Labeling AI content for Russia's March 2027 rules: an engineering checklist A developer published an engineering checklist for complying with Russia's AI content labeling rules, which take effect 1 March 2027, covering provenance manifests, JSON Schema validation, ExifTool metadata embedding and ffmpeg remuxing. The approach pairs each asset with a single manifest sharing an ID, then derives file metadata, visible labels and HTTP headers from that one source so the provenance record cannot drift or be silently stripped. The author estimates 90–120 minutes for the first asset and about ten minutes for each subsequent one once the schema, metadata commands and CI verification script exist. Russian rules on labeling AI-generated content take effect on 1 March 2027. The legal analysis belongs to someone else; what landed on my desk is the engineering side — making sure every asset that leaves the pipeline carries a provenance record both a person and a machine can read, and that it cannot quietly lose that record later. Below is the setup I would hand to another developer. Budget 90–120 minutes for the first asset. Once the manifest format, the metadata commands and the CI script exist, each additional asset costs roughly ten minutes. Rule number one: every artifact gets one manifest and one asset file sharing the same ID. That single convention is what makes everything else scriptable — checksums, metadata writing and the CI loop all key off the same name. mkdir -p ai-labeling/{schema,manifests,assets,scripts} cd ai-labeling git init ai-labeling/ ├── schema/label.schema.json ├── manifests/img-2027-0001.json ├── assets/img-2027-0001.jpg └── scripts/verify labels.sh Tools to have ready, with the version check I run first: jsonschema package pip install jsonschema ; confirm with python3 --version . ajv-cli runs through npx , so there is nothing to install globally: check node -v and npx --version . exiftool -ver . ffmpeg -version | head -n 1 . $PSVersionTable.PSVersion . The manifest is a plain-text provenance record: what produced the asset, when, and whether a human reviewed it. It exists before any output surface, so the file metadata, the page label and the API header are all derived from one source and cannot drift apart. Writing it first also forces you to capture the model identifier while you still have it — copy the exact string from the API response body, never type a model name from memory. manifests/img-2027-0001.json : { "asset id": "img-2027-0001", "asset sha256": "