How to label AI-generated content for the EU AI Act
A practical guide to marking AI-generated images, video, and audio the way EU AI Act Article 50 expects - machine-readable C2PA content credentials, a visible disclosure, and a fingerprint that survives re-encoding.
"Label your AI content" sounds like adding a caption. It isn't. The EU AI Act's Article 50 is really asking for two different things at once, and most teams only do the easy one. This is a practical guide to doing both - the visible disclosure a person reads, and the machine-readable marking a platform or regulator can verify - for AI-generated images, video, and audio.
If you want the deadline context first: the transparency obligations become applicable August 2, 2026.
The two kinds of "label" (and why you need both)
Visible disclosure is the "made with AI" a viewer sees - a caption, an on-screen note, an audio disclaimer. It's for humans.
Machine-readable marking is the embedded, verifiable record that a system can check without a person in the loop - it says what generated the asset, when, and by whom, in a standardized format. It's for platforms, auditors, and regulators.
The machine-readable layer matters because a caption can be cropped, translated away, or simply omitted, and it proves nothing about how the asset was actually made. It's the technique Recital 133 of the AI Act names - C2PA Content Credentials - and what Article 50(2) puts on the model providers. Do the visible label for your audience (the deployer duty under Article 50(4)); adopt the machine-readable marking for defensibility and because clients and platforms now ask for it. They are not substitutes.
Step 1 - add C2PA content credentials to each asset
C2PA (the standard behind "Content Credentials") embeds a cryptographically signed manifest into the file: which models were involved, what edits happened, and a signature that makes tampering detectable. This is the core of machine-readable marking.
Two things to get right:
- Sign at creation or delivery, not "later." There's no way to retroactively prove how an asset was made if nothing captured it at the time. The marking has to be produced when the work is.
- Cover the whole pipeline, not just the final render. If a hero image passed through three models and two reference inputs, the credential should reflect that. Partial provenance invites exactly the questions you were trying to answer.
If you generate in tools that don't emit C2PA - most local Stable Diffusion and ComfyUI setups don't by default - you need something in the pipeline to add it. We wrote about that specific gap in ComfyUI has provenance gaps.
Step 2 - keep a fingerprint that survives the platform
Here's the catch that undoes a lot of good-faith marking: most platforms strip embedded metadata on upload. Your carefully signed C2PA manifest can be gone the moment the asset hits a social feed.
The answer is a second layer - a perceptual fingerprint (a content-derived hash) computed from the content itself. It survives re-encoding, resizing, and metadata loss, so even a stripped copy can be matched back to the original signed record in a registry. If you only remember one thing from watermarking vs metadata vs fingerprinting: no single layer is enough on its own.
Step 3 - add the visible disclosure where it's required
Separate from the machine-readable marking, some content and some jurisdictions require a disclosure a person can see - particularly deepfakes and AI likenesses, and particularly in advertising. What's required depends on where the content runs and what it is; the field guide to AI disclosure laws covers which rules apply where. The practical move is to make the visible label a normal part of your delivery spec, not a last-minute scramble.
Step 4 - keep the record
Marking the asset is not the same as being able to prove it later. Keep a signed, human-readable record per delivery - the models and prompts that shaped each asset, the approval chain with timestamps, and content hashes tying each file to the record. When a brand's legal team or a regulator asks "show me," that document is what you produce. It's also what survives when the file's embedded metadata does not.
Common mistakes
- Treating a caption as compliance. It's the human layer, not the machine-readable one.
- Marking only the final asset. The pipeline behind it is part of the provenance.
- Relying on embedded metadata alone. It gets stripped; you need the fingerprint layer too.
- Doing it manually, per campaign. At production volume, manual marking is the step that quietly gets skipped. It has to be automatic.
That last point is the whole reason Archibal exists: it signs the C2PA credential, computes the fingerprint, and issues a verifiable certificate on every delivery, so the marking is produced every time instead of when someone remembers.
Frequently asked questions
How do I label an AI-generated image for the EU AI Act? Embed a C2PA content credential in the file (the machine-readable marking), keep a perceptual fingerprint so a stripped copy can still be matched, and add a visible disclosure where the content or jurisdiction requires one.
Is a "made with AI" caption enough? No. A caption is the human-readable disclosure (the deployer duty under Article 50(4)). Machine-readable marking - embedded, verifiable provenance - is a separate layer, the technique Recital 133 names, and a caption does not provide it. You want both.
What are Content Credentials? Content Credentials are the consumer name for C2PA - a standardized, cryptographically signed record embedded in a file describing how it was created and edited, which a viewer or platform can verify.
What happens if the platform strips the metadata? The visible label and embedded credential may be lost, but a perceptual fingerprint computed from the content survives re-encoding, so the asset can still be matched back to its original signed record.
Can I label content that was already made? You can add a credential to an existing file, but you cannot retroactively prove how it was generated if nothing captured that at creation time. Provenance starts when the marking is applied.
Do I have to label every AI-touched asset or only fully synthetic ones? The safe posture is to mark anything with material AI generation or manipulation. Recording provenance on everything means the marking exists whether or not a given asset later turns out to need it.
The bottom line
Labeling AI content for the EU AI Act is two jobs: a visible disclosure for people, and machine-readable C2PA marking (plus a fingerprint) for verification. Do both, do them at creation or delivery, and automate them - so "we labeled it" is something you can prove, not just something you said.
If you make AI work for clients, see how Archibal automates this for creators and agencies.