Take a screenshot of an AI-generated image and you have just destroyed most of what proved it was AI-generated. The cryptographic Content Credential that named the model, stamped the time, and logged the edits is gone, because a screenshot is a fresh capture of pixels carrying none of the original file’s metadata. Re-save that same image as a JPEG at quality 90 and you strip the credential again. Push it through almost any social platform or content management system and the platform’s own re-encoding finishes the job.
That fragility is the entire problem behind the December 2 deadline, and it is why the companion news post here carried the headline it did: a visible label is not enough. This piece is the other half, the practitioner half. Not what the law says, but what a content team actually deploys, what breaks the moment you publish, and where the honest answer is uncomfortable.
Two obligations, and most teams only see one
The EU AI Act’s Article 50 became applicable on August 2, 2026. The obligation most content teams are racing toward, machine-readable marking of synthetic media, carries a December 2, 2026 compliance date. Miss it and the ceiling on penalties is the greater of 15 million euros or 3% of worldwide annual turnover, which is not a rounding error for anyone reaching EU users, and the rule applies extraterritorially, so a US publisher whose output lands in front of EU readers is inside the scope.
Article 50 actually asks for two different things, and they are easy to conflate:
- Human disclosure. People need to be told, in a way they can perceive, that they are looking at or listening to AI-generated or manipulated content. This is the visible label, the “made with AI” caption, the on-screen badge.
- Machine-readable marking. The provider of the generative system must ensure the output is marked so that any compliant verifier, not just the provider’s own tool, can detect it as artificial. The regulation says this marking has to be “effective, interoperable, robust, and reliable, taking into account the state of the art.”
The visible label is the easy 20%. Any competent team can add a caption. The machine-readable half is where the engineering lives, because “robust” and “reliable” mean the mark has to survive the exact transformations that content routinely goes through on its way to a reader. That is the part most compliance checklists wave through, and it is the part that will not survive an audit.
One more distinction worth pinning down: providers of the AI system carry the marking duty, deployers carry the disclosure duty. If you generate content with a third-party model, the vendor is supposed to mark the output. Whether that mark is still attached by the time your CMS is done with it is your problem, not theirs.
Three marks, three completely different failure modes
There are three standards you will actually encounter in AI content watermarking, and the single most useful thing to understand is that they fail in opposite ways. Treating them as interchangeable “watermarks” is the mistake that produces a compliance program that looks done and is not.
C2PA Content Credentials is a cryptographically signed manifest attached to the file. It records the assertions that matter: which system created the asset, when, and what edited it since. Under the hood it standardizes three things so any verifier can read any file: JUMBF as the container format, JSON-LD as the claim schema, and COSE as the signature format, checked against the C2PA trust list. It is the richest of the three and the only one that carries a full provenance chain. It is also the most fragile, because it lives in the file’s metadata and a naive re-save wipes it.
SynthID, from Google DeepMind, is a perceptual watermark embedded in the pixels or the audio samples themselves, not in the metadata. It carries almost no context, just a detectable signal, but because it modifies the actual content rather than the container, it survives the operations that kill C2PA.
IPTC is plain-text metadata in an XMP packet. Most major generators write it, including Midjourney and ChatGPT. It is human-friendly and trivially stripped.
Here is how the three behave against the transformations content actually undergoes, drawn from published durability testing:
| Operation | C2PA | IPTC | SynthID |
|---|---|---|---|
| Screenshot | Destroyed | Destroyed | Mostly survives |
| JPEG re-save (Q90) | Destroyed | Survives | Survives |
| 50% crop | Destroyed | Survives | Often survives |
| Brightness / contrast edit | Destroyed | Survives | Survives |
| Metadata stripping | Removed | Removed | Survives |
Read that column for SynthID against the “state of the art” language in Article 50 and the conclusion writes itself. A signed manifest gives you provenance but not durability. An embedded watermark gives you durability but not provenance. The regulators know this: the finalized Code of Practice names a layered approach, cryptographic provenance plus imperceptible watermarking plus human-readable labeling, precisely because no single technique is robust and rich at the same time. You are not choosing one. You are stacking them.
SynthID is not indestructible either. A 2026 research paper demonstrated 91% watermark removal through spectral analysis, but it required aggressive processing that visibly degraded the image. For a compliance posture, that matters: casual re-encoding leaves the mark intact, and defeating it takes deliberate effort that damages the asset. That is a defensible position. “We attached a caption” is not.
If you generate images, audio, or video
This is the solvable case, so handle it first.
Start with generators that already mark at the source. As of mid-2026, C2PA is written by OpenAI’s image tools, Adobe Firefly, Microsoft Designer, Google Imagen, and Pixel devices. SynthID is written by Google Imagen, NVIDIA Cosmos, ElevenLabs for audio, and OpenAI, which joined the C2PA steering committee on May 19, 2026 and committed to embedding SynthID alongside the Content Credentials it already attaches. The scale is real: more than 100 billion images and videos plus 60,000 years of audio have carried SynthID, and Gemini’s verification tooling has been used roughly 50 million times. If your pipeline runs on tools that mark both layers, most of the work is choosing not to break them downstream.
