2026-11-13 - Marking, Provenance, Authenticity: Three Different Things
You see a video with a small “AI” in one corner. Then another one, with no sign at all. Which of the two can you trust?
The sign alone will not tell you. A mark indicates how a piece of content was created, not that it is true. Its presence does not prove that the content is false. Its absence does not prove that it is genuine.
I have already written about the
, the
and
who must disclose the use of AI
. Those posts speak to producers and publishers. Here the perspective is that of the person looking.
Why now
has applied since 2 August 2026, and a deadline for some providers falls on 2 December. In my view the risk is learning the wrong rule: labelled means artificial, unlabelled means true. It is the
I have already written about.
Three words, three questions
WordWhat it answersWhat it does not answer
MarkingWas the content generated or manipulated with AI?Is it true? Who produced it?
ProvenanceWhich tool or source does it come from?Did what it shows actually happen?
AuthenticityAre the content and its data intact?Is the story around it correct?
refers to cryptographic methods for proving provenance and authenticity: technical words that do not mean truth. An intact photograph can illustrate a false story.
Marking is written for machines and falls to the provider of the system. A label is written for people and falls, in certain cases, to whoever uses the system.
How it works
ToolWhat it isWhere it gives way
Visible labelA notice for people. The
offers three EU icons: basic, fully AI-generated, partially AI-modifiedIt is a statement. The icons are free to use and their presence does not prove compliance
WatermarkAn imperceptible signal embedded in the contentIt can degrade. For its own text, Anthropic admits that a substantial rewrite neutralises it
Signed metadataData tied to the file, digitally signed and time-stamped. C2PA is an open standard used for this purposeLost through format conversion, re-saving and screenshots
DetectorA program that looks for the signal and says whether it found itIf the signal is missing, it proves nothing about origin
The signature serves to show whether those data have been altered. It does not say whether they were true when written.
The Code starts from one finding: no technique is enough on its own. For content meant for online circulation it provides for at least two layers, signed metadata and a watermark. Free-form text has only one, because it cannot carry metadata. Very short text, under 200 tokens, gets no watermark.
The limits of a mark
Removal
As I reported in my newsletters,
that images from its Google Earth feature carried the SynthID watermark, but BBC Verify tests showed that the signal could be circumvented.
that C2PA metadata are lost with a screenshot and that open-source tools exist to remove them.
According to the
(point 16), platforms that merely disseminate third-party content are not deployers, meaning users subject to the labelling duty. They are only strongly encouraged to preserve marks and labels.
Errors
Article 50(2) requires solutions that are effective and reliable as far as technically feasible. Anthropic itself states that a mark is not conclusive proof of authorship and that its absence does not rule out AI.
Conflicting signals
You may find one signal and not the other. After a screenshot the metadata disappear, while the watermark may remain. Between 2 August and 2 December, content may carry a visible label without technical marking, because the
. Marking
can also catch content that the law did not require to be marked.
When signals do not match, none of them wins automatically. It is a reason to look for the source.
Why a label may be missing
Without any rule being broken:
- the content was generated and made available before 2 August 2026, since no retroactive marking is due;
- a private individual created it for personal, non-professional activity and is therefore not a deployer;
- it is text reviewed by a person, with someone holding editorial responsibility;
- the intervention is standard editing, such as correcting grammar or reducing noise;
- the content is not a deep fake, because it does not falsely appear authentic.
And then, of course, there are those who ignore the rules.
Can a mark also reveal the author?
Article 50(2) requires signalling that the content is artificial. It does not require stating who produced it, on which device or where. According to the
(point 94), marking and detection must respect data protection by design and minimisation, and must not process information about the creator of the content.
As a rule, then, it should not. The risks still have to be checked system by system:
- Author and device. Content Credentials can show
the author, social accounts, the app or device and capture data
. A name is
, but the signed manifest still shows when the content was created. Anyone with good reasons not to sign, such as a source or a whistleblower, should check these data before publishing. The
(Article 4) also mentions online identifiers.
- Location. A marked file is not a cleaned file. If you start from one of your own photos, remember that
that recipients may be able to access its location metadata. I will return to file metadata in a future post.
- Linkability. The Code allows fingerprinting and logging as supplementary measures. In my view this is the most delicate point: a log joining content and accounts would link your creations to one another even with no metadata in the file.
- Checking. To check content online you often have to upload it. The Code commits signatories to treating it as sensitive, with minimisation and immediate deletion. Those who have not signed are not bound by that commitment.
What the law says
The rules in force
Article 50 works on two levels. Providers of generative systems mark outputs in a machine-readable format (paragraph 2). Deployers disclose deep fakes and generated text published to inform the public on matters of public interest (paragraph 4). The information must be clear and distinguishable at the latest at first exposure (paragraph 5).
