Watermarking Synthetic Content by 2 December 2026: C2PA, SynthID and the Interoperability Problem

Marking AI-generated output is about to stop being an ethics slide and become a product obligation with a date on it. From 2 December 2026, providers of generative AI systems placed on the EU market must mark their synthetic output in a form a machine can read as artificially generated.

This is the marking duty in Article 50(2) of the EU AI Act. The original date sat with the wider transparency package on 2 August 2026, but the Digital Omnibus compromise gave the provider marking obligation a four-month grace, landing it on 2 December 2026. Treat that date as operative but verify it against the final published text, as the Omnibus was still being finalised as this was written. The direction of travel has not moved: machine-readable marking of synthetic content is now a shippable product feature, not a policy aspiration. And the moment you build it, you hit a problem the regulation does not solve for you — no single technique covers every media type or survives every transformation content undergoes between your system and the viewer.

What the obligation actually asks of the technology

Article 50(2) applies to providers of generative systems — the entity that builds or places the model on the market — and covers synthetic audio, image, video and text. The output must be marked “in a machine-readable format and detectable as artificially generated or manipulated.” The Act qualifies the standard of care: solutions must be effective, interoperable, robust and reliable “as far as this is technically feasible.” That last clause is doing a lot of work, and it is where the engineering judgement lives.

Note the separation of duties. Article 50(2) is the provider’s marking obligation — embed a machine-readable signal at generation. The deployer-facing disclosure duties, including labelling deepfakes for viewers, sit elsewhere in Article 50 and arrive on the 2 August 2026 date. If your firm both builds and deploys, you own both, and they are not the same control. I have written separately on the deployer-facing disclosure side of Article 50; this post is about the marking layer underneath it.

The AI Office’s Code of Practice on marking and labelling of AI-generated content is meant to give the how. Drafts have been published and it is being finalised, but do not wait for it to name a vendor — it will not. It describes families of techniques — metadata, watermarking, fingerprinting — and expects you to combine them competently. The real decision is which techniques, in which layers, against which pipeline.

C2PA: credentials that travel with the file, until they don’t

C2PA — the Coalition for Content Provenance and Authenticity, whose consumer face is Content Credentials — is a metadata standard. It attaches a cryptographically signed manifest to the media: who generated it, with what tool, and what was done to it. The signature is a hard binding — tamper with the pixels and the hash no longer matches, so the credential is verifiable and its absence or breakage is itself informative.

The weakness is obvious to anyone who has watched a file move through the internet. Manifests live in metadata, and metadata is routinely stripped — by a platform that re-encodes on upload, by a screenshot, by a messaging app that recompresses. A credential that a social platform discards on ingest has failed the obligation, because the obligation is that the mark be detectable downstream, not that it existed at the moment of export.

The answer C2PA now reaches for is Durable Content Credentials: store a copy of the manifest in a database, then bind it back to the media with a soft binding — an invisible watermark or a content fingerprint — that acts as a recovery key. If the metadata is stripped, a verifier recovers the watermark or fingerprint, looks up the manifest, and restores provenance. The specification is explicit that combining a watermark and a fingerprint is more robust than either alone, and that only approved algorithms qualify. That is more moving parts than most teams assume when they hear “just add C2PA.”

SynthID and the watermarks that live in the content

SynthID, from Google DeepMind, sits in the other layer. Rather than attaching metadata, it embeds an imperceptible watermark into the generated content itself — across text, image, audio and video — by nudging the model’s output at generation time. Because the signal is in the pixels, tokens or samples, it survives some transformations that destroy metadata: cropping, mild compression, minor edits, and for text, modest paraphrasing.

It is not a universal solution, and its makers do not claim it is. For text, confidence degrades sharply under thorough rewriting or translation, and it works less well on short, factual outputs where there is little room to shift the token distribution. More to the point for a compliance architect: SynthID is applied at generation by the model provider and detected with the provider’s tooling. You cannot use it to mark content produced by a model you do not control, and detection is not a neutral, cross-vendor utility.

The interoperability problem, stated plainly

Here is the trap. C2PA and SynthID are not competitors you choose between; they occupy different layers and fail in different ways. C2PA gives you a rich, signed, human-and-machine-readable credential that a careless platform can strip. An in-content watermark survives more of the journey but carries far less information and, today, is largely tied to the vendor that embedded it and the vendor that detects it. There is no single mark that is at once information-rich, transformation-robust, cross-vendor and readable by an arbitrary third party. The Act asks for interoperable and robust marking; the technology delivers those two properties in different tools.

So the compliant posture is not to pick a winner. It is to layer deliberately: a C2PA manifest for the signed provenance record, an approved watermark and fingerprint as soft bindings so the manifest can be recovered after stripping, and, where your generator supports it, an in-content watermark as a further fallback. Then — and this is the part teams skip — test durability against your actual distribution path, not a lab. Export the file, push it through the platforms your content really travels on, screenshot it, recompress it, and see which marks a verifier can still read at the other end.

Embedding and verifying the provenance layer

The C2PA layer is the most tractable to stand up first, because open tooling exists. The snippet below uses Adobe’s open-source c2patool to embed a signed manifest that declares the media as trained-algorithmic (generative AI) output, then reads it back. The IPTC digital source type is the field a verifier keys on to know the content is synthetic.

# manifest.json — declares the media as generative-AI output
{
  "claim_generator": "acme_studio/1.4 c2pa-rs/0.40",
  "assertions": [
    {
      "label": "c2pa.actions.v2",
      "data": {
        "actions": [
          {
            "action": "c2pa.created",
            "digitalSourceType":
              "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
            "softwareAgent": { "name": "Acme Diffusion", "version": "3.2" }
          }
        ]
      }
    }
  ]
}

# Embed the signed manifest into the generated image.
# -m manifest, -o output; --force overwrites an existing output file.
# Signing key and certificate are referenced from the manifest or environment.
c2patool render_0007.png -m manifest.json -o signed_0007.png --force

# Read the credential back and confirm the synthetic declaration survived.
# Inspect the c2pa.actions assertion for digitalSourceType before you ship.
c2patool signed_0007.png

Two cautions. First, the signing certificate matters: a manifest signed with a certificate no verifier trusts reads as unverified, which is not the same as marked. Second, embedding the manifest is the easy half. The durability — the watermark and fingerprint that let this manifest be recovered after a platform strips the metadata — is the half that decides whether the mark survives distribution, and it depends on the approved algorithms your pipeline adopts.

What to do before December

The Digital Omnibus bought a few months, not a reprieve, and as with the high-risk deadline shifts, the sensible firms are treating the deferral as time to build rather than time to wait. If your product emits synthetic media at any scale, the work is concrete: inventory every generator and output media type, map the real distribution path for each, choose the marking layers per type, and instrument a durability test that runs on export. What the Omnibus moved and what it did not is set out in our note on the deferrals.

The obligation is not satisfied by the mark you embed. It is satisfied by the mark a supervisor, or a verifier, can still read once your content has been screenshotted, recompressed and reposted. If you have only tested the first, you have tested the wrong thing.