Notes on provenance, the new EU rules, and building proof of origin that survives the real internet.
Google has watermarked over 10 billion pieces of content, and you still need a waitlist to check one. AI watermarking is strong when present, meaningless when absent, and readable by almost nobody — which makes it excellent evidence and a bad verdict.
A federal rule written for deepfakes already exists in draft. Its comment period closed in February 2026, and the committee declined to advance it in May. So synthetic evidence is still governed by rules written before generative models — which work, but only for a party with a record of origin.
The FBI's 2025 report logged 22,364 AI-related complaints and $893 million in losses. In the one category it measured closely, the AI-flagged share was under 8% of the total — because victims could not tell. That gap is a verdict on detection, not an argument for more of it.
Thirty-one states now regulate election deepfakes, and the 2026 midterms are the first cycle to test all of them. The ads are already running — labeled, unlabeled, and in court. Disclosure outlived the outright bans. A disclosure rule only bites if someone can establish where a video came from.
EU AI Act Article 50 applies from 2 August 2026, with 2 December for systems already on the market. It asks for two things: machine-readable marking and detectability. Everyone shipped the first. The second is where compliance breaks.
A C2PA certificate is two things wearing one name: a keypair anyone can make, and a place on a trust list now gated behind security evaluation. Why c2patool says valid while validators say untrusted, and what to ship in the meantime.
AI detectors output a probability, not a fact — and the false positives land on real people. Here is why recording where content came from beats guessing after the fact.
Phones now cryptographically sign photos, Chrome and Search verify them, and EU law soon requires AI content to be detectable. Origin is becoming a first-class property of every image — here's what's driving it, and where the current approach still breaks.
C2PA is the most important standard in content provenance, and you should use it. It also leaves one half of the problem open — the half where content actually travels.
A signature proves who signed something. It does not prove when, or that nobody swapped it since. For proof of origin, that gap is everything — and it is what a transparency log closes.
A screenshot changes every byte of an image while your eye sees the same picture. Perceptual fingerprinting is the trick that closes that gap — here is how it actually works.
