AI-generated content marking, provenance & detection (AI Act Art. 50)

Since 2 August 2026 the EU AI Act's transparency rules (Art. 50) apply: providers of generative systems must mark outputs in a machine-readable way, and deployers must label deepfakes and certain AI-written public-interest text. The practical answer is a layered stack: invisible watermarks, signed C2PA content credentials, visible labels, and verification or detection tools on the receiving side. No single technique is sufficient, so the stack must combine several.

Problem & value

• Who has the problem: (1) Providers of image, audio, video and text generators (including companies that ship a generative feature inside a product) must mark outputs. (2) Deployers - marketing teams, publishers, agencies, public bodies - must disclose deepfakes and AI text published to inform the public. (3) Platforms, newsrooms, insurers, banks and authorities need to judge whether incoming media is synthetic.
• Today: marking is ad hoc (a "made with AI" caption, stripped metadata), and detection is mostly guesswork or unreliable classifiers.
• AI value: automated marking at generation time, automatic label insertion in the publishing workflow, and verification at ingestion, with an audit trail that proves compliance.
• Regulatory driver: Art. 50(2) requires outputs to be marked in a machine-readable format and detectable as artificial, with solutions that are effective, interoperable, robust and reliable as far as technically feasible. Art. 50(4) requires deployers to disclose deepfakes and AI-generated public-interest text (not when the text had human review or editorial control with editorial responsibility). The Commission published the final voluntary Code of Practice on marking and labelling on 10 June 2026 [1][2].
• Honest limit: the Code itself acknowledges that no single marking technique fully meets the Act's requirements, and expects at least two layers (for example metadata plus watermark) where necessary [1].

Variants

• Provider-side marking: watermarking inside a generator (image/video/audio/text) plus signed provenance manifests.
• Deployer-side labelling: CMS/DAM plugins that add visible labels or the EU icon, audio disclaimers, and "AI-assisted" flags to campaigns, news and social posts.
• Chatbot disclosure (Art. 50(1)): tell users they interact with an AI, unless obvious [2].
• Camera / capture provenance: signing authentic photos at capture (C2PA-enabled devices, newsroom workflows) so that authenticity, not just synthetic origin, is provable.
• Platform and newsroom verification: read credentials on upload, query watermark detectors, show provenance badges, escalate unmarked suspicious items to humans.
• Forensic detection: classifiers for generated images/audio when no mark exists; useful as a signal, not as proof.
• Merged/adjacent: fraud-oriented voice/video deepfake detection is SEC-011; exam and academic integrity (AI text detection in education) is EDU-008. Both are only touched here as consumers of the same detectors.
• Private use: creators labelling their own AI art; consumers checking provenance via browser or platform badges (for example Google's SynthID Detector portal or Gemini-based checks for Google-made content [3]).

How it works

1. Generation side: prompt
2. generator
3. [invisible watermark]
4. [C2PA manifest signed with org certificate]
5. [metadata: IPTC DigitalSourceType = trainedAlgorithmicMedia]
6. publishing workflow
7. [visible label / EU icon / audio disclaimer]
8. channel Verification side: upload/ingest
9. read C2PA manifest + validate signature chain
10. watermark detector query (vendor API or own detector)
11. optional forensic classifier (image/audio)
12. score + explanation
13. policy: show badge | label | queue for human review | reject

Key components: - Watermarks: imperceptible signals in pixels, audio samples or text token statistics. Google SynthID covers images, video, audio and text; text marking works by adjusting word probability scores [3]. Meta AudioSeal marks speech with sample-level localisation, MIT-licensed including weights [6]. For text, the green/red-list scheme of Kirchenbauer et al. is available in open tooling such as Hugging Face TGI [7]. - Content credentials: the C2PA specification (v2.2 includes Content Credentials, Attestations and a Soft Binding API) defines signed manifests that record origin and edit history; open-source SDKs such as c2pa-rs (MIT/Apache-2.0, beta, C API available) create and validate them [4][5]. Metadata can be stripped, so soft binding (watermark or fingerprint lookup) is used to re-link stripped files to their manifest. - Labels: visible disclosure that is clear, distinguishable and given at first exposure, meeting accessibility rules (Art. 50(5)) [2]. - Human-in-the-loop: editors decide on borderline detections; a named person takes editorial responsibility for AI text that is exempt from labelling via human review.

Data preparation

Two data sets matter: the content you generate or publish (images, audio, video, text in CMS, DAM, file shares and social tools) and the metadata about how it was produced (tool, prompt, editor, date). In an SMB this is scattered across Canva or Adobe projects, shared folders, the website CMS and agency mailboxes. Typical gaps: no record of which assets were AI-generated, metadata stripped by export or upload, no central asset library, unclear rights and no examples for testing detectors.

