C2PA vs watermarking vs metadata: what Article 50 actually requires
Article 50(2) says AI-generated output must be "marked in a machine-readable format and detectable as artificially generated or manipulated." It does not say C2PA. It does not say watermark. It does not name a single technology anywhere in its operative text.
That is deliberate, and it is the fact most implementation guides skip past on their way to recommending a product. The Act is technology-neutral: it states a functional outcome and leaves the mechanism to the state of the art. Recital 133 lists what it has in mind — "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques" — and asks that providers consider available techniques or a combination of such techniques, so far as the result is "sufficiently reliable, interoperable, effective and robust as far as this is technically feasible."
Four adjectives, one escape clause, and an explicit invitation to combine methods. This page is about what each technique actually delivers against those four words.
The four techniques#
Metadata identification#
A field in the file saying how it was made. IPTC's DigitalSourceType — trainedAlgorithmicMedia for fully generated content, compositeWithTrainedAlgorithmicMedia for AI-edited — is the established vocabulary, and XMP carries it in most formats.
- Interoperable
- excellent. Decades-old plumbing, read by everything.
- Effective
- good, where present.
- Robust
- poor. Any process that rewrites the file can drop it, and most do.
- Reliable
- poor on its own — a metadata field is an unsigned assertion. Anyone can write
trainedAlgorithmicMediainto a photograph, or delete it from generated art.
C2PA Content Credentials#
A cryptographically signed manifest bound to the file, from the Coalition for Content Provenance and Authenticity. It records what generated the content, when, and what happened to it since. The record is signed with a certificate, so tampering is detectable.
- Interoperable
- strong and improving. An open specification with real adoption across camera makers, editing tools and the major generative products, plus published verification tooling.
- Effective
- the most complete answer available for images and video.
- Robust
- the same fragility as metadata — it travels with the file, so a re-encode that discards ancillary data discards the manifest. Detached and cloud-recoverable manifests exist to soften this, at the cost of another lookup.
- Reliable
- strong, and the reason to prefer it over bare metadata. Signature verification distinguishes an intact claim from an edited one. Absence of a manifest, though, proves nothing either way.
Invisible watermarking#
A signal embedded in the content itself — pixel-domain for images, spectral for audio, token distribution for text — recoverable by a detector that knows what to look for.
- Robust
- the reason it exists. Survives re-encoding, resizing, screenshotting and re-uploading. Metadata and manifests do not survive them.
- Interoperable
- weak. Detection generally requires the originator's detector or a shared key. There is no universal reader, so a watermark that no third party can check is a mark whose detectability depends on who is asking.
- Effective
- good within its ecosystem.
- Reliable
- mixed, and honestly so. Robustness against casual transformation is good; robustness against deliberate removal is an active research problem, and published attacks degrade many schemes.
Text is the hard case throughout. Statistical watermarking of generated text is real but fragile — paraphrase, translation, or a pass through another model degrades it — and a copy-paste into a CMS strips every out-of-band alternative.
Fingerprinting and logging#
Keeping a perceptual hash of what you generated, or a log of it, and matching against it later. Robust to transformation in a way metadata is not, and interoperable only if someone can query your database. Useful as corroboration. Marking travels with the file itself.
Side by side#
| Metadata (IPTC/XMP) | C2PA Content Credentials | Invisible watermark | Fingerprint / log | |
|---|---|---|---|---|
| Machine-readable | Yes | Yes | Yes, with the right detector | Only via lookup |
| Survives re-encoding | No | Usually not | Usually | N/A |
| Tamper-evident | No | Yes | Partially | N/A |
| Third party can verify | Yes | Yes | Often not | No |
| Maturity for images | High | High | Medium | Medium |
| Maturity for text | Low | Low | Low | Low |
The table is the argument for combining techniques, which is what Recital 133 suggests and what the state of the art has converged on: a signed manifest for verifiability, plus a watermark for survivability. Neither alone satisfies all four adjectives.
What this means if you are not a model provider#
Article 50(2) is a provider duty. If you run a website that publishes AI-generated images, you are not the one obliged to mark them — the generative system's provider is. Two reasons to care anyway.
