How to mark AI content, modality by modality

The two-layer principle

The code of practice thinks in two layers: signed metadata attached to the file (provenance anyone can read out) plus an imperceptible watermark embedded in the content itself (survives when metadata is stripped). Where the format supports both, do both. Where it can't — free-form text has nowhere to put metadata — one layer is acceptable. And everything below applies to AI-modified content too, unless the edit stays inside the narrow assistive exception (grammar and spell-checking, not rewriting or summarizing).

Text

• Visible label at the point of output— a line like "Written by Claude Sonnet" or "AI-assisted draft" next to the generated text. Ship-this-afternoon territory, and it also satisfies the Article 50(1) disclosure duty.
• Transport metadata — where text travels inside a protocol, the protocol can carry the marker. Email is the clean example: a header such as X-AI-Assisted: text=ai-drafted; model=claude-sonnet-4-6; provider=Anthropic is machine-readable, robust, and invisible to the reader. This is what our own mail client sends.
• Containerized documents — PDF, DOCX and friends can carry signed XMP metadata or a C2PA manifest. If your product exports documents, this is the expected layer.
• Statistical watermarks— schemes like Google DeepMind's SynthID Text bias token choice so the text itself is detectable. This only works at generation time, so it's your model provider's layer to ship; downstream API users can't add it afterwards. Until yours offers it, a documented feasibility assessment plus a visible label is the defensible position.

Images

• C2PA Content Credentials — the emerging industry standard: a cryptographically signed manifest travelling with the file, recording that (and how) AI produced or edited it. Supported by Adobe tooling, several model providers, and a growing set of cameras and platforms. This is the default answer for images.
• IPTC metadata — set DigitalSourceType = trainedAlgorithmicMedia(or compositeWithTrainedAlgorithmicMedia for AI edits) in the image's IPTC/XMP block. Cheap, standardized, read by search engines and newsroom tooling.
• Invisible watermarks — pixel-level marks (SynthID for images, vendor equivalents) that survive resizing and mild compression. Usually applied by the generator, so check what your image API already embeds before building anything.
• Visible badge— a small "AI-generated" mark or the Content Credentials "CR" pin in a corner. Not sufficient alone (it crops off), good as the human-facing layer on top of metadata.

Audio

• Audible disclosure— a short spoken or tonal notice ("this recording was generated with AI") at the start. The human-facing layer, required territory anyway for voice systems people converse with.
• Inaudible watermarks— signal-level marks such as SynthID for audio or Meta's AudioSeal, which survive re-encoding and let a detector localize AI-generated segments. Generator-side, like all watermarks.
• Container metadata — MP4/BWF and podcast feeds can carry a C2PA manifest or ID3-style tags naming the generator. Strippable, but machine-readable and free.

Video

• C2PA manifest — same standard as images, covering the whole file including its edit history. The interoperable machine-readable layer.
• Invisible per-frame watermarks — SynthID-class marks embedded across frames, robust to cropping and re-encoding. Generator-side.
• Visible overlay— a persistent or opening "AI-generated" label. For anything deepfake-adjacent this is effectively mandatory — the Article 50(4) deepfake disclosure wants humans, not just machines, to see it.
• Platform flags— YouTube's altered-content disclosure, TikTok's AI-generated label and similar. Set them when you publish; they don't replace marking the file itself, but regulators read them as part of your good-faith effort.

Content published on a website

Publishing is where two different duties meet. The markingduty of Article 50(2) attached back when the content was generated — it belongs to the tool's provider. The disclosure duty of Article 50(4) attaches to you the moment you publish AI-generated text to inform the public on matters of public interest — and it gives publishers a genuine choice: disclose the AI origin, or have a human review the text and take editorial responsibility. Marketing copy and product pages rarely qualify as public-interest information, and purely personal publishing is outside the Act entirely; a blog that explains, reports or advises is squarely inside.

• A disclosure line near the content— either branch of 50(4) can be satisfied visibly: "Generated with AI" for the disclosure route, or a byline note like "drafted with AI, reviewed and edited by a named editor" for the editorial-responsibility route. Put it where readers actually look: under the headline or by the byline, not in the footer.
• Machine-readable page signals — a <meta name="generator"> tag is the established HTML-level marker; Schema.org has no widely adopted AI-provenance property yet, so visible text plus the meta tag is the current state of the art for web pages. Say so in your compliance file rather than inventing markup.
• Don't strip your own media marking — the quiet gotcha: image CDNs and optimization pipelines routinely remove EXIF/XMP metadata when they compress. If your images carry C2PA Content Credentials or IPTC tags, configure the pipeline to preserve them — otherwise the machine-readable layer silently disappears between your CMS and the reader.
• A site-level AI policy page — one page stating what you use AI for and what gets human review, linked from the footer. Not required by the Act, but it centralizes the explanation, and regulators and readers both read it as good faith.
• If you already name an editorially responsible person— as German media law makes many sites do in the imprint — that's the same person the editorial-responsibility exception asks for. Align the two rather than inventing a parallel structure.

Posted on a public forum or social platform

On someone else's platform you control neither headers nor page markup, so the options shrink to three: what you write in the post itself, the platform's own labels, and the metadata your file carries in the door.

• Inline disclosure in the post— one honest line ("written with AI assistance", "image generated with AI") inside the post text. On a forum this is the only marker fully under your control, and many communities' own rules demand it independently of the Act.
• The platform's AI label— where the platform offers a disclosure toggle or label (YouTube's altered-content flag, TikTok's AI-generated label, Meta's AI disclosure), set it when you post. It's the platform's native machine-readable layer.
• Upload media with its metadata intact— several platforms auto-label media that arrives carrying C2PA or IPTC AI markers (Meta's "AI info" label works this way; LinkedIn displays Content Credentials). Stripping metadata before upload switches those labels off; leaving it in lets the marking you already did keep working downstream.
• Bot accounts— if an AI system posts autonomously under an account, identify the account as automated. That's the Article 50(1) interaction disclosure in forum clothing, and essentially every platform's bot policy besides.
• Scope check — purely personal, non-professional posting is outside the Act entirely; posting as a business or in a professional capacity is not. And realistic deepfake images, audio or video must be visibly disclosed when posted regardless of the public-interest test.

When the ideal layer isn't available to you

The pattern across all four modalities: watermarks belong to whoever runs the model, metadata belongs to whoever writes the file, and visible labels belong to you. If you're a downstream API user and your provider ships no watermark, you are not obliged to invent one — the obligation is bounded by what's technically feasible and available on the market. What you must do is document that assessment, ship the layers you can (labels, headers, metadata), and adopt the upstream layer when it appears. Systems on the market before August 2026 have until 2 December 2026 to get this in place — our case study shows the whole exercise on a real product, and the self-check tells you whether Article 50(2) applies to yours at all.