Automate Digital Content Provenance & Compliance.

Article 50 of the EU AI Act (Regulation 2024/1689) creates distinct duties: providers of generative AI systems must ensure AI-generated or manipulated content is marked in a machine-readable format, while deployers have disclosure obligations for deepfakes and certain AI-generated text on matters of public interest. It does not require every digital asset to carry a signature. C2PA Content Credentials are a practical mechanism for the machine-readable marking, per the European Commission's July 2026 guidelines. The obligations apply since August 2, 2026.

Non-compliance with the AI Act's transparency obligations can draw administrative fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Deployers — including marketing agencies publishing on behalf of clients — carry their own obligations, separate from the model provider's.

C2PA is the open technical standard from the Coalition for Content Provenance and Authenticity, backed by Adobe, Microsoft, Google, and the BBC among others. A C2PA manifest is a cryptographically signed block of metadata embedded in a file that records how the content was created — including whether AI was involved — using the IPTC digitalSourceType vocabulary. Anyone can verify a signed asset independently at verify.contentauthenticity.org.

Upload a batch to Authentrail (up to 25 files per scan via the dashboard, or stream via the API). Assets flagged as AI-generated without valid provenance can be remediated in one click: Authentrail injects a signed, RFC 3161-timestamped C2PA manifest declaring the content AI-generated, and returns the signed files ready to publish.

Yes. Like the GDPR, the AI Act applies based on where the output is used, not where the publisher sits. An agency in Dubai or New York that publishes AI-generated campaign content reaching EU audiences falls under Article 50. Authentrail evaluates every asset against EU, UAE, and US rules simultaneously so multinational teams see all exposure at once.

Authentrail detects C2PA manifests, XMP digitalSourceType declarations, and generator fingerprints left by tools like DALL-E, Midjourney, Adobe Firefly, Stable Diffusion, and ComfyUI. No scanner can prove a fully stripped image is human-made — which is exactly why the workflow includes named human-origin attestations: a signed declaration by your team member, recorded in the audit trail, for assets whose provenance is technically unknowable.

Raw text cannot carry cryptographic metadata — copy-paste strips everything. Article 50(4) instead requires a disclosure for published AI-generated text on matters of public interest. Authentrail's text disclosure log records the disclosure with a SHA-256 content hash, the responsible person's name, and a timestamp, and includes it in your audit report.

California's SB 942 (AI Transparency Act) requires provenance disclosures for generative AI content, and Utah has enacted digital content provenance standards; other states have bills in progress. Authentrail tracks the state patchwork and evaluates assets against California SB 942 as the strictest current baseline.

That notice means the signing certificate isn't on the C2PA known certificate list — it says nothing about whether the signature is valid or the file tampered with. Verifiers show it for any issuer outside the trust list, including our demo certificate. The fix is signing with a CA-issued certificate from a C2PA-participating authority (such as DigiCert) — which is what Authentrail's bring-your-own-certificate setup is for, and why the recognized issuer shown to the world is your organization, not us.

Yes — bring your own certificate (BYOC) is the recommended setup. Your organization uploads its own CA-issued ES256 X.509 certificate, so manifests are signed in your name and your organization is the attesting party. Keys are encrypted at rest, and hardware-backed signing via your own KMS or HSM is on the roadmap.

The C2PA reference implementation does not yet support embedding manifests in PDF. Authentrail instead writes the machine-readable disclosure into the PDF's XMP metadata using the same IPTC digitalSourceType vocabulary — satisfying Article 50's machine-readable requirement and readable by Adobe tooling.

Yes. Amazon KDP requires publishers to declare AI-generated content when submitting books. Authentrail's audit report includes a KDP declaration guidance section that maps your batch's scan results — AI-generated images, disclosed AI text — directly onto the KDP questionnaire's answers.

Those tools can create provenance. Authentrail governs what happens across the entire asset lifecycle — including assets created elsewhere, missing provenance, multiple jurisdictions, remediation, publication decisions and long-term evidence. The AI Act is one regulatory driver; the underlying problem is proving where digital content came from and what happened to it, across large, messy, multi-client workflows.

Social platforms and CDNs routinely strip embedded metadata on upload. The timestamped audit report proves your assets were compliant at the moment of delivery — which is the obligation you can actually control. Authentrail also lets you re-scan published URLs to check whether provenance survived the pipeline.