Marking AI-generated images so machines can read it
If you publish AI-generated images, Article 50(2) requires them to carry machine-readable marking — metadata a program can check, not a visible watermark. C2PA Content Credentials and IPTC's DigitalSourceType are the two formats in practical use.
What the law requires
Article 50(2) puts the obligation on providers of generative AI systems: outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated. The marking has to be effective, interoperable, robust and reliable as far as technically feasible.
It is a machine-readable requirement, not a visible-watermark requirement. A "Made with AI" caption is good practice and satisfies nothing here. What counts is metadata embedded in the file, or served alongside it, that another system can verify.
Deployers publishing AI images are not the addressee of 50(2) itself, but stripping marking that was present — which most image pipelines do by default when they resize and re-encode — undermines the provider's compliance and is exactly what a scan will surface.
What our scanner looks for
- C2PA Content Credentials, by their container format: JPEG APP11 segments carrying JUMBF boxes with the C2PA label, PNG caBX chunks, and BMFF uuid boxes with the c2pa label.
- C2PA manifests served over HTTP via a Link header with rel="c2pa-manifest".
- IPTC and XMP metadata, in particular DigitalSourceType set to trainedAlgorithmicMedia — the standard value for "made by a generative model".
- Images that look AI-generated but carry no marking at all. This is reported as a warning and never as a failure: absence of marking is not proof of anything, and some marking schemes are not publicly verifiable.
How to fix it
- 1Keep the credentials your generator already produced. DALL·E, Firefly, Midjourney and others emit C2PA; the loss almost always happens later, in a resize or CDN re-encode. Fixing your image pipeline to preserve metadata is usually the entire job.
- 2Where marking was lost, add IPTC DigitalSourceType=trainedAlgorithmicMedia. It is a single metadata field and widely supported by tooling.
- 3For a stronger claim, sign a C2PA manifest with the c2pa toolchain and serve it either embedded or via the Link header.
- 4Audit the specific stages that strip metadata: image CDNs, Next.js/Sharp transforms, and social-preview generators are the usual culprits.
Deadlines and penalties
Enforceable since 2 August 2026 — with one carve-out. Under the Digital Omnibus, generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement. After that date it applies to all in-scope systems.
Free, no account needed. We'll show you every page where this applies, with the evidence.
Common questions
Is a visible watermark enough?
No. Article 50(2) is specifically about machine-readable marking. A visible watermark may help people, but it does not satisfy this obligation and a scan will not detect it as marking.
Does this apply to images a human edited with AI tools?
The text covers content that is artificially generated or manipulated. Substantial AI manipulation is in scope; a routine crop or colour correction is not. The line is genuinely unclear at the margin, which is why our scanner reports these as indicators rather than conclusions.
What about SynthID?
Google's SynthID is a watermarking scheme that is not publicly verifiable, so no external scanner can confirm its presence. We therefore never report an unmarked-looking image as a failure — only as something worth reviewing.
Related
This page describes technical indicators and the obligations they relate to. It is not legal advice. A website scan detects indicators, not legal compliance — which is why our reports say “no issues detected” and never “compliant”.