Shipping AI Content Provenance That Actually Survives Production (Post Article 50)

The EU AI Act's Article 50 transparency rules went enforceable on August 2, 2026. If you ship a generative AI feature that touches EU users, you now owe the regulator a machine readable marking on your output. The obvious shortcut, drop a C2PA manifest and call it done, does not survive contact with production. Here is what actually works, with the code to make it real. The Two Layer Reality Article 50(2) requires effective, interoperable, robust, and reliable marking. The EU Code of Practice interprets that as at least two layers: signed metadata (C2PA) plus imperceptible watermarking (SynthID or equivalent). Fingerprinting is optional layer three. The reason for two layers is not bureaucratic. It is a screenshot. C2PA lives in a JUMBF metadata box. X strips it on upload. CDNs strip it during optimization. Screenshots destroy it entirely. Microsoft admitted this openly in its February 2026 Media Integrity report: preventing every attack on provenance is not possible. Invisible watermarks embedded in the pixel content survive those operations but carry very little information. You need both. Generating a Signed C2PA Manifest (Node) // npm install c2pa-node import { createC2pa, ManifestBuilder } from 'c2pa-node'; import { readFile, writeFile } from 'node:fs/promises'; const c2pa = createC2pa(); async function signGeneratedImage(inputPath, outputPath, generationMeta) { const asset = { buffer: await readFile(inputPath), mimeType: 'image/jpeg' }; const manifest = new ManifestBuilder({ claim_generator: 'firesafe/1.0', format: 'image/jpeg', title: 'ai-generated-image.jpg', assertions: [ { label: 'c2pa.actions', data: { actions: [{ action: 'c2pa.created', digitalSourceType: 'http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia', softwareAgent: generationMeta.modelName, }], }, }, { label: 'com.firesafe.generation', data: { model: generationMeta.modelName, modelVersion: generationMeta.modelVersion, promptFingerprint: generationMeta.promptHash, timestamp: new Date().toISOString(), deployerId: generationMeta.deployerId, }, }, ], }); const signer = { type: 'local', certificate: await readFile('./certs/signing.pem'), privateKey: await readFile('./certs/signing.key'), algorithm: 'es256', tsaUrl: 'http://timestamp.digicert.com', }; const signed = await c2pa.sign({ asset, manifest, signer }); await writeFile(outputPath, signed.signedAsset.buffer); return signed.manifest; } Two things to notice. First, the digitalSourceType field is what auditors will actually search for; the IPTC value trainedAlgorithmicMedia is the standard flag for AI generated content. Second, the timestamp authority URL is not optional if you want long term verifiability. A signature without a trusted timestamp is only as good as your certificate lifetime. Embedding SynthID (Python, Vertex) If you are already on Google's Imagen or Veo stack, SynthID is applied automatically on generation, and you can verify it via the Vertex AI API. If you are running Stable Diffusion or Flux locally, you need to add an equivalent scheme yourself. Here is the Vertex path. from google.cloud import aiplatform from google.cloud.aiplatform.gapic.schema import predict import base64 aiplatform.init(project="your-project", location="us-central1") def generate_with_synthid(prompt: str) -> bytes: endpoint = aiplatform.Endpoint(endpoint_name="projects/.../imagen-3") instance = predict.instance.ImageGenerationPredictionInstance( prompt=prompt, add_watermark=True, # SynthID applied on generation ).to_value() response = endpoint.predict(instances=[instance]) image_b64 = response.predictions[0]["bytesBase64Encoded"] return base64.b64decode(image_b64) def verify_synthid(image_bytes: bytes) -> dict: """Returns detection score. Above threshold means SynthID present.""" endpoint = aiplatform.Endpoint(endpoint_name="projects/.../synthid-verifier") instance = predict.instance.VerifierInstance( image=base64.b64encode(image_bytes).decode(), ).to_value() response = endpoint.predict(instances=[instance]) return { "score": response.predictions[0]["score"], "verdict": response.predictions[0]["verdict"], # "ai" | "human" | "uncertain" } Detection is not binary. SynthID returns a confidence score, and you set the threshold. For compliance logs, log the raw score, not just the verdict. When a regulator asks how you know your marking survived a compression, you want the numbers. Deployer Disclosure Middleware Article 50(4) puts the disclosure obligation on the deployer. If you serve generated content in a product, you have to attach a