Notes on provenance, the new EU rules, and building proof of origin that survives the real internet.
EU AI Act Article 50 applies from 2 August 2026, with 2 December for systems already on the market. It asks for two things: machine-readable marking and detectability. Everyone shipped the first. The second is where compliance breaks.
A C2PA certificate is two things wearing one name: a keypair anyone can make, and a place on a trust list now gated behind security evaluation. Why c2patool says valid while validators say untrusted, and what to ship in the meantime.
AI detectors output a probability, not a fact — and the false positives land on real people. Here is why recording where content came from beats guessing after the fact.
Phones now cryptographically sign photos, Chrome and Search verify them, and EU law soon requires AI content to be detectable. Origin is becoming a first-class property of every image — here's what's driving it, and where the current approach still breaks.
C2PA is the most important standard in content provenance, and you should use it. It also leaves one half of the problem open — the half where content actually travels.
A signature proves who signed something. It does not prove when, or that nobody swapped it since. For proof of origin, that gap is everything — and it is what a transparency log closes.
A screenshot changes every byte of an image while your eye sees the same picture. Perceptual fingerprinting is the trick that closes that gap — here is how it actually works.
