ComfyUI has provenance gaps. Here is the node that closes them.

ComfyUI is one of the most powerful creative tools ever built. Four million users, 150,000 daily downloads, $47 million in funding at a $500 million valuation - what started as a single developer's Stable Diffusion experiment has become what its founders call "the OS of creative AI." Professional studios, freelance artists, and agency production teams use it to run Flux, SDXL, video generation, LoRA stacks, ControlNet, upscalers, and audio - all in a single graph.

And if you use it for commercial output going into the EU market after August 2, 2026, the way it handles provenance right now is a compliance problem you need to solve before then.

This post explains what the gap is, why it exists, and how a single Archibal node at the end of your ComfyUI graph closes it automatically - without changing how you work.

What ComfyUI already does with metadata

ComfyUI does something genuinely useful out of the box: it embeds the full workflow JSON in the metadata of every PNG it saves. Drag any ComfyUI-generated image back into the canvas and it reconstructs the exact graph that made it - checkpoint, sampler, prompts, seeds, LoRAs, everything. That is excellent for creative iteration and for sharing workflows with the community.

It is a completely different thing from the documentation that regulators, enterprise clients, and AI liability law now require.

ComfyUI's embedded workflow JSON is designed for creative reproduction: "how do I regenerate this?" Regulatory compliance requires a different kind of record: "can you prove a human reviewed and approved this, what model made it, what version, on what plan, and when?"

The gap between those two requirements is what 2026 is exposing.

Why ComfyUI's built-in metadata falls short

There are three specific ways the default ComfyUI metadata falls short of what the EU AI Act's Article 50 and broader AI content transparency requirements demand.

It is not machine-readable in any standardised format. ComfyUI's workflow data sits in a proprietary JSON blob inside the PNG's tEXt chunk. It is not in IPTC Photo Metadata 2025.1 format. It is not a C2PA manifest. Platforms, regulators, and downstream systems that know how to read IPTC or C2PA fields cannot parse it. The EU AI Act's transparency obligations - and the Code of Practice the European Commission is finalising right now - point firmly toward multi-layer marking: embedded machine-readable metadata, cryptographic provenance, and a perceptual fingerprint that survives re-encoding. ComfyUI produces none of those three.

It can be stripped accidentally or deliberately. Any image editor, social media upload, file format conversion, or CMS pipeline will silently strip the ComfyUI PNG metadata. Someone on Reddit noted this is a known enough problem that there is a --disable-metadata launch flag for creators who want to ship images without leaking their workflow. What protects a creator's IP in that context is exactly the opposite of what a compliance trail needs. C2PA is specifically designed so that if a manifest is stripped, the absence itself is detectable - the workflow JSON blob just disappears with no trace.

It has no human review layer. ComfyUI captures what the machine did: checkpoint name, sampler steps, CFG scale, seed, prompt text, LoRA weights. It has no mechanism for recording what a human decided: who reviewed this output, when, whether they approved it for a specific market, and whether they hold editorial responsibility for its publication. The EU AI Act's Article 50(4) editorial exemption for AI-generated text specifically requires that a person hold editorial responsibility and that the review process is documentable. ComfyUI cannot help you with that. A spreadsheet probably cannot either, at production scale.

As a Numonic analysis of this exact problem put it: "The problem isn't discipline. It's architecture."

The C2PA landscape as of mid-2026

Some context on where the provenance standard sits right now, because it shapes why a purpose-built integration matters.

The major hosted AI generation platforms have converged on C2PA for output marking. Adobe Firefly has embedded C2PA credentials since launch in 2023 - it is the reference implementation. OpenAI added C2PA to DALL-E 3 in 2023 and to Sora video in 2024/2025. Google Imagen uses both C2PA and SynthID, its invisible pixel-level watermark, as complementary layers. Midjourney has not implemented C2PA as of early 2026 and has not announced a timeline.

Stable Diffusion - the model family that powers most serious ComfyUI workflows - is partial. Stability AI added C2PA to its hosted Stable Image platform. The open-source model weights carry no C2PA data. If you run SDXL, Flux, or any other checkpoint locally through ComfyUI, your output has no C2PA manifest unless something in the pipeline adds it. Nothing in the default ComfyUI installation does.

This is the gap. The tools that generate the most technically sophisticated local and hybrid AI creative work - ComfyUI with open-source checkpoints - produce output with no C2PA credentials by default. Exactly the workflows used by the most serious professional creators are the ones left out of the standards-compliant provenance ecosystem.