human perceivable cue at the point of consumption. This should be middleware, not a per-endpoint decision. // Express middleware that stamps every AI generated response with a disclosure header // and, for HTML endpoints, injects a visible label component. import type { Request, Response, NextFunction } from 'express'; interface AIResponse extends Response { isAIGenerated?: boolean; aiModelId?: string; } export function aiDisclosureMiddleware(req: Request, res: AIResponse, next: NextFunction) { const originalSend = res.send.bind(res); res.send = function (body: any) { if (res.isAIGenerated) { res.setHeader('X-AI-Generated', 'true'); res.setHeader('X-AI-Model', res.aiModelId || 'unknown'); if (res.getHeader('Content-Type')?.toString().includes('text/html')) { const disclosureBanner = ` This content was generated with AI (model: ${res.aiModelId}). `; body = body.replace('', `${disclosureBanner}`); } } return originalSend(body); }; next(); } The header is machine readable, the banner is human perceivable. Both are required for a defensible position under Article 50(4). The Detection Endpoint You Owe Yourself The regulator will not just require that you mark content. They will ask you to prove your marking works on your own output. Build the endpoint before you need it. from fastapi import FastAPI, UploadFile, HTTPException from pydantic import BaseModel import c2pa app = FastAPI() class VerificationResult(BaseModel): c2pa_present: bool c2pa_signer: str | None c2pa_ai_flag: bool watermark_present: bool watermark_score: float verdict: str # "compliant" | "partial" | "unmarked" @app.post("/verify", response_model=VerificationResult) async def verify(file: UploadFile): content = await file.read() # Layer 1: C2PA manifest c2pa_result = {"present": False, "signer": None, "ai_flag": False} try: reader = c2pa.Reader.from_stream(file.content_type, content) manifest = reader.active_manifest c2pa_result["present"] = True c2pa_result["signer"] = manifest.signature_info.issuer for a in manifest.assertions: if a.label == "c2pa.actions": for action in a.data.get("actions", []): if "trainedAlgorithmicMedia" in action.get("digitalSourceType", ""): c2pa_result["ai_flag"] = True except Exception: pass # Layer 2: SynthID wm = verify_synthid(content) # from earlier # Verdict if c2pa_result["ai_flag"] and wm["score"] > 0.9: verdict = "compliant" elif c2pa_result["ai_flag"] or wm["score"] > 0.9: verdict = "partial" else: verdict = "unmarked" return VerificationResult( c2pa_present=c2pa_result["present"], c2pa_signer=c2pa_result["signer"], c2pa_ai_flag=c2pa_result["ai_flag"], watermark_present=wm["score"] > 0.5, watermark_score=wm["score"], verdict=verdict, ) Log every call. When a national authority asks for proof, "our compliance rate this quarter" should be a SELECT statement, not a scramble. Two Gotchas People Are Missing The Article 50(2) grace period expires December 2, 2026. If your system was on the market before August 2, you have four months to add the machine readable marking. Systems launched after August 2 owe it from day one. The August 2 immediate obligations were the deployer disclosure and chatbot rules under 50(1) and 50(4). Rolling your own watermark is a strategic mistake. The EU is standing up a public detection capability aligned with the Code of Practice, which is drafting toward SynthID compatible schemes and C2PA compliant manifests. If your custom scheme is not in that reader, your marking is not effectively detectable, and "effectively detectable" is one of the four adjectives in the statute. Fine Math Up to 15 million euros or 3 percent of global annual turnover, whichever is higher. For a startup at 10 million ARR that ships an unmarked generated image feature to EU users, worst case is 15 million euros. For a company at 5 billion ARR, worst case is 150 million euros. The gap between the effort to comply (a sprint) and the exposure (a quarter of ARR) is the largest asymmetry in AI regulation right now. Ship List for This Week Wire C2PA signing into your image, video, and audio generation pipelines. Enable SynthID (or equivalent) on every provider that supports it. If your provider does not, switch or complain. Add deployer disclosure middleware to every endpoint that returns generated content. Stand up a /verify endpoint that checks your own marking. Start logging generation events with model version, timestamp, prompt fingerprint, and disclosure applied. Talk to your DPO about Article 12 record keeping obligations, which layer on top of Article 50. Five days of grace are already gone. The next audit request lands in weeks, not years.