AI Labeling Compliance

How to comply with the new EU AI Act Article 50(2) and California SB 942 regulations.

Published June 30, 2026; Updated November 4, 2026

A number of AI content labeling regulations have been passed, in jurisdictions around the world. The most immediate obligations are the EU AI Act Article 50(2), which has an upcoming 2 December 2026 deadline for existing generative AI systems, and the California AI Transparency Act, which has separate deadlines for AI producers, content platforms, and camera capture devices.

Global AI labeling regulationsNovember 2026

in force, c2pa + watermarkin forcein force, limited scopeproposed or upcomingnot covered

Explore a jurisdiction:

Select a jurisdiction for its scope, deadlines and requirements.

The two most important ones are the EU AI Act Article 50(2) and the California AI Transparency Act.

EU AI Act Article 50(2)

California AI Transparency Act

Complying with these requirements is a fairly complex endeavor, since two new technologies are required: digitally-signed metadata and invisible watermarking. In particular, the implementations must be interoperable, which means that third-party vendors are effectively required.

Cryptographically signed metadata

C2PA Content Credentials attach a tamper-evident provenance record to the file: who signed it, how AI was involved, and which system generated it.

Explore C2PA

Invisible watermarking

A signal woven into the media itself helps recover its AI origin even when metadata is stripped. Per-embed marks can also reconnect to a content record.

Explore PawPrint

Trufo is the trusted industry partner for companies who need to comply, working with AI labs (e.g. OpenAI), brands (e.g. Adidas), platforms (e.g. Getty Images), and newsrooms (e.g. IPTC) on their production implementations.

Managed Compliance with Trufo

Estimated time to compliance: 10 days, 1 engineer, clean integration.

For those looking for a compliance solution, here is a step-by-step guide:

0. Sign the EU Code of Practice on AI-Generated Content.

1. Create an account at app.trufo.ai. Invite members of your organization.

Enable MFA in User Settings. An organization owner or admin completes validation, accepts agreements, and creates API keys.

2. Complete Organization Validation (2-5 business days to complete a callback by phone) and purchase the C2PA Signing Service ($120/mo).

3. Set up the Python SDK

Reference trufo-py for documentation.

Create a c2pa-sign-prod key in Organization Settings → API Access. MFA is required. Replace the key placeholders below, then run each step in the same terminal.

Use Python 3.10 or later with venv support. The following commands use Bash.

bash

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade 'trufo>=2.2,<2.3'
export TRUFO_C2PA_SIGN_PROD_API_KEY='<your-c2pa-sign-prod-key>'

4. Register your AI system

For first-party AI labeling, your organization must operate the system and its model. An owner or admin must first accept the Created Assertion Acknowledgement.

Replace AI_SYSTEM_NAME and AI_SYSTEM_VERSION below. Register once per system version; use the saved ID for subsequent signing calls.

Save this as register.py, then run python register.py. It writes your ID to ai-system-id.txt.

python

import os
from pathlib import Path
import requests

response = requests.post(
    "https://api.trufo.ai/ai-system/add",
    headers={"X-API-Key": os.environ["TRUFO_C2PA_SIGN_PROD_API_KEY"]},
    json={
        "name": "<AI_SYSTEM_NAME>",
        "version": "<AI_SYSTEM_VERSION>",
        "ai_involvement_modes": ["ai_generated"],
        "c2pa_first_party_attestable": True,
        "c2pa_ai_disclosure": {"modelType": "c2pa.types.model"},
    },
    timeout=60,
)
response.raise_for_status()
ai_system_id = response.json()["ai_system_id"]
Path("ai-system-id.txt").write_text(ai_system_id)
print(ai_system_id)

5. Sign your content

This image example uses an input smaller than 10,000,000 bytes.

Place input.jpg beside ai-system-id.txt. Save this as sign.py and run python sign.py; it writes signed.jpg.

python

import os
from pathlib import Path
from trufo import sign_c2pa

signed = sign_c2pa(
    os.environ["TRUFO_C2PA_SIGN_PROD_API_KEY"],
    Path("input.jpg").read_bytes(),
    assertions=[
        ["ai_system", {
            "ai_system_id": Path("ai-system-id.txt").read_text().strip(),
            "ai_involvement": "ai_generated",
        }],
    ],
    actions=[
        ["watermark", {
            "wid_allocation_mode": "per_embed",
            "effort_policy": "require",
        }],
    ],
)
Path("signed.jpg").write_bytes(signed)

Check your signed content at verify.trufo.ai.

Full integration guide · Supported formats · Large files and audio/video

Trufo helps you meet all the compliance requirements across any jurisdiction you need:

Digitally signed metadata

For formats that support metadata, Code signatories record whether content was AI-generated or manipulated: “All recorded information will be digitally signed”.

EU Code of Practice, 1.1.1

✓ Conformant C2PA metadata records AI involvement in a digitally signed manifest.

Invisible watermarks

Code signatories ensure AI-generated or manipulated content is “marked with an imperceptible watermark”, except very short text.

EU Code of Practice, 1.1.2

✓ PawPrint embeds an invisible watermark. Per-AI-system watermarking supports the EU workflow; use per-embed watermarking for California.

Unique content identifiers

Where technically feasible, covered providers must include a “unique identifier” in the latent disclosure for images, video and audio their AI creates or alters beyond minor modifications.

