Provenance registry
Check if a file is on record
Drop any image, video, audio or PDF. Archibal checks its content fingerprint against the records in the registry - even if the C2PA metadata has been stripped. File bytes are not stored; max 50 MB.
About this lookup
- The registry uses Archibal's own content fingerprinting - a perceptual code derived from the content itself that survives transcoding, re-encoding and format conversion, even after C2PA metadata has been stripped.
- A match shows the production org, the declared AI tools and the production stages. The full record is opened through the delivery link the issuer shares.
- No registry match means the file was not delivered through Archibal. The checker still reads any Content Credentials (C2PA) embedded in the file itself and shows the signer and validation result.
Questions about checking files and the law
What does a match mean?
Archibal holds a provenance record for this file: the production org, the AI tools declared, and the delivery it shipped in. Even if this copy had its C2PA metadata stripped, the content fingerprint still ties it back to the original record.
How does it recognise a file after the metadata is stripped?
Archibal computes a content fingerprint - a perceptual code derived from the pixels or audio themselves, not from file metadata. It survives re-encoding, resizing and format conversion, so a stripped or re-exported copy still resolves to its record. Invisible watermarks such as Google's SynthID work on a similar principle for the outputs of that one provider; the fingerprint here works on any file Archibal has recorded.
Does this prove EU AI Act (Article 50) compliance?
No. Article 50(2) (applying from August 2, 2026) obliges the PROVIDERS of generative AI systems to mark their outputs in a machine-readable way; separate duties fall on deployers who publish certain content. A record here does not satisfy either. What it does is document which tools were declared, what evidence was found, and the C2PA credentials and fingerprint that were attached - the material your compliance team needs when a brand or regulator asks how a piece was made.
What about US and other disclosure laws?
The same record supports disclosure obligations beyond the EU - US state deepfake and AI-labelling laws, platform policies and advertising rules. The field guide to AI disclosure laws covers the wider landscape.
What if there is no match?
No registry match means the file was not delivered through Archibal - not that it is fake. The checker still reads any Content Credentials (C2PA) the file itself carries and shows who signed it and whether the signature holds. Archibal only vouches for what passed through it.