The marking rarely survives to your page. Between the generator and your published file sit an upload, a resize, a format conversion, an optimiser and a CDN, and stripping ancillary data is the default behaviour of most of that chain. Content that left the generator correctly marked routinely arrives bare. Nobody in a typical stack owns this, which is why it goes unnoticed for months. Our per-generator guides cover what each tool embeds by default and what strips it.
Absence is not evidence, in either direction. An unmarked file is not proof the content is human-made, and a marked one is not proof of anything about your compliance posture. What you can usefully know is what your own published files carry today — that is checkable, and mostly unchecked.
If you are a provider — you built the generative feature, or had it built and put it into service under your own name — then 50(2) is yours. Which role you occupy is worth settling: provider vs deployer under Article 50.
The 2 December 2026 detail#
The one deferral in Article 50 is specifically about this duty. Machine-readable marking under 50(2) is deferred to 2 December 2026 for generative systems already on the market before 2 August 2026. Everything else in Article 50 — chatbot disclosure, deepfake and AI-text labels, notices — applied on 2 August 2026 with no grace period.
That is the entire carve-out, and it is narrower than most summaries suggest. What 2 December does and does not cover.
Marking is not the same as labelling#
One distinction worth keeping straight, because the two get merged constantly:
- Marking (50(2)) is machine-readable, invisible to readers, and a provider duty. It applies to generative output broadly.
- Labelling (50(4)) is visible, for humans, and a deployer duty. It applies only to deepfakes and to public-interest AI text.
You can satisfy one and fail the other in either direction. See do you need to label AI-generated content? and the official EU icons.
Checking what your files carry#
The check is not hard and it is rarely done: download a handful of your published images and read their metadata. Any C2PA-aware viewer, or an exiftool pass looking for DigitalSourceType and C2PA manifest blocks, tells you within a minute whether your pipeline preserves provenance.
Our scanner does this as one of its checks — sampling published media for machine-readable provenance marking, recording what it found as detected, not detected, or could not verify, and sealing the result into a dated record. The free homepage scan includes it.
Common questions
Does the EU AI Act require C2PA?
No. The Act names no technology in its operative text. Article 50(2) states a functional outcome — output marked in a machine-readable format and detectable as artificially generated or manipulated — and Recital 133 lists watermarks, metadata identifications, cryptographic methods, logging methods, fingerprints or other techniques, asking that the result be sufficiently reliable, interoperable, effective and robust as far as technically feasible. C2PA is the most complete answer currently available for images and video, not a legal requirement.
Is a watermark better than embedded metadata?
They fail differently, which is why Recital 133 invites combining techniques. Metadata and C2PA manifests travel with the file, so a re-encode that discards ancillary data discards them — but they are interoperable and, in C2PA's case, tamper-evident. Watermarks survive re-encoding, resizing and screenshotting, but detection generally requires the originator's detector, so there is no universal reader. The state of the art has converged on a signed manifest for verifiability plus a watermark for survivability.
Why does AI-generated text have no good marking option?
Text is the hard case for every technique. Statistical watermarking of generated text is real but fragile — paraphrase, translation, or a pass through another model degrades it — and a copy-paste into a CMS strips every out-of-band alternative such as metadata or a manifest. This does not transfer the duty to publishers, but it does mean the marking a reader's tooling would look for is usually not there.
Whose duty is machine-readable marking?
The provider's — whoever provides the generative AI system. If you publish AI-generated images made with someone else's tool, Article 50(2) is not your obligation. If you built the generative feature yourself, or had it built and put it into service under your own name, it is.
What does the 2 December 2026 date change?
It defers exactly one thing: machine-readable marking under Article 50(2), for generative systems already on the market before 2 August 2026. Everything else in Article 50 — chatbot disclosure, deepfake and AI-text labels, notices — applied on 2 August 2026 with no grace period. That is the entire carve-out, and it is narrower than most summaries suggest.
Sources and further reading
- Article 50 — Transparency obligations (EU AI Act)
- Recital 133 — marking techniques
- Code of Practice on Transparency of AI-Generated Content
Last updated September 2026. Informational only, not legal advice: this page describes what the text of the EU AI Act says and what an external check can observe, not whether any particular site complies. Corrections welcome at hello@disclosureproof.com.