1. Who should read this?
This guide is for teams that provide generative AI systems or publish AI-generated output. It focuses on output marking and verification. Exact coverage depends on the system, media type, users, market, and role. This overview is not legal advice.
2. What does the EU AI Act require?
Article 50(2) applies to providers of AI systems that generate synthetic audio, image, video, or text. Providers must mark those outputs in a machine-readable format so they can be detected as artificially generated or manipulated. The technical solution must be effective, interoperable, robust, and reliable as far as technically feasible.
Article 50 also has separate disclosure duties for systems that interact with people and for deployers of deep fakes and some public-interest text. Those duties may require visible notices or other product changes beyond the file's Provenance Record.
Status: Article 50 applies from August 2, 2026. The Act does not require C2PA by name. Providers must test whether their implementation meets the law and current guidance.
3. What does California require?
The California AI Transparency Act, SB 942 as amended by AB 853, covers providers whose generative AI system has more than one million monthly visitors or users and is publicly accessible in California. Its covered-provider duties became operative on August 2, 2026.
Offer a public tool and API that can assess covered image, video, and audio content and return detected system provenance data.
Let users add a clear disclosure to covered content created or altered by the provider's system.
Embed a durable, industry-aligned disclosure in covered AI-generated content, with provider, system, time, and identifier information where required.
Require licensees to keep disclosure capability and revoke a license within 96 hours after discovering a prohibited disabling change.
California also limits what the detection tool may collect and retain. Later duties apply to large online platforms from January 1, 2027 and covered capture devices from January 1, 2028. The current covered-provider content duties concern image, video, audio, and combinations of those media, not text.
4. Where does Content Provenance fit?
A C2PA Provenance Record can identify AI-generated content, name the signing organization and tool, record actions and ingredients, include timestamps, and bind the record to the file with a digital signature. An independent checker can then read the record and test the seal.
C2PA does not decide whether the product complies with a law. A provider still needs to address media coverage, marking durability, visible disclosure, detection access, privacy, feedback, license terms, incident response, and evidence that the controls work after common edits and platform processing.
5. What should an AI provider build?
- Map scope. List each system, output type, market, user count, and whether the company acts as provider, deployer, platform, or another role.
- Mark at creation. Add the machine-readable record before the output leaves the generation pipeline.
- Make it inspectable. Give users and third parties a checker and, where required, an API or visible disclosure.
- Protect privacy. Minimize personal data in records and in any detection service. Set short, documented retention rules.
- Test the route to the user. Exercise resizing, transcoding, screenshots, metadata stripping, social platforms, and missing-record cases.
- Keep evidence. Record versions, test results, failures, fixes, disclosure choices, and license enforcement so counsel and auditors can review the system.
6. Where can I learn more?
Encypher maintains detailed implementation guides for both laws. The links below cover scope, dates, technical controls, and the limits of C2PA in more depth.
Implementation rule: Use the law and official guidance as the source of the duty. Use C2PA as an evidence layer. Have counsel test the finished product against the rules that apply to it.