Article 50 Has Two Halves. Most Voice Teams Built One.

Since 2 August 2026 the transparency obligations in Article 50 of the EU AI Act have been applicable, with national authorities able to enforce them and exposure running up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.

This is not legal advice. What follows is an engineering argument about which half of the obligation teams have actually built.

Two duties, not one

Article 50 asks for two different things, and they are not the same kind of work.

The first is disclosure. A system that interacts directly with a person has to make it apparent that the person is dealing with an AI, unless that is already obvious. Nearly every team shipped this. It is a sentence at the top of the call, a line in the greeting, a configuration flag. It took an afternoon and a conversation with legal about wording.

The second is provenance. A system that generates or manipulates synthetic audio, image, video or text has to embed machine-readable markings so the output is detectable as artificially generated, and provide a means of detection. For generative systems already on the market when the rules landed, a limited transitional period applies to that marking and detection duty, and it runs out on 2 December 2026.

That is the half far fewer teams have built, and the reason is not administrative.

Why the obvious implementation is hard

Ask an engineer to make audio machine-detectable and they will reach for a watermark: embed an imperceptible signal in the waveform, publish a detector, done. That is the right instinct for a downloaded file. It is a much harder proposition inside a live phone call.

Two published results frame the problem.

RAW-Bench is a benchmark that evaluated deep-learning audio watermarking methods against a realistic pipeline of distortions including compression, background noise and reverberation, across speech, environmental sound and music. Its headline finding is that neural compression is the most damaging attack on watermarks, and that this holds even when the watermarking method was trained against those compressions. Training on the attack helps. The authors are explicit that it is not always sufficient.

CallShield, published in January 2026, is among the closest work to doing this properly in real time. It embeds and recovers a watermark bit by bit inside 40-millisecond frames of live 8 kHz speech, which is to say at telephone bandwidth, in real time. What is instructive is everything the authors had to build around it. Because the channel is lossy, they treat the call as a noisy serial link and wrap it in a data-link protocol with frame synchronisation, error detection, correction and retransmission. Even then, completing their full authentication exchange takes an average of 63 seconds, including up to three retransmissions.

Now hold that against a real service call. It lasts ninety seconds. The synthetic audio is generated a phrase at a time, streamed over a narrowband codec, transcoded at least once by a carrier, possibly re-encoded by a recording platform, and interrupted constantly by a human talking over it. Whatever survives that is not guaranteed to be what the detector is looking for.

A prediction with a date on it

By the end of Q1 2027, the first serious wave of Article 50 reviews will find that a meaningful share of deployed voice systems shipped a watermark that does not reliably survive their own production channel. The teams that can actually answer whether specific audio was generated by them, on a given call, at a given time, will have answered it from a signed record rather than from the audio.

For real-time telephony the durable artifact is not the mark in the waveform. It is provenance at the record layer: for every synthesised utterance, a durable entry holding the call identifier, the timestamp, the text spoken, the voice and model that produced it, and a hash of the emitted audio, held by the provider and reachable through a detection interface a legitimate enquirer can query.

It answers the question the regulation is asking. It survives transcoding because it never travelled through the channel. And it is the same record already needed for quality review, incident forensics and any dispute about what a system told somebody.

The counter-case

The watermark advocates have a point that a record cannot fully answer. A signed record only works if someone comes and asks. It is custodial, it relies on the generator being cooperative and still in business, and it does nothing for a recipient holding an audio file with no idea where it came from. That is precisely what in-band marking is for, and it is why the research above is worth funding rather than dismissing.

A serious answer is probably both: mark what you can, and never let the mark be the only thing standing between you and the question.

There is also a fair objection that this reads an engineering constraint into a legal text that has not been tested, and the first enforcement actions may care about something else entirely. That is true. It is not a reason to arrive in December with nothing.

What to do this week

The useful exercise costs nothing. Open the architecture diagram and put a finger on the exact place where a specific generated utterance becomes findable again after the call ends.

If the finger does not land anywhere, that is the finding.