California, § 22757.3(a)(1)(D)

✓ Per-embed watermarking gives each output a unique identifier linked to its content record.

Interoperable disclosures

Covered providers’ latent disclosures must be “compliant or interoperable with widely recognized industry standards”.

California, § 22757.3(a)(4)

✓ C2PA manifests and registered soft-binding identifiers connect signing, watermarking, and downstream validation.

Interoperable detector tool

Code signatories provide a “detection mechanism for each marking technique” and support detection across systems where technically feasible. Access is generally free.

EU Code of Practice, 2.1.1 and 3.4

✓ The public detection tool at verify.trufo.ai is free to use. White-labeled sites are also available.

Public detector tool

Covered providers must offer “a disclosure verification tool at no cost to the user” so users can assess AI-created or altered media and recover detected provenance data.

California, § 22757.2(a), (e)

✓ Use verify.trufo.ai as your free public detector and link it from your product’s interface.

Some frequently asked questions:

How do I choose which of the five integration modes to use?

Use the local version if you want to keep your media files local; the C2PA claim signing is still done on Trufo servers, as are various other operations needed for the Trufo service to operate. Use the REST APIs (cloud) or docker image (local) if Python does not work well in your tech stack.

Are there other integration methods, such as node.js or rust SDKs?

We are currently working on adding support across more workflow modalities. Feel free to email us at support@trufo.ai for specific requests.

What if I need to make more complex declarations, or want my name to show up in the C2PA data?

You should purchase the branded Generator Product. Please schedule a free 30-minute consultation.

What if I want to declare AI-modified instead of AI-generated?

If you would like the "most accurate" method of declaring an "AI-modified" action and a "non-AI" parent, due to conformance limitations we cannot write that claim on the shared Trufo AI Labeling Service generator product. You would need to purchase the branded Generator Product. However, what you can do right now is to set a "non-AI" component (componentOf) or input (inputTo), and set the ai_involvement to ai_modified (coming in v2.3).

Does the cost scale with the amount of content or the type of content I have?

Yes, but in a reasonable way. We work with small teams producing 1-2 pieces of content a month to enterprise giants that process a billion a day, so we will have a good solution for you regardless of how much content you have (or anticipate having in the future).

What other vendors are there, that provide this turnkey service?

Trufo is currently the only vendor that is both a trusted C2PA Certificate Authority and a watermark & soft-binding provider, so no other vendors (as of Nov 2026) are able to provide a true turnkey service. Adobe does provide both C2PA and watermarks out-of-the-box, but that only applies for workflows within the Adobe product ecosystem.

Build-Your-Own AI Labeling

Estimated time to compliance: 3-6 months, 2-5 engineers, ongoing updates.

For those looking to build compliance in-house, here is a step-by-step guide:

1. Build a conformant C2PA generator product and pass the C2PA Conformance Program.

on your own

2. Find a C2PA Certificate Authority to get your C2PA Claim Signing Certificate.

Trufo CA
Digicert
SSL.com
Irdeto
D-Trust

3. Find a C2PA TSA provider to add timestamps to your C2PA.¹

Trufo CA
Digicert
SSL.com

4. Find a watermark provider with a watermark designed for interoperability (as opposed to e.g. leak tracing).

Trufo PawPrint
Google SynthID

5. Set up a content registry so that requisite metadata can be recovered from the watermark.²

Trufo Provenance Registry
on your own

6. Set up a free public decoding endpoint where content can be checked.

Trufo PawPrint
Google SynthID
on your own

7. Keep up with updates to the C2PA and CAWG standards.

on your own

¹ Not required for California.
² Not required for the EU.

As more regulations come out, such as in China and India and Korea, there may be additional requirements.

Some frequently asked questions:

Should I build my own, or should I use the turnkey service?

We typically recommend the following types of companies to build their own: (a) mega-tech corporations, (b) hardware manufacturers, (c) C2PA provenance experts.

Relevant Release Notes

Here are the major releases that are relevant to AI labeling.

November 4, 2026
v2.2
• limited time promotion: baseline services free until Jan 1
• introducing the ai-system registration (for compliance); deprecating the ai-disclosure registration (outdated)
• per-system watermarking is now live, in addition to per-embed
October 25, 2026
v2.1
• launch of the docker image integration
• enabling the Trufo AI Labeling Service in local mode
October 19, 2026
v2.0
• C2PA specifications v2.4, conformance v0.2
• launching the branded Generator Product for more complex declarations or increased brand visibility
• enabling proper AI labeling via the Trufo AI Labeling Service (c2pa.created + trainedAlgorithmicMedia)
Earlier in 2026
v1.x
• separate EU API endpoint, for data residency (eu.api.trufo.ai instead of api.trufo.ai)
• launch of the Trufo Provenance Service (first such service to pass conformance)
• issuance of C2PA Claim Signing Certificates and C2PA Trusted Timestamps

About Trufo

Built by people who care about provenance.

We are a team with alumni from Princeton & Stanford & Harvard and engineers from Netflix & Google & Meta, who are passionate about building out trust infrastructure for the post-AI world. We have been involved with C2PA since the early days, and are here to help you bring trusted provenance to your products.

Your product.
A clear path forward.

Bring us your workflow, your deadlines, and your questions.

Schedule a consultation

Ready to build? Open the dashboard