C2PA validation and a signed audit record for EU AI Act Article 50 workflows

Updated August 3, 2026

ChronoVerify is the read, validate, and audit layer that platforms, trust and safety teams, and newsrooms wire into an image pipeline to confirm machine-readable AI-provenance marking, cryptographically validate C2PA Content Credentials against the official trust lists, and keep a signed, timestamped record of every check for EU AI Act Article 50 transparency work. It is for providers and deployers operating in the EU that generate or publish images: stock and digital-asset platforms, content moderation and trust and safety teams, newsrooms, and any business that ingests or publishes image content and needs an auditable provenance step.

ChronoVerify is also a member of the Content Authenticity Initiative (CAI). The CAI is the Adobe-founded community advancing C2PA Content Credentials and open content provenance, and we validate signers against both the official C2PA and CAI trust lists.

The current legal picture

Article 50 of the EU AI Act sets transparency duties for AI-generated and AI-altered media. Providers of systems that generate synthetic image, audio, or video output are expected to mark that output in a machine-readable, interoperable, and robust way. Deployers who publish AI-generated or materially altered media are expected to disclose that it is artificial. C2PA Content Credentials are the leading interoperable approach to that marking, and the European Commission's Code of Practice on marking AI-generated content, finalized on June 10, 2026, points to provenance credentials of this kind and gives signatories a practical pathway to demonstrate conformity with the marking duties. ChronoVerify is an initial signatory of the Code of Practice on Transparency of AI-Generated Content, Section 1, on the first list the European AI Office published on July 31, 2026, in the capacity Section 1 allows for technology providers of detection solutions: it reads and validates marks and generates nothing. Signing is a public signal of support for the code, not an approval of the product by the AI Office. See the announcement and the official list of signatories.

The timeline:

• Article 50 has applied since August 2, 2026.
• Under the AI Omnibus package, adopted by the Parliament and Council in June 2026 and signed on July 8, 2026, generative AI systems already on the market before that date have until December 2, 2026 to meet the machine-readable marking requirement of Article 50(2). The other Article 50 duties, including deployer disclosure, have applied since August 2. There is no single hard cutoff on August 2 for every system.
• The European Commission adopted its guidelines on the Article 50 transparency obligations on July 20, 2026. They are guidance rather than binding law: they set out how the Commission reads the obligations, and only the Court of Justice can give an authoritative interpretation. Confirm your own obligations, and the current state of the law, with qualified counsel.

California is adding a duty to read provenance as well as write it

Almost every rule in force today asks whoever generates content to mark it. The California AI Transparency Act, as amended by AB 853, is different: it puts a duty on the party distributing content to detect the provenance data already in it. ChronoVerify was built for that side of the problem.

• From August 2, 2026, a covered provider must make an AI detection tool available at no cost to the user.
• From January 1, 2027, a large online platform (a public-facing social media, file-sharing, mass messaging, or stand-alone search platform that exceeded 2,000,000 unique monthly users over the preceding 12 months) must detect whether compliant system provenance data is present in content it distributes, disclose through its interface whether that content was generated or substantially altered by a generative AI system or captured by a capture device, and let users inspect the provenance data. It must also not knowingly strip compliant provenance data or digital signatures, to the extent technically feasible.
• From January 1, 2028, capture device manufacturers must offer latent disclosures carrying the manufacturer name, the device name and version, and a timestamp, embedded by default.

The "captured by a capture device" limb is worth noting, because it is not what AI detection scores answer. Establishing that a file carries genuine capture provenance, and recording that finding durably, is the same job ChronoVerify already does on images: validate the credential against a trust list, fail closed when the signer is not recognized, and return a typed verdict you can retain. The statute is technology-neutral and names no vendor.

Who must do what, and where ChronoVerify fits

Article 50 places two duties on different parties, and ChronoVerify maps to a specific job under each: the check and the record. It does not discharge either duty for you.

The integration ladder

The ladder has three rungs: run a working check in one command, wire it into your pipeline, then make every check auditable.

curl -X POST https://chronoverify.com/v1/verify \
  -F "file=@photo.jpg"

curl -X POST https://chronoverify.com/v1/keys/free \
  -F "email=you@company.com"

# pip install chronoverify
from chronoverify import Client
client = Client("cv_live_...")
result = client.verify(file="photo.jpg")
print(result["verdict"], result["c2pa"]["validation_state"])

{
  "mcpServers": {
    "chronoverify": {
      "command": "npx",
      "args": ["-y", "chronoverify-mcp"]
    }
  }
}

curl -X POST https://chronoverify.com/v1/report \
  -H "Authorization: Bearer cv_live_..." \
  -F "file=@photo.jpg" -o report.pdf

What the signed, timestamped audit record proves

The audit report is the artifact you keep, so it is worth spelling out what it proves and how anyone can check it without relying on us.

What it contains and attests. An Ed25519 signature over the exact findings and the file's SHA-256, so the record cannot be altered without breaking the signature. An embedded RFC 3161 trusted timestamp token, which shows the report existed no later than the timestamp and is verifiable offline. An embedded visual reference of the image and a five-verdict plain-language scale, so a reviewer who is not technical can read the outcome.

How a third party verifies it offline. Recompute the file's SHA-256 and confirm it matches the report. Verify the Ed25519 signature against ChronoVerify's published public key, with no need to contact or trust us. Verify the RFC 3161 timestamp token using the exact openssl command the report prints. Or paste the signed payload and signature into the free report verifier, which runs the signature check in the browser.

What it is, and is not. The report is a signed, timestamped audit record and a chain-of-custody artifact for your review files: investigative triage you can hand to an auditor. It is not courtroom proof, and it is not an attestation that the scene the photo shows is real. It records what the file's data says and whether its provenance validates, nothing more.

Honest limits

• ChronoVerify validates provenance and reads metadata. It is not an AI-generation or deepfake detector and does not score whether an image was made by AI. It reads the machine-readable marking; it does not infer it.
• Absence of marking is not evidence. Marking is commonly stripped by resizing, re-saving, screenshots, and most social platforms, and many generators write none. Treat absence as absence of evidence.
• A credential is reported as validated only when its signature and content binding are intact and the signer chains to a recognized root on the official C2PA and CAI trust lists. A self-signed or unknown signer is reported as present but unverified. A tampered credential is reported as failed. Validation fails closed: any error leaves the result unverified.
• It validates embedded credentials. The small number of images that reference a credential stored remotely are reported as carrying a credential that was not retrieved, with the URL surfaced, and are never reported as unsigned. The manifest is deliberately not fetched, so its signature and trust status are not verified, which keeps every check deterministic and free of outbound requests.
• There is no Article 50 certification for a product, and none exists. ChronoVerify does not claim one. Membership of the Content Authenticity Initiative signals participation in the provenance ecosystem; it is not a conformance mark.
• SOC 2 Type II and ISO 27001 are not held today. A verdict is investigative triage with documented limits and should not be the sole basis for an automated decision about a person.
• This page is information about a tool, not legal advice. Confirm your own obligations with qualified counsel.

Common questions