Question 1

What does Article 50 of the EU AI Act require?

Accepted Answer

Article 50 sets transparency duties: providers of generative AI systems must mark outputs in a machine-readable format, detectable as artificially generated or manipulated (50(2)), and deployers must disclose deep fakes and AI-generated text published to inform the public on matters of public interest (50(4)). It also requires that people are told when they interact with an AI system (50(1)) and when emotion recognition or biometric categorisation is used on them (50(3)). The information must be clear and distinguishable, at the latest at the first interaction or exposure (50(5)). See Article 50, paragraph by paragraph.

Question 2

How do I comply with the AI Act marking requirement?

Accepted Answer

If you provide a generative AI system, mark every audio, image, video or text output in a machine-readable way that lets it be detected as AI-generated, with a solution that is effective, interoperable, robust and reliable as far as technically feasible (Article 50(2)). Recital 133 names watermarks, metadata identifications, cryptographic methods for proving provenance, logging methods and fingerprints, alone or combined. For images, audio and video, the Commission’s Code of Practice has signatories use at least two layers, digitally signed metadata and an imperceptible watermark, and offer a detection solution free of charge. Signing the code is voluntary; providers who comply by other means must show that their measures are adequate.

Question 3

When do the AI Act labelling rules apply?

Accepted Answer

Article 50 applies from 2 August 2026, the AI Act’s general date of application (Article 113). Providers of generative AI systems placed on the market before that date have until 2 December 2026 to meet the marking duty in Article 50(2), under Article 111(4) as added by Regulation (EU) 2026/1744. See the countdown to 2 December 2026.

Question 4

Do I have to label AI-generated images in marketing?

Accepted Answer

Under the AI Act, a visible disclosure is required when the image is a deep fake: AI-generated or manipulated content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Articles 3(60) and 50(4)). For an evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing that such content exists in a way that does not hamper the work. Separately, the provider of the AI system that generated the image must mark it in a machine-readable way under Article 50(2), whether or not you show a label. Article 50(6) adds that other transparency duties in EU or national law still apply; this is not legal advice.

Question 5

What is the EU Code of Practice on marking and labelling AI-generated content?

Accepted Answer

It is the Code of Practice on Transparency of AI-generated Content, a voluntary code drawn up by working groups of independent experts, in a process facilitated by the European Commission, to help providers and deployers meet Article 50(2) and 50(4); the final code was published on 10 June 2026. Section 1 covers marking and detection by providers of generative AI systems, and Section 2 covers labelling of deep fakes and AI-generated published text by deployers, with an EU icon anyone may use. The Commission says signatories can rely on its measures to demonstrate compliance, while those who comply by other means will have to show their measures are adequate.

Question 6

Is C2PA enough for Article 50?

Accepted Answer

Not on its own, according to the Commission’s Code of Practice: as long as no single technique can meet the requirements of Article 50(2) by itself, signatories mark images, audio and video with at least two layers, digitally signed metadata and an imperceptible watermark. A C2PA manifest is digitally signed metadata that can declare AI generation, so it fits the first layer, but metadata can be removed when a file is re-encoded or uploaded; the code does not name C2PA. The AI Act itself names no standard and asks for marking that is effective, interoperable, robust and reliable as far as technically feasible.

Question 7

What are the fines?

Accepted Answer

Breaching the Article 50 transparency obligations can be fined up to EUR 15 million or, for a company, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g)). For SMEs, including start-ups, the lower of the two applies (Article 99(6)), and Regulation (EU) 2026/1744 extended that to small mid-cap enterprises (Article 99(6a)). Member States lay down the penalty rules and enforce them (Article 99(1)).

Question 8

Does the AI Act apply to companies outside the EU?

Accepted Answer

Yes, in many cases: it applies to providers placing AI systems on the EU market whether or not they are established in the EU, and to providers and deployers in a third country where the output produced by the AI system is used in the EU (Article 2(1)(a) and (c)). So a provider outside the EU whose generative system is offered in the EU, or whose outputs are used there, can be covered by Article 50.

