{"slug": "eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2", "title": "EU AI Act Article 50(2): marking AI-generated images with C2PA before the 2 December deadline", "summary": "A developer published a readiness guide for EU AI Act Article 50(2), which requires providers of AI-generated image, audio, video and text features to embed machine-readable, interoperable markings in outputs before the 2 December transition deadline. The guide walks through attaching C2PA Content Credentials to generated images using the open-source c2patool CLI, tagging assets with the IPTC `trainedAlgorithmicMedia` digital source type, and validating the manifest with a jq-based check run against every generation path. It cautions that C2PA is one layer of compliance rather than a complete answer and notes that production signing should keep private keys out of manifest files.", "body_md": "If your product generates images, audio, video or text for people in the EU, Article 50(2) of the EU AI Act is the duty that lands on the engineering team, not the design team. It's not about a banner. It's about what travels inside the file.\n\nThis post walks through what the text says, the one transition date that matters, and a working pipeline that attaches C2PA Content Credentials to AI-generated images. It's readiness support for developers, not legal advice, and it was AI-assisted and then edited.\n\nFrom [Regulation (EU) 2024/1689, Article 50](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng), paraphrased closely:\n\nThree things developers often get wrong:\n\nIf your image or audio feature launched before August, you have roughly five weeks from today. That's the reason for this post.\n\nThe Commission has also backed a voluntary [Code of Practice on Transparency of AI-generated Content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content), with a section for providers on marking and detection. It's worth reading alongside the [Commission's Article 50 guidelines](https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations), because the regulation itself doesn't name a specific technology.\n\n[C2PA](https://c2pa.org/) (Coalition for Content Provenance and Authenticity) is an open standard for signed provenance manifests, often called Content Credentials, embedded in or attached to media files. A manifest can record that an asset was created by a generative model, using the IPTC digital source type `trainedAlgorithmicMedia` from the [IPTC NewsCodes scheme](https://cv.iptc.org/newscodes/digitalsourcetype/).\n\nIt's a strong candidate for the \"machine-readable\" and \"interoperable\" parts of 50(2), but be honest about its limits:\n\nTreat C2PA as one layer of your design, not the whole answer.\n\n[`c2patool`](https://github.com/contentauth/c2pa-rs/tree/main/cli) is the open-source CLI from the Content Authenticity Initiative. Install a prebuilt binary from the [c2pa-rs releases](https://github.com/contentauth/c2pa-rs/releases?q=c2patool) or with `brew install c2patool` on macOS.\n\nSave as `ai-generated.json`:\n\n```\n{\n  \"claim_generator_info\": [\n    { \"name\": \"acme-image-service\", \"version\": \"2.3.0\" }\n  ],\n  \"title\": \"generated.jpg\",\n  \"assertions\": [\n    {\n      \"label\": \"c2pa.actions\",\n      \"data\": {\n        \"actions\": [\n          {\n            \"action\": \"c2pa.created\",\n            \"digitalSourceType\": \"http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia\"\n          }\n        ]\n      }\n    }\n  ]\n}\n```\n\nUse your own service name and version. The key line is `digitalSourceType` with the `trainedAlgorithmicMedia` code.\n\n```\nc2patool generated.jpg -m ai-generated.json -o generated.signed.jpg\n```\n\nThe output extension has to match the input; the tool won't convert formats. Without a key and certificate configured, `c2patool` uses a built-in development certificate and prints a warning. That's fine for a spike and not fine for production. The project's docs say to keep private keys out of manifest files in production and use a subprocess or remote signer instead (see [signing docs](https://github.com/contentauth/c2pa-rs/blob/c2patool-v0.27.22/cli/docs/signing.md)).\n\n```\nc2patool generated.signed.jpg > report.json\njq -e '.. | objects | select(.digitalSourceType? | tostring | test(\"trainedAlgorithmicMedia\"))' report.json \\\n  && echo \"AI-source marker present\" \\\n  || { echo \"missing AI-source marker\"; exit 1; }\n```\n\nRun this as a test on a sample output from every generation path you ship (image endpoint, batch export, editor \"AI fill\", and so on). The most common real-world gap isn't a missing library. It's one forgotten code path that writes files without the manifest.\n\nA thin Node.js wrapper around the CLI:\n\n``` js\nimport { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nconst run = promisify(execFile);\n\nexport async function markAiImage(inPath, outPath) {\n  await run(\"c2patool\", [inPath, \"-m\", \"ai-generated.json\", \"-o\", outPath, \"-f\"]);\n  const { stdout } = await run(\"c2patool\", [outPath]);\n  if (!stdout.includes(\"trainedAlgorithmicMedia\")) {\n    throw new Error(`C2PA marker missing on ${outPath}`);\n  }\n  return outPath;\n}\n```\n\n`-f` lets the tool overwrite an existing output file. If you're in Rust, Python or JavaScript and don't want to shell out, the [C2PA SDKs](https://opensource.contentauthenticity.org/) expose the same builder.\n\nLike any transparency duty, you'll want to show what you did, not just say it. A minimal record per release:\n\n```\n# compliance/art50-2-marking.yml\nrelease: 2026-10-27\nsurfaces:\n  - name: image-generation-api\n    content: image/jpeg, image/png\n    marking: c2pa manifest, digitalSourceType=trainedAlgorithmicMedia\n    signer: remote (KMS-backed)\n    ci_check: tests/c2pa_marker.sh\n  - name: tts-export\n    content: audio/mpeg\n    marking: TODO (target before 2026-12-02)\nknown_gaps:\n  - marker stripped when users screenshot output (evaluating invisible watermark)\n```\n\nIt costs ten minutes and turns a vague \"we're working on it\" into a dated, reviewable plan.\n\nThis isn't legal advice or a compliance certification. Whether C2PA alone is \"effective, interoperable, robust and reliable\" enough for your product is a judgment for you and your counsel, informed by the Commission's guidelines and the Code of Practice.\n\nIf you're still working out which Article 50 paragraphs even apply to your product, RuleReddy has a free, no-signup [Article 50 check](https://www.rulereddy.com/eu-ai-act/tools/applicability-checker?utm_source=devto&utm_medium=article&utm_campaign=art50-50-2) that walks through the scoping questions.", "url": "https://wpnews.pro/news/eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2", "canonical_source": "https://dev.to/rulereddy/eu-ai-act-article-502-marking-ai-generated-images-with-c2pa-before-the-2-december-deadline-1opc", "published_at": "2026-10-27 14:38:20+00:00", "updated_at": "2026-10-27 14:42:23.568308+00:00", "lang": "en", "topics": ["ai-policy", "generative-ai", "ai-tools", "developer-tools"], "entities": ["European Union", "EU AI Act", "C2PA", "Content Authenticity Initiative", "IPTC", "European Commission", "c2patool"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2", "markdown": "https://wpnews.pro/news/eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2.md", "text": "https://wpnews.pro/news/eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2.txt", "jsonld": "https://wpnews.pro/news/eu-ai-act-article-50-2-marking-ai-generated-images-with-c2pa-before-the-2.jsonld"}}