By sector
Which obligation is yours.
We mapped 83 organisations across ten sectors against the regime that actually applies to each. 57 of them are already inside a live obligation. Only 20 are waiting for December. Find the row that looks like you.
Already inside a live obligation
Generative AI platforms
Your output is synthetic media, so Article 50 lands squarely — and if the system can produce imagery of people, the UK offence reaches the tool itself, not just its misuse. What you need is a dated record of the controls you put in place and when.
19 mapped · s.66I + Art.50(2) · in force 29 Jun 2026E-commerce with AI imagery
AI-generated product and model imagery shown to EU consumers. The same pairing as the platforms: marking duties on the output, and s.66I exposure wherever the pipeline can render a person.
6 mapped · s.66I + Art.50(2) · in force 29 Jun 2026Media publishers
Provenance was already an editorial standard; the obligation formalises it. The value is the inverse of the compliance framing — a signed original lets you show a real photograph is real when someone claims otherwise.
12 mapped · Art.50(4) deepfake + public-interest text · in force 2 Aug 2026Creative agencies
Producing AI content at volume for clients who are going to ask who carries the liability. A per-asset record answers that question in the contract rather than after the complaint.
8 mapped · Art.50(4) disclosure · in force 2 Aug 2026User-generated content platforms
Your users upload synthetic content and the marking duty sits with you, not them. The hard part is not detecting it — it is holding a defensible record of what you did about it.
6 mapped · Art.50(4) disclosure · in force 2 Aug 2026Government and public bodies
Expected to be exemplary, and answerable for how they know what they publish is genuine. Article 50(1) and (3) duties run to disclosure to the people interacting with the system.
6 mapped · Art.50(1)/(3) · in force 2 Aug 2026Inside the December marking transition
These three carry the Article 50(2) machine-readable marking obligation with the four-month transition, which closes 2 December 2026. It applies only to systems placed on the market before 2 August 2026 — anything launched since had to comply on day one.
Stock marketplaces
Ingesting third-party media at scale and obliged to label what is synthetic — on material you did not create and cannot interrogate. The upstream signature is the only thing that travels with the asset.
7 mapped · Art.50(2) marking · grace ends 2 Dec 2026Enterprise software with generative features
A generative feature bolted onto a product used across the EU pulls the whole product into scope. Usually discovered by the governance team rather than the team that shipped it.
7 mapped · Art.50(2) marking · grace ends 2 Dec 2026Adtech
Synthetic creative at scale, in a sector already fluent in disclosure obligations. The infrastructure question is how marking survives the handoffs between buyer, exchange and publisher.
6 mapped · Art.50(2)/(4) · grace ends 2 Dec 2026Not a compliance target
AI governance and compliance tooling
These vendors sell AI governance, and provenance is a gap in the stack rather than a duty they carry. We treat them as a channel, not as prospects — and we say that here rather than counting them in a market-size number.
6 mapped · partner / channelWhat the record is actually for
Across every sector above the artefact is the same, and it is worth being concrete about what it does and does not do.
It survives someone changing the file
One altered byte and verification fails, with a reason. That is the whole product in a sentence.
It is checkable by someone who does not trust you
The verification is an Ed25519 signature over a content hash. A regulator, a counterparty or a court can run it without our servers and without our permission.
It records edits rather than hiding them
A hash-linked chain means a removed step is visible as a break. “All reasonable steps” needs a record where a gap shows.
It survives your own pipeline re-encoding the file
A byte-exact hash breaks the moment a platform recompresses a JPEG, even though the picture is unchanged. A perceptual hash recorded alongside it matches the transcoded asset back to its record. The two answer different questions and we keep both.
It compresses to something you can hand over
An inclusion proof for one record out of a hundred thousand is about 800 characters. It is checked by rebuilding a hash — no account, no portal, no call to us.
The first three are the provenance half. The last two exist because evidence has to survive real pipelines and real handovers, and an evidence layer that only works on pristine files inside our own interface is not an evidence layer.