The Code of Practice of 10 June 2026 is voluntary. The Commission assessed it as adequate on 8 July, the AI Board on 9 July. Adherence is not conclusive proof of compliance.
The Guidelines C(2026) 5054 are not binding. Their content was approved on 20 July 2026. Formal adoption follows the availability of all language versions, and only then do they apply. As I write, the
do not record it.
Labelling does not make something lawful:
say so. In Italy,
Article 612-quater of the Criminal Code
punishes anyone who causes unjust harm by spreading, without consent, images, videos or voices falsified with AI and capable of deceiving.
What changes on 2 December 2026
DateWhat appliesWhat it means for you
2 August 2026Article 50 applies. Deployers' labels have no extension and new systems mark from the startA deep fake published by a deployer must already be disclosed
2 December 2026
: providers of systems placed on the market before 2 August must comply with paragraph 2You see no difference: the mark is for machines. More new content should become readable by a tool
2 February 2027Code commitment, for signatories only: interoperability of detectorsIt is not a statutory deadline
2 December does not change the past: older content need not be marked after the fact. The new
also apply from that date, on systems generating non-consensual intimate imagery of identifiable people or child sexual abuse material. That is a different rule: it does not concern marking.
What may change
What follows is not law in force. The Guidelines announce joint Commission and EDPB guidelines on the interplay between the AI Act and data protection. They are in preparation, so the point about the creator may be refined. The Code will be reviewed at least every two years.
What you can do
1. Read the label, if there is one
Look for the notice at the start of a video or audio clip, near the headline of a text. Tell fully generated from partially modified: a real photo that has been retouched is not an invented scene.
2. Trace the original file
Screenshots and re-saves wipe metadata. Look for who published first and for the file closest to the origin, then check whether independent sources confirm the fact.
3. Check signed credentials
For signed metadata there is
, the Content Credentials tool described in the
. You select or drag a file from your device. The interface is available in several languages. If credentials exist, you see who issued them and when, the app or device used, the recorded actions and any AI-generated elements. If the issuer is not recognised, the page shows “Unrecognized”: the file may not come from where it claims to.
4. Use watermark readers with care
The Code commits signatories to offering a detection solution, free of charge as a rule. Google has said that SynthID can be checked with the Gemini app or Google Lens. Each tool, however, answers only for the signal it can read. Do not upload private photos without checking who receives them.
Read a negative result as follows:
CheckResultWhat it means
LabelNo labelIt may not be required, or it may have been left out. This does not mean the content is genuine
Signed credentialsNo credentials shownThe file has none, or has lost them. This says nothing about its origin or truthfulness
Watermark readerSignal not foundThis applies only to that signal. It does not rule out the use of AI
5. If you generate the content yourself
Check what the file contains before sharing it. On iPhone,
: Share → Options → turn off Location. “Location Not Included” should appear above Options. Do not strip the mark out of habit: removing location metadata is one thing, deleting the signal of artificial origin is another.
6. If the content concerns you
- Platform. Use the notice mechanism under
Article 16 of the Digital Services Act
if you believe the content is illegal.
- Data protection authority. The Guidelines recall that the deployer of a deep fake of identifiable people remains a controller. You can lodge a complaint under Article 77 GDPR. In Italy that is the
; elsewhere in the EU, your own authority.
- Market surveillance authority.
allows anyone to report an infringement. In Italy the designated authority is, in general, the National Cybersecurity Agency, ACN (Law 132/2025, Article 20). For systems built on a model from the same provider, the AI Office is competent.
- Criminal complaint. In Italy, if the elements of Article 612-quater are met, prosecution as a rule depends on a complaint by the victim. Note the address and the date you saw the content.
How much does it really help?
The absence of a mark does not mean that the content is false. Its presence does not mean that it is true.
CountermeasureWhat it reducesWhat remains
Reading the labelUncertainty about disclosed contentThose who do not disclose, or disclose falsely
Checking watermark and metadataDoubt about origin, if the signal is thereSignals removed, missing or unreadable by that tool
Tracing the sourceThe risk of false contextThe time it takes. A source can be wrong
Removing location before sharingWhat the file reveals about where you wereService logs and clues in the image
Notice and complaintSpread or the infringement, against a reachable partyCopies already circulating and those who stay anonymous
A mark tells you something about the path a piece of content has taken. Whether it tells the truth remains a question for the sources.
Sources
, Content Authenticity Initiative
, as amended by
. Consolidated text on ai-resources.eu:
,
,
,
and
ai-resources.eu,
fact sheet on the Code of Practice
and
fact sheet on the Guidelines C(2026) 5054
;
,
, Articles
and 77
Italian Law No. 132 of 23 September 2025
, Articles 20 and 26 (Article 612-quater of the Criminal Code)
Italian Data Protection Authority,
(in Italian)
Apple,
Manage location metadata in Photos
NicFab Newsletter,
and
Content Authenticity Initiative,
and
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.