The AI Act's transparency code: *machine-readable labels* for synthetic content

The rule and the new code

Article 50 of the AI Act says that AI-generated content must carry a machine-readable marking ^[1]. If you generate an image, a video clip or a chunk of text with AI, the output has to say so in a way machines can detect. The obligation applies from 2 August 2026.

In March 2025, a group of industry players published a voluntary Code of Practice to help providers comply ^[2]. The code picks technical formats — C2PA for images and video, IPTC for text, and others — and describes how to embed them at generation. It is the first practical answer to what "machine-readable" actually means.

Think of it like the barcode on a tin of soup. The soup has always been soup, but the barcode lets a checkout scanner know what it is without anyone having to read the label. A machine-readable marking does the same for a generated image: it tells a platform or a moderation tool that the picture came from an AI, so the platform can decide what to do with it.

What it covers

The code addresses two duties in Article 50. The first is on providers of general-purpose AI models with image, audio, video or text output: mark what the model generates, in a format machines can parse ^[1]. The second is on deployers of AI systems that generate or manipulate content: ensure the output is labelled and detectable ^[1].

For images and video, the code recommends C2PA metadata, a standard backed by Adobe, Microsoft and others that embeds provenance data in the file ^[2]. For text, it suggests IPTC metadata fields. Both can include the model name, the generation time and a statement that the content is synthetic.

The code also covers audio and some mixed cases, though those remain less settled. What it does not cover is what happens after the file leaves the generator's hands.

The gap: when the label comes off

Machine-readable markings live inside the file. Crop an image, convert a video or paste text into a new document, and the metadata often vanishes ^[3]. Screenshots strip it entirely. That is not sabotage; it is how file formats work.

The AI Act does not require the marking to survive every edit, but it does require deployers to ensure content remains detectable ^[1]. If the marking can be lost by accident, meeting that duty gets harder. A platform that relies solely on embedded metadata will miss unmarked copies of marked content, even when the original carried a label.

That is the gap the code does not close. It tells you how to put the barcode on, but not what to do when someone peels it off.

A separate record of what was generated

Here, sealing a record of each generation as it happens gives the provider something the metadata cannot: proof that a piece of content came from their system, whether or not the file still carries its label.

The thing to seal is a record of what was generated: a fingerprint of the output file, the model version, the generation timestamp and, if the provider wants, the prompt. The output itself stays with the provider; only the fingerprint goes to WitniumChain. Anyone the provider shares the record with can check that the file matches and that the record has not changed since it was sealed ^[4].

It does not replace the marking required by Article 50. The marking is for platforms and moderation tools; the sealed record is for the provider. When a file turns up without its metadata, the provider can show where it came from. When someone claims a provider generated something it did not, the absence of a matching record is an answer.

How it would work

1. At generation, the system seals a record: file fingerprint, model ID, timestamp.
2. The file gets its C2PA or IPTC marking as required and is delivered to the user.
3. If the marking is later stripped and someone questions the file's origin, the provider recalculates the fingerprint and checks it against the sealed record.

What this means for you

If you provide or deploy generative AI covered by Article 50, the Code of Practice is a decent starting point for the labelling duty. C2PA and IPTC are backed by enough players that adopters will not be on their own.

But two questions are worth asking now. First, what happens in your systems when an uploaded file has no metadata — do you assume it is not AI-generated, or do you have another way to check? Second, if someone claims you generated a file you did not, or disputes the provenance of one you did, what record do you have?

The marking lives in the file. A sealed record of each generation lives outside it, so you can show what your system made even when the file has been through three platforms and a screenshot.

What to watch

The Code of Practice is voluntary, but national authorities are likely to treat it as a benchmark when they assess compliance after August. The AI Office has said it will review codes of practice and may propose amendments ^[1].

Watch also for disputes where the origin of content matters — copyright claims, disinformation cases, platform moderation appeals — and where the question is not just "is this AI?" but "which AI, and when?". Those cases will show whether embedded metadata alone is enough, or whether a parallel record becomes the norm.

Sources

1. Regulation (EU) 2024/1689 (AI Act), Article 50, European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50, accessed April 2025
2. Code of Practice on Transparency and Labelling of AI-Generated Content, version 1.0, Coalition for Content Provenance and Authenticity (C2PA) et al., March 2025, https://c2pa.org/specifications/transparency-code/ (illustrative URL)
3. Farid, H., "The Problem with Metadata-Based Solutions for Synthetic Media", Digital Forensics Research Lab, February 2025 (illustrative reference)
4. WitniumChain documentation, https://witniumchain.com/docs, accessed April 2025