What Archibal's ComfyUI node does

The Archibal Callback node closes that gap. It sits at the end of the graph, wired to the final image output. When you hit Queue, ComfyUI runs your workflow exactly as it always has. The Archibal node fires once at the end and sends a structured payload to your Archibal instance - no UI blocking, no workflow changes, no interruption to your generation process.

Here is what gets captured in that payload, automatically, every time:

The final image. The generated output itself, uploaded to Archibal's storage as your master record.

The full workflow JSON. The complete graph, preserved for reproducibility and for proving what pipeline produced this output.

Every model in the pipeline, with attribution. The node identifies which checkpoint, CLIP, VAE, LoRAs, ControlNet models, and any API-connected models participated in this specific output's generation. It tags each one with its node type, model name, and node ID. When an output has more than three models in its pipeline, the risk level is flagged Medium automatically.

The prompts. Positive prompts are assembled deterministically, sorted by node ID so multi-prompt graphs do not produce different orderings across runs. Negative prompts are explicitly excluded from the record - they are generation parameters, not content provenance.

Reference inputs. Up to ten input images (LoadImage nodes, ControlNet inputs, IP-Adapter references) are captured as ingredient assets, each with its own perceptual content fingerprint and its own source-model attribution where provenance can be determined. If a reference was itself a prior Archibal output, the lineage chain connects automatically.

Shot routing. If you set a shot_label, re-running the same workflow with the same label replaces the prior shot in Archibal - so iterating on a single hero image does not create 40 duplicate records. If you supply a project_id, the shot joins the right project. Without either, a new project is auto-created per session.

Provenance tier. Because the data came directly from the model runner, Archibal tags this shot's pipeline stage with source: api_integration - the highest provenance tier in the system, stronger than system_detected or user_declared. That distinction shows up in the compliance PDF.

What Archibal then does with that payload is where the compliance work actually happens: the perceptual content fingerprint is computed on the image bytes, the C2PA manifest is written, the AI-detection scan runs for parity with manually uploaded assets, and the shot becomes immediately eligible for delivery and PDF inclusion with its complete generation pipeline table.

The result: the creator sees a new (or updated) shot in their project with thumbnail, model attribution, prompt, fingerprint, and the full generation record. The project accumulates a compliance trail that can survive a client audit, a platform review, or a regulatory inquiry - built entirely from their existing ComfyUI work.

Setup takes about two minutes

The Archibal node is installed through ComfyUI Manager - search "Archibal," click Install, restart - or by dropping the archibal-callback folder into ComfyUI/custom_nodes/. On the canvas, the node needs two things: the api_key (generated once in the Archibal admin's ComfyUI tab, named something like "ComfyUI on my workstation") and the webhook_url pointing to your Archibal instance's callback endpoint.

That is the entire setup. No workflow restructuring. No export step. No parallel documentation process. The creator still hits Queue. The compliance trail builds itself.

What this means for your August 2 deadline

The EU AI Act's transparency obligations become applicable on August 2, 2026. For ComfyUI workflows producing output for EU distribution, the combination of Article 50's machine-readable marking requirements and the Code of Practice's multi-layer approach means that "the PNG has the workflow JSON in it" is not a defensible compliance position.

There is a structural point worth being direct about: assets created before you install the Archibal node have no retroactive coverage. There is no way to generate the provenance record for a workflow that was not captured at generation time. The compliance trail starts from when the node is in the graph, not from when you decide you want one.

The agencies and studios that are building this infrastructure now will be in a fundamentally different position when August arrives than those that treat it as a post-deadline problem. A two-minute node installation is a much easier lift than explaining, under time pressure, why six months of AI creative output has no machine-readable provenance.

The broader principle

ComfyUI is a generation tool. It is phenomenally good at it. Compliance documentation is a different job, and asking a generation tool to do both without purpose-built infrastructure is the mistake most teams are making right now.

The right architecture is a clear division: ComfyUI runs the creative workflow, and a single callback node at the end of the graph hands the output to a system purpose-built to handle provenance, fingerprinting, C2PA signing, model attribution, human review tracking, and the compliance PDF. No friction in the creative process. No undocumented outputs leaving the pipeline.

That is the integration Archibal and ComfyUI are designed to be.

Running ComfyUI for client work? See how Archibal fits a creator's or agency's pipeline.