C2PA & Content Credentials: machine-readable AI marking

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text to ensure outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated”, using solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible … as may be reflected in relevant technical standards” (Regulation (EU) 2024/1689, EUR-Lex).

What is C2PA?

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open technical specification for cryptographically signed provenance metadata — marketed to end users as Content Credentials. A C2PA manifest is embedded in (or bound to) a media file and records how the asset was created and edited, including whether AI tools were used. Manifests are signed, so tampering is detectable, and the format is designed for interoperability across tools from Adobe, Microsoft, Google, OpenAI and others.

Why C2PA fits Article 50(2)

• Machine-readable: manifests are structured metadata readable by any conforming tool.
• Interoperable: it is an open, multi-vendor specification — exactly the “relevant technical standards” language of Article 50(2).
• Robust: cryptographic signatures reveal stripping or tampering; durable bindings (e.g. watermark-linked manifests) improve survival across platforms.
• Detectable as AI-generated: the spec includes assertions indicating an asset was created or altered with generative AI.

No single technique is bulletproof — metadata can be stripped when platforms re-encode files. That is why the Act says “as far as technically feasible” and why serious implementations combine C2PA metadata with watermarking. Document what you implement and why.

How to add C2PA manifests today

1. Open-source tooling: the C2PA project maintains c2pa-rs (Rust) with bindings for Node.js and Python, plus a CLI (c2patool) for signing files.
2. Sign at generation time: attach a manifest with a generative-AI assertion whenever your pipeline outputs an image, audio or video file.
3. Verify: check credentials with the public Content Credentials Verify tool.

Don't want to run signing infrastructure?

We are launching a simple API: POST your image, receive it back with an embedded C2PA manifest marking it as AI-generated. Join the waitlist on our pricing page — and remember that visible disclosure duties (Article 50(1) and 50(4)) still apply alongside machine-readable marking; our disclosure badge covers those.