AI-Content Marking Rules Are Already in Force — but No Law Names C2PA

Laws that require “machine-readable marks” on AI-made images, audio and video are already in force. But none of them names C2PA.

If you run an AI service that generates images, audio or video, there are deadlines you need to meet. The transparency duties of the EU AI Act (the European Union’s main AI law, adopted in 2024) have applied since Aug. 2, and for systems that were already on the market before then, the marking duty applies from Dec. 2. California’s AI Transparency Act also took effect on Aug. 2.

Here, a “mark” is information embedded in a file so that a program can read it and tell the content was made by AI. It is separate from a visible label.

Rules already in force

Region and law	What it requires	Starts	Penalty
EU AI Act, Article 50	Providers of generative AI must put machine-readable marks on outputs, and deepfakes (video or audio of a person or event made with AI to look real) must be clearly disclosed to users	Aug. 2, 2026. For systems already on the market, the marking duty applies from Dec. 2	Up to €15 million (about $17 million) or 3% of global annual revenue
California AI Transparency Act	Providers of generative AI with over 1 million monthly users must embed hidden marks (provider, system, time, unique ID) in images, video and audio, and offer a free detection tool	Aug. 2, 2026. Large platforms from Jan. 1, 2027, cameras and other recording devices in 2028	$5,000 per violation
South Korea’s AI Basic Act	Sound, images and video that are hard to tell from human-made content must be disclosed as AI output	Jan. 22, 2026	Up to 30 million won (about $22,000) for failing to notify users of AI use and similar violations. Fines are expected to be deferred for at least a year

The California law does not apply to AI-generated text.
South Korea’s law is in force, but its Ministry of Science and ICT (information and communications technology) has indicated that fines will be deferred for at least a year.

Where C2PA fits

C2PA is an industry standard that records who made a piece of content, when and how, signs that record digitally and attaches it to the file. Content Credentials 2.3 came out on Feb. 9, and TikTok joined the steering committee on July 28.

But the laws do not choose the technology. The European Commission’s official FAQ asks only for “effective, reliable, robust and interoperable machine-readable marks” and doesn’t mention watermarks, metadata or C2PA. The Code of Practice that serves as guidance (published June 10, voluntary, about 190 organizations signed by the end of July) does not list specific techniques on its official page either. Some commentary says it asks for signed metadata and invisible watermarks used together, but we could not confirm that on the official page.

Claims we could not confirm

“Mandatory adoption everywhere”: rules and start dates differ by region. Korea’s fines are on hold, and California’s platform duties start in 2027.
“Settled in as the standard across major platforms”: C2PA adoption is growing, but many explainers say it is inconsistent, for example metadata being stripped on upload. We found no basis to call it a platform-wide standard.
“Marks enforced from the model training stage”: every law we checked requires marks on outputs. We found no requirement about training.
“Stronger limits on distributing AI-made content”: we found no basis to generalize this. California’s large-platform duty (to detect marks) starts in 2027.

What could change for developers

What follows is our estimate and advice based on the reports and official material. It is not legal advice, so check separately whether your service is covered.

Work out first whether you are covered. If you have a feature that generates images, audio or video, and you have EU users or more than 1 million monthly users in California, you may be. A service that only generates text is outside the California law.
Use Dec. 2 as the checkpoint. A generation feature already running in the EU must carry marks by that date.
Check that marks survive your pipeline. Tools that resize or re-encode images often wipe the information inside the file. Do not rely on one method; using file information together with an invisible watermark is safer.
The choice of standard is open. Since no law names C2PA, other methods are possible, but the marks must be interoperable. If you are adopting something new, C2PA support is worth considering first.

What to watch

The schedule for detection and interoperability tools from signatories of the EU Code of Practice, California’s January 2027 large-platform duties and proposed amendments, when Korea’s fine deferral ends and whether the law is amended, and how reports of ways to get around C2PA signatures are handled.

Dollar figures for euro and won amounts use Oct. 14 exchange rates (1 euro ≈ $1.12, 1,000 won ≈ $0.75) and are approximate.