Question 9

How do I add C2PA Content Credentials to AI images?

Accepted Answer

Sign the image with a C2PA manifest, using software that implements the C2PA specification and a signing certificate. With Proofcan you drop a JPEG, PNG or WebP on the home page (free account) or call POST /v1/mark: the file is signed with a manifest that declares it AI-generated (the IPTC digital source type trainedAlgorithmicMedia), and it also gets an invisible watermark and a registry record. Proofcan currently signs with a test certificate while its C2PA conformance application is in progress, so validators report the signature as valid but not trusted.

Question 10

How do I add an invisible watermark?

Accepted Answer

Embed it with a watermarking model when you generate or publish the image; one open-source option is Adobe’s TrustMark, released under the MIT licence for both code and model weights, which hides a 100-bit payload in the pixels. Proofcan embeds a TrustMark watermark that carries the image’s 8-character record ID and declares it in the C2PA manifest as a soft binding (com.adobe.trustmark.Q, an entry on the C2PA soft binding algorithm list). TrustMark is trained to withstand common perturbations of the image, but no watermark is guaranteed to survive every edit.

Question 11

How can I check if an image is AI-generated?

Accepted Answer

Look for provenance signals in the file rather than judging the pixels: read its C2PA Content Credentials, for example with the Content Credentials checker, and check for a vendor’s watermark with that vendor’s own tool. Under the Commission’s Code of Practice, signatory providers offer their detection solution free of charge. Proofcan’s Verify finds Proofcan’s own watermark and record; if an image carries no credentials and no readable watermark, these tools cannot tell how it was made, and Proofcan offers no pixel-based AI detection.

Question 12

How do I verify Content Credentials?

Accepted Answer

Open the file in a C2PA validator: Proofcan’s Content Credentials checker reads it in your browser without uploading it, and the Content Authenticity Initiative’s Verify tool lets you inspect the credentials online. A validator checks that the signature and hashes still match the file and shows who signed it; it does not prove that the statements inside are true. A signature from a certificate that is not on the C2PA trust list is reported as untrusted, even when the file is intact.

Question 13

Do Instagram, LinkedIn or TikTok remove C2PA?

Accepted Answer

None of the three says so in the pages we read; what they document is reading it. Meta says it reads the “AI generated” information in the C2PA and IPTC standards and adds “AI info” labels on Facebook, Instagram and Threads, LinkedIn shows Content Credentials on images and videos that carry C2PA data, and TikTok said in May 2024 that it reads Content Credentials to auto-label AI content and attaches its own to TikTok content. Whether the credentials survive in the copy a platform serves is not stated there, so check a downloaded copy; details are on the platform pages.

Question 14

Do Midjourney, ChatGPT or Gemini add C2PA?

Accepted Answer

ChatGPT does and Gemini does for the models Google lists, according to their makers; Midjourney does not document it. OpenAI says supported images generated with ChatGPT, Codex and the OpenAI API include C2PA Content Credentials and a SynthID watermark, and Google says images from Nano Banana Pro (Gemini 3 Pro Image) in the Gemini app carry C2PA metadata and that Gemini API images include a SynthID watermark. Midjourney’s Content Authenticity page describes its own hidden ID tag, checked at midjourney.com/verify, and does not mention C2PA; see the AI tool pages.

Question 15

What is TrustMark?

Accepted Answer

TrustMark is an open-source invisible watermarking method for images from Adobe, released under the MIT licence for both its code and its model weights. It hides a 100-bit payload in images of any resolution, and its variants are entries on the C2PA soft binding algorithm list (for example com.adobe.trustmark.Q). Proofcan uses it to carry each image’s record ID.

