What AI-presented images actually carry: 73 images, 38 companies, August 2026

A note from ChronoVerify, built and maintained by a veteran intelligence analyst. Published August 6, 2026

In the first days after the EU AI Act's Article 50 transparency obligations entered into application, we fetched 73 images that 38 companies publicly present as AI-generated or AI-altered, each file exactly as the company's own page delivers it to a visitor, and checked what each one carries. 72 of the 73 arrived with no C2PA Content Credentials. One arrived with a credential that was present, cryptographically intact, and signed by an entity on the C2PA trust list.

Checks ran August 3, 2026. Delivered files can change at any time; every count on this page describes that day.

The numbers

Every image in the sweep is one a company presents as AI on its own pages: example galleries in model documentation, product demos, AI stock categories, and AI campaign imagery. We checked the delivered file, not the original: the exact bytes a visitor's browser receives from the page that makes the AI claim.

• 72 of 73 images carried no C2PA Content Credentials at all. Not broken credentials, not failed validation: no credential present in the delivered file.
• 1 of 73 carried a validated credential: present, cryptographically intact, signer on the C2PA trust list, manifest declaring AI generation. It is named below.
• Many of the credential-free files carried no EXIF or XMP metadata either. A file like that gives a provenance checker nothing to evaluate, and ChronoVerify reports it as inconclusive rather than guessing.

Who was checked

The 38 companies break down like this. The sweep is not a random sample: each company qualified by publicly presenting delivered images as AI-generated or AI-altered.

Eleven of the 38 are confirmed signatories of the EU Code of Practice on Transparency of AI-Generated Content, read against the official signatory list the same day; a twelfth matches a signatory name only loosely, so we count it as unconfirmed. The other 26 are not on the signatory list. The roster runs from some of the largest model providers to single-product tools.

The one that validated

The generated demo image on Flipsnack's AI flipbook tool page arrives as a WebP carrying C2PA Content Credentials that are present and cryptographically intact. The signer, OpenAI Media Service, chains to the C2PA trust list, and the manifest declares AI generation: digital source type trainedAlgorithmicMedia, software agent gpt-image. The permanent verdict record is public: chronoverify.com/v/T70rPUIsInISOOB4.

The credential was embedded at generation, which OpenAI documents doing. What makes Flipsnack the one in 73 is the delivery path: their site serves the generated file with the marking still in it. Serving the file without re-encoding it is the step most delivery paths miss, and it is the step they got right.

Where the markings go

The likeliest explanation for most of the 72 misses is mechanical, not editorial. C2PA Content Credentials and metadata live inside the file, and the delivery paths most websites use rewrite files as a matter of course: image optimizers, resizing endpoints, CDN re-encodes, format conversion. Each rewrite produces a new file, and the marking does not carry over unless someone re-signs the output or serves the original bytes. Several of the checked files came from exactly such endpoints. This is also why a sweep of delivered files says nothing about whether the images were marked when they were generated.

Method

• Selection. Companies that publicly deliver images they themselves present as AI-generated or AI-altered, identified from their own pages. Signatories and non-signatories of the EU transparency Code of Practice were both included on purpose.
• Fetch. The exact image URL the company's page embeds, fetched as delivered, with no re-encoding on our side.
• Check. One POST /v1/verify call per file: C2PA Content Credentials validated against the official trust list, EXIF and XMP read, SHA-256 of the delivered bytes recorded. ChronoVerify is a C2PA Conformant Validator, listed on the C2PA Conforming Products List.
• Records. Every check produced a permanent verdict record with the file's SHA-256, so any finding can be re-examined later even if the delivered file changes.
• Date. All checks ran on August 3, 2026.

What this does and does not show

Absence of a credential is not evidence an image is fake, and it is not evidence about how the image was made. These records describe what delivered files carried on one day, nothing more. Article 50 places marking duties on providers and disclosure duties on deployers, machine-readable marking accepts more than one technical route, and generative systems that were already on the market have until December 2, 2026 to meet the marking requirement. Nothing here is a legal conclusion, and this page is not legal advice. ChronoVerify reads and validates provenance; it does not detect AI generation.

Why 37 companies are not named

The point of the sweep is the systemic picture: the marking layer that transparency rules assume is, as delivered today, mostly not there to read. Naming the misses would turn a delivery-path observation into a scoreboard, and a file that changes tomorrow would make the scoreboard wrong. The positive example is named because it is evidence the plumbing can work. Journalists and researchers who want the row-level evidence, with the delivered file URL, the page making the AI claim, the SHA-256, and the permanent verdict record for every row, can request it through the contact form.

Sources: the delivered files and their permanent verdict records (row-level evidence available on request); the official signatory list (European AI Office, read August 3, 2026); OpenAI's C2PA documentation; EU AI Act Article 50; ChronoVerify's conformance record; compliance and Article 50.