EU AI Act Article 50: a practical checklist for your image pipeline

A field note from ChronoVerify, built and maintained by a veteran intelligence analyst. Published July 20, 2026

Article 50 of the EU AI Act sets transparency duties for AI-generated and AI-altered media, and the regime applies from August 2, 2026. If you build systems that generate images, or you publish media that may be AI-generated or materially altered, at least one of those duties is likely to reach you. This is the operational version: who is affected, what the two duties require, and a checklist to get an auditable provenance step running in your image pipeline this week. It is a companion to our argument for why verifiable provenance, not detection, is the durable signal. Here the goal is narrower: what to do, in what order, and what to keep.

Who Article 50 affects

Article 50 places transparency duties on two different parties. Providers of systems that generate synthetic image, audio, or video output are expected to mark that output in a machine-readable, interoperable, and robust way, so downstream systems can detect it. Deployers who publish AI-generated or materially altered media are expected to disclose that it is artificial. The duties bind those parties, not a verification tool. If you generate images, publish media that may be AI-generated or altered, or ingest such media at scale, you probably sit under at least one of them. Stock and digital-asset platforms, content moderation and trust and safety teams, newsrooms, marketplaces, and any product that ingests or publishes image content are the common cases. Confirm your own status with qualified counsel.

C2PA Content Credentials are the leading interoperable approach to the marking, and the European Commission's Code of Practice on marking AI-generated content, finalised on June 10, 2026, points to provenance credentials of this kind and gives signatories a practical pathway to demonstrate conformity with the marking duties.

The two duties, and where a check fits

Each duty maps to a specific job you can run on an image. ChronoVerify does not discharge either duty for you: it gives you the check and the record.

The timeline, stated honestly

• Article 50 applies from August 2, 2026.
• Under the AI Omnibus package, adopted by the Parliament and Council in June 2026 and signed on July 8, 2026, generative AI systems already on the market before that date have until December 2, 2026 to meet the machine-readable marking requirement of Article 50(2). The other Article 50 duties, including deployer disclosure, still apply from August 2. There is no single hard cutoff on August 2 for every system.
• The Commission's interpretive guidelines on Article 50 are still pending, so specifics can still move. Confirm your own obligations, and the current state of the law, with qualified counsel. This is information about a tool, not legal advice.

A checklist to get an auditable provenance step running this week

Ordered so you can start today and stop at the rung that fits your obligation.

1. Inventory your image touchpoints. List where images enter and leave your product: uploads, generated output, third-party feeds, and anything you publish. For each, note whether you are the provider marking it or the deployer publishing it.
2. Decide the two questions per image. Is it marked, and does the marking validate. Those are the questions a check answers, and they are the two you record.
3. Run a keyless check today. Send one image and read the verdict. No signup, so there is nothing to procure first.
4. Wire the check into your pipeline. Mint a free API key, then call the same endpoint from the Python or TypeScript SDK, or hand the tool to an AI assistant over MCP, so every image is checked automatically.
5. Turn on signed, timestamped reports for anything you publish or may have to defend, so each decision has a record a third party can check.
6. Write down the neutral case and human routing. Record a policy for images that carry no credential, since absence is neutral, not evidence, and route low-confidence or high-stakes cases to a human instead of auto-deciding.
7. Keep the records. Retain the typed verdict logs and the signed reports in your review files as the durable, checkable record behind each disclosure decision.

The integration ladder

You can go from reading this page to a working check in one command, then wire it into your pipeline, then make every check auditable. Three rungs, reusing the real snippets from the compliance page.

curl -X POST https://chronoverify.com/v1/verify \
  -F "file=@photo.jpg"

curl -X POST https://chronoverify.com/v1/keys/free \
  -F "email=you@company.com"

# pip install chronoverify
from chronoverify import Client
client = Client("cv_live_...")
result = client.verify(file="photo.jpg")
print(result["verdict"], result["c2pa"]["validation_state"])

{
  "mcpServers": {
    "chronoverify": {
      "command": "npx",
      "args": ["-y", "chronoverify-mcp"]
    }
  }
}

curl -X POST https://chronoverify.com/v1/report \
  -H "Authorization: Bearer cv_live_..." \
  -F "file=@photo.jpg" -o report.pdf

What to keep in your review files

The deployer disclosure duty is a decision, and a decision is easier to stand behind when it has a record. Keep three things per image you act on.

• The typed verdict. One deterministic result on a five-point scale (provenance confirmed, consistent, inconclusive, metadata anomaly, or manipulation indicated), plus the C2PA validation state and signer. Log it with the file identifier so the decision is reproducible.
• The signed, timestamped report for anything you publish or may have to defend. It contains an Ed25519 signature over the findings and the file's SHA-256, an embedded RFC 3161 trusted timestamp token that verifies offline, and an embedded visual reference and a plain-language scale a non-technical reviewer can read.
• Your policy for the neutral case. A note that absence of a credential is treated as absence of evidence, not as a finding, and a record of how low-confidence or high-stakes cases were routed to a human.

A third party can verify the report offline without trusting us: recompute the file's SHA-256 and confirm it matches, verify the Ed25519 signature against ChronoVerify's published public key, and verify the RFC 3161 timestamp token with the exact openssl command the report prints. Or paste the signed payload into the free report verifier, which runs the signature check in the browser.

Honest limits

Regulatory language invites overclaiming, so the boundary is stated plainly.

• This is not an AI-generation or deepfake detector. ChronoVerify validates provenance, reads EXIF and XMP metadata, and reads the machine-readable marking. It does not score whether an image was made by AI. It reads the marking; it does not infer it.
• Absence of marking is neutral. Marking is commonly stripped by resizing, re-saving, screenshots, and most social platforms, and many generators write none. Treat a missing credential as absence of evidence, not as evidence of fakery.
• A credential is validated only when it chains to a trusted root. The signature and content binding must be intact and the signer must chain to a recognized root on the official C2PA and CAI trust lists. A self-signed or unknown signer is reported as present but unverified. A tampered credential is reported as failed. Validation fails closed: any error leaves the result unverified.
• Pixel forensics are conservative triage, not proof. They are calibrated to avoid false alarms: no authentic photo in the measured corpus was wrongly flagged, and no known edit was cleared as consistent, and a manipulation flag requires two corroborating signals, never one. Treat a flag as a reason to look closer, not as a verdict on reality.
• There is no Article 50 certification for a product, and none exists. ChronoVerify does not claim one. Membership of the Content Authenticity Initiative signals participation in the provenance ecosystem; it is not a certification, a C2PA conformance mark, or an endorsement of any result.
• A verdict is investigative triage with documented limits, not courtroom proof. SOC 2 Type II and ISO 27001 are not held today. A verdict should not be the sole basis for an automated decision about a person. A signed report proves ChronoVerify issued that exact finding over that file's SHA-256 at that time; it does not prove the depicted scene is real.
• This is information about a tool, not legal advice. Wiring in a provenance check supports the obligation; it does not discharge it. Confirm your own obligations with qualified counsel.

Sources and further reading: C2PA Specifications index; C2PA FAQ; EU AI Act Article 50 (transparency obligations); European Commission on the AI Act; Content Credentials Verify; ChronoVerify compliance and Article 50 page; Article 50 marking checker.