← All work

Machine-readable provenance for synthetic media

Marking AI-generated video so it is detectable as artificially generated, as Article 50(2) of the EU AI Act requires — and what actually survives publication.

• C2PA / Content Credentials
• IPTC DigitalSourceType
• FFmpeg
• c2patool

The obligation

Article 50(2) requires providers of systems that generate synthetic image, audio, video or text to mark those outputs in a machine-readable format, detectable as artificially generated. It applies from 2 August 2026, and it was not among the provisions deferred by the Digital Omnibus. Systems already on the market before that date have until 2 December 2026 for the marking requirement.

It is a duty on the provider of the generating system — not on the platform the content is later published to.

What we mark

Two layers, written in order, at render time:

1. IPTC DigitalSourceType — an XMP claim naming how the asset was produced (trainedAlgorithmicMedia for fully generated, distinct values for composites and AI-assisted edits of real capture). Cheap, widely read.
2. C2PA Content Credentials — a signed manifest recording the generating software, the edit actions applied, and the publishing organisation. Tamper evident: any later modification breaks the signature.

Signing is the last operation that touches the file. Any re-encode or metadata write afterwards invalidates the manifest, so it sits after the final mux and before upload.

What we do not claim

Major platforms read provenance metadata on ingest, use it to apply their own AI labels, then re-encode and discard it. The credential does not survive on the platform, and a file downloaded from a post carries no manifest.

That is a limitation of distribution, not of the marking. The obligation is discharged at the point of output, so the durable record is the signed original we retain together with its hash, manifest identifier and signing certificate — not the published copy.

Anyone claiming a credential that stays attached through Instagram is describing something that does not currently happen.

Why it is worth doing anyway

• It is the obligation, and the date has passed.
• Platform classifiers treat declared AI origin better than undeclared. Marking works with detection rather than against it.
• The retained record is auditable: per asset, the model, the source type, the signature and the time it was produced.

Talk to us about this