Question 16

C2PA metadata vs invisible watermark

Accepted Answer

C2PA metadata is a signed record inside the file that can say a lot (who signed it, which tool made it, an AI declaration) and exposes any later change to the file, but it is lost when the file is re-saved without it. An invisible watermark is part of the pixels and carries only a short identifier, but it can still be read after many edits that remove metadata. The C2PA specification links the two: a watermark declared as a soft binding lets a removed manifest be found again in a repository, which is why Proofcan writes both and keeps a registry record.

Question 17

What happens after a screenshot or compression?

Accepted Answer

A screenshot creates a new file without the original C2PA manifest, and re-compression with a tool that does not carry the manifest across drops it or leaves a manifest that no longer matches the file. An invisible watermark is part of the pixels, so it may still be readable; if Proofcan’s watermark is, Verify finds the record and says the C2PA data is missing. No watermark survives every edit, so a file without a readable mark proves nothing either way; see why metadata gets stripped.

Question 18

What is soft binding?

Accepted Answer

In the C2PA specification, a soft binding is a content identifier that is either not statistically unique, such as a fingerprint, or embedded as an invisible watermark in the content (section 2.3.13). If a manifest is removed from a file but a copy remains in a provenance store elsewhere, the file and the manifest can be matched again through the soft binding (section 9.3.1). It complements the hard binding, cryptographic hashes that tie the manifest to the exact bytes of the file (section 2.3.12).

Question 19

Can I mark video and audio?

Accepted Answer

Not on the website, which marks JPEG, PNG and WebP images only. Video (MP4, MOV) and audio (WAV, MP3, M4A, FLAC) can be marked through the API in a closed beta, open only to accounts admitted to it: a background job embeds a Video Seal or AudioSeal watermark carrying the record ID and signs a C2PA manifest. The beta is described in the API’s OpenAPI document and has no public price yet.

Question 20

How do I mark images in bulk with an API?

Accepted Answer

Create an API key in your dashboard and send each image to POST /v1/mark with an Authorization: Bearer header; the response is the signed file, with its record ID in the Proofcan-Lookup-Id header. API marks use the same monthly quota as the web app, and each key can send 30 mark requests a minute with at most 2 running at once. On the website you can also drop up to 25 images at once and download them as a ZIP; see the API docs.

Question 21

What does Proofcan do, and what does it not do?

Accepted Answer

Proofcan marks AI-generated images: it signs them with a C2PA manifest that declares AI generation, embeds an invisible TrustMark watermark carrying a record ID, and files a registry record that anyone can check for free. It does not detect AI-generated images that carry no mark, does not put a visible label on the image, and does not make you compliant with the AI Act or any other law; it is a technical tool, not legal advice. Its C2PA conformance application is in progress and it signs with a test certificate, and video and audio are a closed API beta, not part of the website.

Question 22

Where is my data processed?

Accepted Answer

In the EU: the website and its functions run in Frankfurt (Vercel, fra1), images are signed on Proofcan’s engine in Nuremberg, Germany (Hetzner), and the database is in Ireland (Turso, AWS eu-west-1). Signed files are kept for 24 hours so you can download them, while the registry record stays. The trust center and the privacy policy list every subprocessor and its role.

Question 23

What does the free plan include?

Accepted Answer

5 marks a month, with the same signature, watermark and registry record as the paid plans, and access to the API on the same quota. Verifying images is free for everyone, without an account. No card is required.

Question 24

How much does Proofcan cost?

Accepted Answer

Free is €0 for 5 marks a month; Starter is €29 a month for 100 marks, Pro is €99 a month for 400 marks, Agency is €199 a month for 1,000 marks. API marks use the same monthly quota, and Paddle, the merchant of record, collects VAT. For more than 1,000 marks a month, write to support@proofcan.com; see pricing.

Question 25

Who is behind Proofcan?

Accepted Answer

Proofcan is built by its founder, Volkan Çatak, and operated by Galzura Software Company, the brand of Volkan Çatak (Sole Proprietorship) in Ankara, Türkiye. The Legal Notice has the full details, and support is at support@proofcan.com.

Questions and answers.

The EU AI Act