones that treated document provenance as infrastructure from the start: not a legal feature bolted on before a deadline, but a structural property of every file they publish.

MX was built for exactly that job. The deadline just made it urgent for everyone else.

A note on scope. The 2 August deadline applies in full to any system placed on the market from that date. For generative systems already on the market before it, the AI Omnibus gives providers a transitional period, to 2 December 2026, to implement the Article 50(2) machine-readable marking. That extension is narrower than it sounds: it covers the provider's marking duty and nothing else. The deployer duties aren't extended - labelling deepfakes, labelling AI-generated text on matters of public interest, and disclosing a chatbot's nature all apply from 2 August 2026, however long the underlying model has been deployed. If your CMS is publishing AI-generated text on matters of public interest from August 3 onwards, the labelling duty applies regardless of when you deployed the model.

If you're a CMS vendor, a digital agency, or a publisher with AI-generated content in your stack and no provenance layer beneath it, I'm happy to talk.

Tom Cranstoun leads Digital Domain Technologies Ltd, trading as CogNovaMX, and founded the Machine Experience (MX) practice. MX: The Handbook is available now. MX: The Protocols follows in 2026.