What a signatory list can prove

On 31 July the European Commission published a list of names. On 2 August, the obligations those names relate to became enforceable.

About 190 organisations are on it. They have signed the Code of Practice on transparency of AI-generated content, the voluntary instrument built to help providers and deployers meet Article 50 of the AI Act. Most of the coverage reported the number and moved on.

The number is the least interesting thing on the page.

What was actually published

The sequence is tighter than it looks, so it is worth setting out.

The code was published on 10 June 2026, drawn up by independent experts in a process the AI Office convened. It has two sections. Section 1 covers marking AI-generated content in a machine-readable format so that it can be detected. Section 2 covers labelling deepfakes and AI-generated text published to inform the public on matters of public interest.

On 8 July the Commission concluded that the code adequately covers the obligations in Article 50(2), (4) and (5). The AI Board adopted its own adequacy assessment the following day. That matters more than it sounds. It makes the code the single EU-wide instrument a signatory can point to, whatever member state they operate in and whichever market surveillance authority holds the file.

The deadline for inclusion in the initial list was 22 July. The list went up nine days later. Enforcement began two days after that.

Every organisation on the list made its decision before it could see anyone else’s.

The decomposition

The Commission published two totals. Section 1 has 83 signatories. Section 2 has 152.

Those do not sum to 190, because the sections are signed separately and an organisation that both builds and deploys generative systems is invited to sign both. Reading the two published tables against each other gives the breakdown: 45 organisations appear in both sections, 38 in Section 1 only, 107 in Section 2 only. That is 190 distinct organisations, which reconciles with the Commission’s own headline figure.

So the half of the obligation a person can see attracted nearly twice the signatures of the half a machine can check.

I want to be careful about what that does and does not show, because there is an obvious and boring explanation. Far more organisations deploy generative AI than build it. Agencies, news sites, consultancies, councils and manufacturers appear throughout Section 2 and have no business being in Section 1. The two populations are not the same size, so the gap is not evidence of reluctance on its own.

There is a second thing in the eligibility rules that is less boring.

Section 1 is open to organisations that carry no Article 50(2) obligation at all. The Commission says so directly. Providers of AI models can sign it. So can technology providers of marking, watermarking, provenance and detection solutions, who the Commission’s own eligibility notes describe as not directly bound by that obligation.

Read the Section 1 list with that in mind and a number of the names are visibly provenance and verification businesses rather than duty holders. That is not a criticism of them. Supplier participation in a code they helped draft is sensible, and the AI Office invited it deliberately. But it means 83 is an upper bound on the number of organisations that have signed up to mark their own output, and the true figure is lower by an amount the list does not let you calculate.

Worth knowing before anyone cites 83 as a measure of industry commitment.

The sentence the Commission wrote about its own instrument

Here is the part that has had almost no attention.

On the page announcing the adequacy assessment, the Commission describes the code as the EU-wide adequate instrument for compliance. In the same short passage, on the same page, it writes that adherence to the code “does not constitute conclusive evidence of compliance”.

Both of those are true at once, and it is not a drafting accident.

Adequacy is a judgement about design. It says that the measures set out in the code, if followed, are the right measures. Evidence is a judgement about history. It says the measures were followed, in this organisation, on the day in question.

A regulator that ran those two together would be telling you that reading the manual is the same as doing the work. This one has declined to.

I flagged the same qualification in July, when it sat in the Commission’s FAQ and could reasonably have been read as a placeholder ahead of the adequacy decision. It was not a placeholder. It survived adequacy, and it now appears in the assessment itself.

That is about as clear a statement as a regulator will ever make that a documented control and a control you can prove ran are different objects.

What signing actually buys

The benefits are real and worth having. A signatory gets one recognised route instead of an argument conducted separately with each national authority. Lighter administrative load. Predictability across borders.

And, stated plainly in the Commission’s guidance, fewer requests for information and access than a non-signatory should expect.

Look at what that is. It is a supervisory-load benefit. Signing does not answer the compliance question. It changes how often you are asked it, and in what form.

