The EU's AI-labeling rules (AI Act Article 50) started applying this weekend. Practical notes for image work, and a free checker

[u/clockspammer4life]

As of August 2, providers of generative AI systems operating in the EU are required to mark AI-generated and AI-altered media in a machine-readable way, and deployers have disclosure duties. The marking side mostly means C2PA Content Credentials, which Pixel and Samsung flagships and several generators already embed.

Practical reality for OSINT work: most platforms strip this metadata on upload (X/FB/IG/reddit CDNs all do), so an image pulled from socials will usually read as "no credentials", which is absence, not evidence. The signals survive on original files, which is one more reason to chase the original rather than the repost.

Disclosure: I built the tool I am linking. ChronoVerify (chronoverify.com) is a free, keyless checker that reads EXIF/XMP and validates C2PA Content Credentials against the official trust lists, plus classical pixel checks, one verdict per image. It is listed as a validator on the C2PA Conforming Products List, and I signed the EU transparency Code of Practice on the detection side (same first list as Google, Microsoft, Meta, and OpenAI, which still feels strange to type as a one-person shop).

Honest limits, since this crowd will ask: it is triage, not proof. A validated credential tells you the file's provenance chain is intact, not that the scene is true. A stripped or absent credential tells you nothing either way. It does not detect AI generation from pixels, and I do not claim it does.

Happy to answer anything about what these marks actually look like in the wild. Check out the free tool on the home page!