Preparation steps: (1) inventory where AI content is produced and published (PREP-003 for shadow tools); (2) centralise assets in a DAM or structured file share (PREP-009) and add tags such as "AI-generated" and tool used (PREP-010); (3) define the marking policy and categories (PREP-019, PREP-024); (4) build a small test set of own and external AI-made and real content to evaluate detectors (PREP-018); (5) make sure export steps preserve C2PA or watermark metadata. Detection of foreign content is probabilistic, so evaluation data matters. Effort is moderate, around 20-30 percent, mostly asset inventory and workflow changes.

Implementation paths

Which path for whom

• SMB: Path B - orchestrating marking, labelling and checks with n8n or Power Automate on cloud APIs fits the existing CMS and publishing tools better than a single product.
• Enterprise: Path B - provenance marking must be wired into own content pipelines, DAM and generation tools; use shared platform APIs.
• Developer: Path C - open-source watermarking, C2PA tooling and classifiers can be embedded directly in your generation or publishing products.
• Public: Path B on sovereign EU or German cloud - authorities need marking for published AI content without sending material to non-EU services.

Path A - Buy (off-the-shelf)

• Generator vendors with built-in marking: Google (SynthID across Gemini/Imagen/Veo/Lyria outputs), Adobe (Content Credentials in Firefly and Creative Cloud), and other major vendors that sign C2PA manifests. Using these tools gets provider-side marking for free, but deployer labelling remains your duty.
• Provenance and detection services: Truepic, Reality Defender, Hive, Sensity and similar; Digimarc offers watermarking and C2PA tooling. Check each vendor's EU data residency. EU-based options exist in detection (for example Sensity, Netherlands; Resemble AI is US). Verify current offers before selection.
• CMS/DAM integration: Adobe Experience Manager, Cloudinary and similar DAMs preserve or display credentials; add a labelling step in the CMS.
• Right choice for: SMB/marketing teams that only use generators (deployer duties) and need labels plus a log, not their own models.

Path B - Build on cloud APIs

• Generate with providers that mark by default (Google Vertex AI with SynthID, Adobe Firefly API, Black Forest Labs and Mistral for EU-based providers - check their marking status individually) and wrap the output pipeline: verify marks are present, add your own C2PA manifest with c2pa-rs or the CAI SDKs, add a visible label, store an audit record.
• For verification: call the SynthID Detector (portal; partner program for others) and vendor detection APIs, combine with C2PA validation, and use a VLM or LLM only to explain results and draft moderator notes, never as the sole detector.
• Orchestrate in n8n, Power Automate or a CMS webhook. Recommended default for most SMBs and enterprises.

Path C - Self-host (open source)

• Stack: c2pa-rs / c2patool for signing and validation; AudioSeal for speech [6]; open text-watermark libraries (green/red-list schemes, Hugging Face TGI watermark option [7]); open image watermarks such as invisible-watermark or Stable Signature-style approaches for own diffusion models; open-weight classifiers for forensic detection.
• Hardware: signing and validation run on CPU (HW1). Marking inside your own generator adds negligible load; running detectors on video at scale needs a GPU (HW2).
• Ops: key management (HSM or cloud KMS for the signing certificate), certificate trust list handling, and keeping detectors updated. On-prem is fully possible for the marking and verification of your own content; detecting other vendors' watermarks usually requires their detectors, which are not open.

Path D - Custom training

Worth it only for (a) providers of their own generative models who must embed robust watermarks (training the watermark encoder/decoder jointly, red-teaming against cropping, re-encoding, paraphrasing) or (b) platforms with proprietary forensic detectors that need retraining as generators change. Data needed: large paired sets of real and synthetic media from current generators, refreshed regularly. Detectors trained on old generators generalise poorly to new ones.

State of the art (2026)

• Regulation turned into practice: the final Code of Practice (June 2026) defines a two-section structure, provider marking (Art. 50(2)) and deployer labelling (Art. 50(4)), recommends multi-layer marking, a common EU icon or equivalent labels and audio disclaimers for audio-only content [1][2]. Check the Commission's guidelines and any pending amendments (digital omnibus) for transition periods before fixing your timeline.
• Interoperability is growing: SynthID Detector is open to everyone and checks content from Google and partner tools (OpenAI, NVIDIA and Kakao named, Apple announced) [3]. C2PA 2.2 adds attestations and a Soft Binding API for linking assets to manifests after metadata loss [4].
• Limits and failure modes:
• Metadata is trivially stripped by screenshots, re-encoding and many social platforms; watermarks degrade under heavy edits, paraphrasing (text) or generative re-rendering.
• Detectors give probabilistic scores, produce false positives on real media (especially non-native writing in text) and lag new generators. Never use a score alone to accuse a person.
• Open-weight generators can run without any marking; absence of a mark proves nothing.
• Provenance proves who signed, not that content is true.
• Watermark detectors from different vendors are often not cross-readable.

