Article 50, Both Sides

Article 50 has applied since 2 August 2026, and it is the rare obligation where knowing about it and complying with it are genuinely separate pieces of work.

EU AI Act Compliance Clock — the duty. Which of your systems the Act reaches, in what role and tier, on what date, with Article 50's ten transparency duties listed and tracked, the deployer register, the conformity roadmap and the US state overlay.

Synthetic Media & Deepfake Defense Kit — the discharge, and the other half nobody expects. The Produce side builds disclosure once — a visible caption, the platform's native label, C2PA content credentials and a register row — so one practice satisfies Article 50, the Chinese, Korean and Indian labelling rules, the YouTube, TikTok and Meta policies, New York's synthetic-performer advertising rule and the state election statements together. Plus the consent pack for the digital-replica statutes: a likeness and voice release, an employee addendum, a talent rider, and documentation for a synthetic persona built from no one.

And the Defend half you did not buy it for. Almost every organisation that produces synthetic media is also a target of it. The verification rule is the one that matters: no money, credential, data or access moves on a phone, video or message instruction without out-of-band verification through a channel the requester did not choose. The control against a cloned CFO is a callback, not a detector.

Why the pair. The Clock will tell you Article 50 applies to a chatbot and a marketing video. It will not tell you what the caption should say, whether your editing suite writes C2PA credentials, who signs the likeness release, or what happens when the synthetic voice is yours and you did not make the recording. This is that work, and it maps back to the Clock's register so the compliance evidence and the production practice are the same artefact.

All three tiers, because both kits sell all three.