AI-Content Marking Rules Are Already in Force — but No Law Names C2PA

Laws that require “machine-readable marks” on AI-made images, audio and video are already in force. But none of them names C2PA.

If you run an AI service that generates images, audio or video, there are dates you need to keep. The EU AI Act’s transparency duties have applied since August 2, and for systems that were already on the market before then, the marking duty applies from December 2. California’s AI Transparency Act also started on August 2.

Here, a “mark” is information embedded in a file so that a program can read it and tell the content was made by AI. It is separate from a visible label.

Rules already in force

Region and law	What it requires	Starts	Penalty
EU AI Act, Article 50	Providers of generative AI must put machine-readable marks on outputs, and deepfakes must be clearly disclosed to users	August 2, 2026. For systems already on the market, the marking duty applies from December 2	Up to €15 million (about $17 million) or 3% of worldwide turnover
California AI Transparency Act	Providers of generative AI with over 1 million monthly users must embed hidden marks (provider, system, time, unique ID) in images, video and audio, and offer a free detection tool	August 2, 2026. Large platforms from January 1, 2027, capture devices in 2028	$5,000 per violation
Korea AI Basic Act	Sound, images and video that are hard to tell from human-made content must be disclosed as AI output	January 22, 2026	Up to 30 million won (about $22,000) for failing to notify users of AI use and similar violations. Fines are expected to be deferred for at least a year

A deepfake is video or audio of a person or event made with AI to look real.
The California law does not apply to AI-generated text.
Korea’s law is in force, but the Ministry of Science and ICT has indicated that fines will be deferred for at least a year.

Where C2PA fits

C2PA is an industry standard for signing who made a piece of content, when and how, and attaching that to the file. Content Credentials 2.3 came out on February 9, and TikTok joined the steering committee on July 28.

But the laws do not choose the technology. The European Commission’s official FAQ asks only for “effective, reliable, robust and interoperable machine-readable marks” and mentions neither watermarks, metadata nor C2PA. The Code of Practice that serves as guidance (published June 10, voluntary, about 190 organizations signed by the end of July) does not list specific techniques on its official page either. Some commentary says it asks for signed metadata and invisible watermarks used together, but we could not confirm that on the official page.

Claims we could not confirm

“Mandatory adoption everywhere”: rules and start dates differ by region. Korea’s fines are on hold, and California’s platform duties start in 2027.
“Settled in as the standard across major platforms”: C2PA adoption is growing, but many explainers say it is inconsistent, for example metadata being stripped on upload. We found no basis to call it a platform-wide standard.
“Marks enforced from the model training stage”: every law we checked requires marks on outputs. We found no requirement about training.
“Stronger limits on distributing AI-made content”: we found no basis to generalize this. California’s large-platform duty (to detect marks) starts in 2027.

What could change for developers

What follows is our estimate and advice based on the reports and official material. It is not legal advice, so check separately whether your service is covered.

Work out first whether you are covered. If you have a feature that generates images, audio or video, and you have EU users or more than 1 million monthly users in California, you may be. A service that only generates text is outside the California law.
Use December 2 as the checkpoint. A generation feature already running in the EU must carry marks by that date.
Check that marks survive your pipeline. Tools that resize or re-encode images often wipe the information inside the file. Do not rely on one method; using file information together with an invisible watermark is safer.
The choice of standard is open. Since no law names C2PA, other methods are possible, but the marks must be interoperable. If you are adopting something new, C2PA support is worth considering first.

What to watch

The schedule for detection and interoperability tools from signatories of the EU Code of Practice, California’s January 2027 large-platform duties and proposed amendments, when Korea’s fine deferral ends and whether the law is amended, and how reports of ways to get around C2PA signatures are handled.

Dollar figures for euro and won amounts use October 14 exchange rates (1 euro ≈ $1.12, 1,000 won ≈ $0.75) and are approximate.