The other side of the trade is equally plain. Not signing is not non-compliance, and nobody should read the list as a naughty step. But a non-signatory has to document how its chosen measures meet Article 50, may be asked to produce a gap analysis against the code, and should expect more questions.

Both routes arrive at the same place. Someone has to be able to produce a record.

What changes in September

For signatories, the Commission has said supervision will focus on monitoring adherence to the code. Two signatory task forces launch in September to share practice and work on implementation.

That is a genuine shift, and I think it is well designed.

Before 2 August, the supervisory question was whether an organisation’s approach was adequate. From September, for anyone on that list, it becomes whether the organisation is doing the thing it said it would do. The first question is answered with a policy. The second cannot be. It can only be answered with a record made at the time the behaviour happened, by someone who was not thinking about an inspection when they made it.

Most governance regimes never make that turn. They assess the design, file the assessment, and treat the file as the outcome. This one has built the turn into the instrument.

Why the marking half is the interesting half

Machine-readable marking is unusual among controls, and it is worth naming why.

Nearly every control needs a separate audit trail bolted on afterwards. You do the thing, then you record that you did the thing, and the recording is a second piece of work competing for attention with the first. When it gets skipped, and it does get skipped, the control may well have run and there is nothing left to show it with.

A mark does not have that problem. Applied at the moment of generation, it is the obligation discharged and the proof it was discharged, in one artefact. You cannot claim it without producing it. There is no gap for the record to fall into.

That does not make it easy. The commitment carries a qualifier chain anyone drafting a compliance position should read closely: technical solutions have to be effective and interoperable as far as technically feasible, weighed against implementation cost and the acknowledged state of the art. There is room to move in that sentence. The standards are still settling, and marks can be stripped downstream by platforms and pipelines never built to preserve them.

But the shape of the thing is right. Where a control produces its own evidence, the distance between what an organisation claims and what it can show closes on its own. Where it does not, that distance opens quietly and nobody notices until somebody asks.

A note on the coverage itself

One caution, and it belongs in a piece about evidence.

In the days after enforcement began, a syndicated summary started circulating that reports specific national enforcement actions in the first week, complete with institution counts and denied extension requests. I went looking for the primary source. It does not verify, and the article carries a publication date that precedes the events it describes in the past tense.

I am not going to name it, because the point is not that one site got something wrong. The point is that regulatory coverage is now being produced at a volume and speed that outruns the events, and it reads plausibly. If you are briefing a board on AI Act enforcement this month, check the Commission and the relevant national authority directly. An assertion in an article is not evidence either.

What to do this week

Whichever way you went, write the decision down and date it.

Which sections apply to you. What you decided. When. Who decided it, and on what basis. Which inventory you checked it against. Where the supporting material lives. When you will look at it again.

That is twenty minutes of work, and it is the difference between a position you can defend and a position you can only assert.

The list published on 31 July tells you who made a claim. Between now and September, the only thing separating those 190 organisations from one another is whether anyone kept the record.

Do you know who is keeping yours?

Sources

European Commission, Code of Practice on Transparency of AI-generated Content: policy page and drafting history, updated 31 July 2026. Commission Opinion on the assessment of the Code of Practice, published 9 July 2026, recording the Commission’s conclusion of 8 July and the AI Board’s adequacy assessment of 9 July. Strong backing for the Code of Practice on Transparency of AI-generated Content, 31 July 2026, carrying the full signatory tables and the section totals of 83 and 152. Questions and answers on signing the code, last updated 10 June 2026, for eligibility, signature and withdrawal mechanics, and the consequences of not signing. Commission starts enforcing AI Act rules and new transparency requirements on 2 August, 31 July 2026. EU AI Act Article 50. All Commission pages fetched and read on 4 August 2026.

The overlap figure of 45, the section-only figures of 38 and 107, and the distinct total of 190 are derived from the published signatory tables rather than stated by the Commission, which publishes the two section totals and an approximate overall figure. The derived numbers reconcile with both.