The law now makes AI label what it made. It says nothing about what it knew.
Since 2 August, anything an AI produces must be machine readable as AI generated. That is a real step and we are for it. It also stops one layer short.
Three rules, live now.
Say you are a machine
A chatbot must disclose that the person is not talking to a human.
Mark what you make
AI generated image, audio, video and text must be machine readable as such.
Or pay
Up to 15M euro or 3% of worldwide annual turnover, whichever is higher. It applies wherever your users are, not just where you are.
Article 99(4). Lower of the two for SMEs. Read the text.
Grace period for pre-existing systems ends 2 December 2026.
Every link rests on something a stranger already trusts.
So that a mediator who has never heard of a UMO can still accept the evidence.
Content is unchanged
SHA-256, FIPS 180-4, NIST.
◆ Shipped
Signed by this key
Ed25519, RFC 8032.
◆ Shipped
One ordered set
Merkle tree over the sealed leaves.
◆ Shipped
Checkable without us
Open format. Every record carries what a standalone checker needs, and no account is involved.
◆ In progress
C2PA is an output standard.
MI™ is an input standard.
C2PA marks the artifact and records edits to it. It is now the mechanism the Code of Practice points at. Six thousand organisations already use it.
We are not competing with it. A UMO's provenance can carry a C2PA manifest as one entry. It answers what was produced. We answer what it knew.
The Code names three mechanisms: signed metadata, invisible watermarking, and an optional registry.
The first two are the model vendor certifying its own output. The third has no owner.