Shared resources & combinations

• Shared building blocks: signing keys/KMS, c2pa SDKs, a media pipeline (transcoding, DAM), classifier and VLM serving, audit log store, review queue. Hardware overlaps with VIS-027 (content moderation) and SEC-011 (deepfake detection): one GPU inference service can run all three.
• Combines with: SEC-011 (deepfake fraud detection uses the same detectors and credentials), EDU-008 (integrity checks), VIS-027 (moderation; add provenance as a signal), ANOM-004 (fake accounts and bots posting synthetic media), ANOM-010 (fake reviews, including AI-written ones), ANOM-014 (ID liveness and injection attacks with synthetic faces), ANOM-017 (tampered or synthetic documents), ANOM-025 (scam calls with cloned voices), ANOM-029 (research image manipulation), ANOM-035 (content fingerprinting is the cousin of soft binding).

Effort, cost & KPIs

• Path A: days to weeks to switch on labelling and credential preservation; cost is mostly licences. Path B: about 1-3 months for a pipeline with signing, labelling and logging; cost drivers are API usage, certificates and integration. Path C: months; driver is key management and maintaining detectors. Path D: research-grade, a specialised team.
• KPIs: share of generated assets carrying both watermark and manifest; share of published AI content with correct visible label; manifest survival rate after each distribution channel; detector precision/recall on your own test set (including real, edited and non-native-language samples); time to review flagged items; audit log completeness.

People & change

Start with management and the communication or marketing lead: they decide the marking policy and own the publishing process. Legal or compliance clarifies which Art. 50 duties apply; they have applied since 2 August 2026, with a transition to 2 December 2026 for marking in systems placed on the market earlier (GUIDE-014). IT integrates marking into CMS and generation tools. Editors, designers and social media staff are the end users and must know when and how to mark. The DPO is involved where content shows identifiable people (deepfakes, voice).

Works council: depends. The marking itself does not monitor staff, but provenance logs record who created which content with which tool, which can be suited to monitor behaviour and then triggers section 87(1) no. 6 BetrVG. Inform the council in any case about changed work processes under section 90 (1) no. 3 and agree what the logs may be used for (GUIDE-004).

AI literacy: support staff with training on generative tools, marking duties and the limits of detectors (AI Act Art. 4, GUIDE-006). Typical concerns are extra work and false accusations when a detector flags a human-made piece. Address both: automate marking in the workflow and never treat a detector score as proof; a person decides. Combine with the company AI policy (GUIDE-007) and pilot with one channel first.

Risks, regulation & compliance

• AI Act: Art. 50 transparency obligations (limited risk) apply from 2 Aug 2026; providers: 50(2), deployers: 50(4), interaction disclosure: 50(1), biometric categorisation/emotion recognition notices: 50(3) [2]. Exceptions include standard editing assistance, evidently artistic/satirical works (reduced disclosure) and human-reviewed text with editorial responsibility. Fines for transparency breaches are set in Art. 99; confirm current figures with counsel.
• Adjacent rules: Art. 5 (prohibited manipulative practices) and Art. 4 AI literacy; Digital Services Act duties for very large platforms on deepfakes; national law on personality rights and copyright.
• GDPR: images, voices and text may be personal data; metadata can contain location or author data - strip what is not needed before embedding credentials. Detection of real persons' faces or voices is personal-data processing (and may involve biometric data); do not use detectors to profile people.
• Risks and mitigations: false accusations (human review, appeal path); false sense of security (layered approach, communicate limits); signing-key compromise (HSM, rotation, revocation); privacy leak through C2PA edit history (redaction policy); watermark removal attacks (assume determined adversaries succeed).

Getting started

1. Inventory all generative features and workflows (marketing, support bots, product features) and classify your role: provider, deployer, or both.
2. Read the Code of Practice and Art. 50 with legal counsel; define a label policy (visible label, EU icon, audio disclaimer, editorial-responsibility exemption).
3. Switch on marking in tools that support it (SynthID/Firefly credentials), and add a CMS step that checks and preserves manifests.
4. Pilot a signing service with c2pa-rs and a KMS-held certificate for your own assets; test survival across your channels.
5. Add verification at ingestion for one high-risk intake (claims photos, user uploads) and measure detector accuracy on your own samples before acting on scores.

Sources

1. Jones Day, "European Commission publishes final Code of Practice on marking and labelling AI-generated content" (June 2026): https://www.jonesday.com/en/insights/2026/06/european-commission-publishes-final-code-of-practice-on-marking-and-labelling-aigenerated-content
2. EU AI Act Article 50 text: https://artificialintelligenceact.eu/article/50/
3. Google DeepMind, SynthID: https://deepmind.google/models/synthid/
4. C2PA Specification 2.2 index: https://spec.c2pa.org/specifications/specifications/2.2/index.html
5. Content Authenticity Initiative c2pa-rs: https://github.com/contentauth/c2pa-rs
6. Meta AudioSeal: https://github.com/facebookresearch/audioseal
7. Hugging Face, watermarking in TGI: https://huggingface.co/blog/watermarking