If your product generates images, audio, video or text for people in the EU, Article 50(2) of the EU AI Act is the duty that lands on the engineering team, not the design team. It's not about a banner. It's about what travels inside the file.
This post walks through what the text says, the one transition date that matters, and a working pipeline that attaches C2PA Content Credentials to AI-generated images. It's readiness support for developers, not legal advice, and it was AI-assisted and then edited.
From Regulation (EU) 2024/1689, Article 50, paraphrased closely:
Three things developers often get wrong:
If your image or audio feature launched before August, you have roughly five weeks from today. That's the reason for this post.
The Commission has also backed a voluntary Code of Practice on Transparency of AI-generated Content, with a section for providers on marking and detection. It's worth reading alongside the Commission's Article 50 guidelines, because the regulation itself doesn't name a specific technology.
C2PA (Coalition for Content Provenance and Authenticity) is an open standard for signed provenance manifests, often called Content Credentials, embedded in or attached to media files. A manifest can record that an asset was created by a generative model, using the IPTC digital source type trainedAlgorithmicMedia from the IPTC NewsCodes scheme.
It's a strong candidate for the "machine-readable" and "interoperable" parts of 50(2), but be honest about its limits:
Treat C2PA as one layer of your design, not the whole answer.
c2patool is the open-source CLI from the Content Authenticity Initiative. Install a prebuilt binary from the c2pa-rs releases or with brew install c2patool on macOS.
Save as ai-generated.json:
{
"claim_generator_info": [
{ "name": "acme-image-service", "version": "2.3.0" }
],
"title": "generated.jpg",
"assertions": [
{
"label": "c2pa.actions",
"data": {
"actions": [
{
"action": "c2pa.created",
"digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
}
]
}
}
]
}
Use your own service name and version. The key line is digitalSourceType with the trainedAlgorithmicMedia code.
c2patool generated.jpg -m ai-generated.json -o generated.signed.jpg
The output extension has to match the input; the tool won't convert formats. Without a key and certificate configured, c2patool uses a built-in development certificate and prints a warning. That's fine for a spike and not fine for production. The project's docs say to keep private keys out of manifest files in production and use a subprocess or remote signer instead (see signing docs).
c2patool generated.signed.jpg > report.json
jq -e '.. | objects | select(.digitalSourceType? | tostring | test("trainedAlgorithmicMedia"))' report.json \
&& echo "AI-source marker present" \
|| { echo "missing AI-source marker"; exit 1; }
Run this as a test on a sample output from every generation path you ship (image endpoint, batch export, editor "AI fill", and so on). The most common real-world gap isn't a missing library. It's one forgotten code path that writes files without the manifest.
A thin Node.js wrapper around the CLI:
import { execFile } from "node:child_process";
import { promisify } from "node:util";
const run = promisify(execFile);
export async function markAiImage(inPath, outPath) {
await run("c2patool", [inPath, "-m", "ai-generated.json", "-o", outPath, "-f"]);
const { stdout } = await run("c2patool", [outPath]);
if (!stdout.includes("trainedAlgorithmicMedia")) {
throw new Error(`C2PA marker missing on ${outPath}`);
}
return outPath;
}
-f lets the tool overwrite an existing output file. If you're in Rust, Python or JavaScript and don't want to shell out, the C2PA SDKs expose the same builder.
Like any transparency duty, you'll want to show what you did, not just say it. A minimal record per release:
release: 2026-10-27
surfaces:
- name: image-generation-api
content: image/jpeg, image/png
marking: c2pa manifest, digitalSourceType=trainedAlgorithmicMedia
signer: remote (KMS-backed)
ci_check: tests/c2pa_marker.sh
- name: tts-export
content: audio/mpeg
marking: TODO (target before 2026-12-02)
known_gaps:
- marker stripped when users screenshot output (evaluating invisible watermark)
It costs ten minutes and turns a vague "we're working on it" into a dated, reviewable plan.
This isn't legal advice or a compliance certification. Whether C2PA alone is "effective, interoperable, robust and reliable" enough for your product is a judgment for you and your counsel, informed by the Commission's guidelines and the Code of Practice.
If you're still working out which Article 50 paragraphs even apply to your product, RuleReddy has a free, no-signup Article 50 check that walks through the scoping questions.