Two-Layer Marking Under Article 50
C2PA + invisible watermark — technical deep-dive

The second draft of the EU Code of Practice on AI-Generated Content (published 3 March 2026) requires at least two active layers of machine-readable marking. The preferred combination is: (1) secure provenance metadata (C2PA Content Credentials v2.3 or equivalent), and (2) an imperceptible watermark embedded at the model output layer. Perceptual fingerprinting is accepted as a fallback when imperceptible watermarking is not technically feasible (e.g., certain text-only deployments). The final Code of Practice (expected June 2026) may harden this requirement.

C2PA uses a W3C Verifiable Credential structure signed with a X.509 certificate issued by a C2PA-registered Certification Authority such as DigiCert. The manifest lives in the file's XMP metadata (images) or ISOBMFF box (video). The signed claim includes the issuer identity (your organisation), the generation timestamp, the model identifier, input parameters, and a cryptographic hash of the output payload. The manifest can be verified by any C2PA-compliant client (Adobe Content Authenticity, Google Chrome, Microsoft Edge) without phoning home. Our kit provisions the DigiCert C2PA cert and integrates the signing pipeline into your model serving infrastructure.

No measurable quality degradation. The SynthID-class watermark operates by perturbing pixel values below the human visual threshold (typically ±1-2 bits per channel in high-entropy regions). In double-blind tests, annotators cannot distinguish watermarked from non-watermarked images above chance. The PSNR delta is <0.3 dB from the original. The watermark is embedded at the model output layer during inference — it is not a post-hoc overlay — so it cannot be removed without fundamentally altering the content.

The C2PA metadata does not survive screenshots (metadata is stripped). The invisible watermark survives screenshots, JPEG recompression, minor crops (≥70% remaining), and resolution downscaling (≥512px shortest side). The perceptual fingerprint survives severe transformations — screen-recording, WhatsApp compress, Twitter re-encode, even print-and-scan — because it operates on content features rather than exact pixels. This is exactly why the three-layer design exists: each layer covers the gaps the others leave.

Text watermarking is an active research area. Two approaches are used: (1) syntactic watermarking — replacing tokens with semantically equivalent alternatives based on a secret random seed (e.g., 'big' → 'large', 'showed' → 'demonstrated') at inference time; (2) logit-based watermarking — biasing the language model's token selection toward a green-listed subset of tokens, producing a detectable statistical signature. Neither is as robust as image watermarking, which is why the Code of Practice accepts deployer disclosure (visible label) for text where technical marking is not feasible. Our kit applies both where available and falls back to deployer disclosure workflow for pure-text pipelines.

Yes, if your team has deep expertise in C2PA certificate provisioning, XMP metadata injection, image perturbation theory, model-inference-layer patching, and perceptual hash engineering across four media types. The C2PA signing pipeline alone requires a DigiCert C2PA-specific certificate (≈£1,200/yr), the C2PA Rust SDK integration, and testing across 20+ platform round-trips. The invisible watermark requires modifying the model's decoder head or VAE decoder. Most teams spend 3-6 months and £30-60K in engineering time. The kit costs £999 and ships in 7 days. At £199/mo for Pro, we maintain the watermarks as models and codecs evolve.

We track every draft revision of the Code of Practice. If the final version (expected June 2026) alters specifications, the kit is updated at no additional cost to Pro and Enterprise subscribers (one-time buyers receive one major update within 90 days). Changes are likely to include: stricter minimum-resilience thresholds for watermarks, new media-type-specific marking requirements, and standardised attestation formats. The current architecture was built with the draft requirements in mind and has headroom for most expected final additions.