Add or re-sign C2PA yourself when you edit. The open-source c2patool from the Content Authenticity Initiative signs an asset from the command line. The core command is genuinely one line:
c2patool -m my_manifest.json -o signed_image.jpg my_image.jpg
It signs with PS256 against your certificate chain. During development you can read the key off the filesystem; in production, put it behind a key management service or hardware security module, the same way you would treat any other signing key, because a signing key that anyone can copy signs anything. Anthropic-scale governance is not required here, but service-account discipline is.
Verify before you publish, not after. Upload a signed asset to verify.contentauthenticity.org to confirm the credential reads, and run images through Google’s SynthID detector to confirm the embedded layer is intact. Build this into the export step so a stripped asset never reaches the CMS in the first place.
Then protect the mark through your own pipeline, which is where most real failures happen. The credential does not survive your image CDN’s re-compression, your theme’s automatic resizing, or a well-meaning editor’s screenshot-and-crop. Audit your own publishing path the way you would audit any data flow: generate a marked asset, run it end to end to the live page, and check whether the mark is still there. In most stacks, the first time you do this, it is not.
If you publish text, the honest answer is different
Here is the part the vendor decks skip. This site publishes text. So do most publishers subject to Article 50, and text is where the durable-marking story falls apart.
C2PA does not ride inside a paragraph of HTML on a web page. IPTC metadata is a file-container concept; your article body is not a file with an XMP packet by the time a browser renders it. The only machine-readable option built for text is a statistical watermark, and Google’s open-source SynthID Text is the reference implementation. It works as a logits processor: as the model generates, it nudges word choices along a pseudorandom pattern that a matching detector can later read, without changing how the text reads to a human. Google open-sourced it on Hugging Face so you can run it on your own models with your own keys.
Read that mechanism carefully, because it defines who can actually use it. SynthID Text watermarks at generation time, inside the model’s sampling loop. That means you can only apply it if you control the model, in practice a self-hosted or provider-side deployment. If you paste a prompt into a hosted chat tool and copy the answer out, there is no logits processor in your hands to mark it. And even when you do control the model, the signal is weakened by short or highly factual passages and largely destroyed by rewriting or translation, which is exactly what a competent editor does to a draft.
So for a working editorial team, chasing a durable text watermark is mostly the wrong target. The right lever is written into Article 50 itself: the text disclosure obligation does not apply where the content “has undergone human review and a natural or legal person assumes editorial responsibility for it.” That is not a loophole, it is the intended design. A publisher that runs AI-assisted drafts through genuine human editing and stands behind them editorially is in a different position from a system pumping unreviewed synthetic text at the public.
The practical consequence is that your text compliance is a records problem, not a watermarking problem. You need to be able to show, per piece, that a named person reviewed it and owns it. Running IT operations at a large enterprise telecom, the mandates I dreaded were never the ones with a clean technical fix. They were the ones where the tool everyone reached for solved the visible part and quietly left the audit trail to you. Content marking is that shape exactly.
The stack that actually survives to December 2
Assemble it in this order, because each layer covers a different half of the rule:
- Provenance at the source. Standardize on generators that write both C2PA and SynthID. This is the cheapest robustness you will ever buy, and it is a procurement decision you make once. If you are running your own models, note that self-hosting is the only path that lets you own the watermarking end to end, which is one more entry in the self-hosting ledger.
- Re-sign on every edit, with
c2patoolbehind a managed key, so the chain does not go dark the moment an asset leaves its original tool. - Verify inside the publish step, so a stripped asset cannot reach a live page. Treat the check as a gate, the same way you would gate on a failing test rather than measure quality after shipping. If you already build your own evals instead of trusting a leaderboard, this is the same instinct applied to compliance.
- Disclosure plus editorial responsibility for text. Label AI-assisted pieces, and keep a per-article record of the human who reviewed and owns each one. That record is your Article 50 text posture, and it is more durable than any watermark you could attach.
- Keep the records. Who generated what, with which system, reviewed by whom, verified when. This is the same governance muscle that enterprises are already building around model logging and data retention, and it is the part an auditor will actually ask to see.
None of this is exotic. It is asset inventory, signing-key hygiene, a gate in the pipeline, and a records trail, which is why the teams that will pass December 2 are the ones treating it as an operations problem rather than a marketing feature. The visible label is the 20% you can finish this afternoon. The machine-readable layer that survives a re-encode, and the records behind the text you cannot watermark, are the 80% that decides whether the label is backed by anything.
Who gets to define acceptable marking is itself contested, the same fight playing out in the standards-body maneuvering among the frontier labs, and the technical bar will keep moving as removal research improves. But the direction is set, and December 2 is close. Generate marked, verify before you publish, and for text, keep the receipts that prove a person owns the words. The mark a reader can see is the easy part. The one a machine can still read after the internet has had its way with your file is the part worth building now.