The Invisible Label Has Arrived. Text Is Still the Hole.

Europe’s rules for marking AI-generated content stopped being a future problem on August 2.

Article 50 of the EU AI Act now requires providers of systems that generate synthetic audio, images, video, or text to make those outputs detectable in a machine-readable format, where technically feasible. More than 180 organizations had signed the voluntary transparency code by the end of July, according to the European Commission.

The labs did not wait for one universal badge. They are assembling a stack. OpenAI now puts signed provenance metadata and Google’s SynthID watermark into supported generated images. The same approach has expanded to audio, with a verifier and API that can sit inside a newsroom or moderation pipeline. Google says SynthID has already marked more than 100 billion images and videos and 60,000 years of audio.

That sounds like the detection problem is close to solved. It is not. The stack works best where generated content has stable pixels or a waveform. Prose can keep its meaning while every token changes.

The provenance stack has three layers

The easiest way to understand the system is as a receipt, a scar, and a reader.

The receipt is C2PA metadata. A creator or editing tool signs a manifest that records what made an asset and what happened to it. Anyone can check whether that declared history was altered after signing. OpenAI became a C2PA Conforming Generator Product in May.

The receipt is rich, but detachable. A platform can strip metadata during an upload, a screenshot can discard it, and a copied fragment may never carry it in the first place.

The scar is an imperceptible watermark embedded in the content itself. It carries less information than a signed manifest, but may survive resizing, compression, cropping, or ordinary editing. OpenAI adds Google’s SynthID to supported images and audio so the content can retain a signal even when the receipt disappears.

The reader is a verification service. It checks the receipt, looks for the scar, and returns a result a person or another system can use. OpenAI previewed a public verifier in May and added verification API access in July. Google offers a SynthID verification flow in Gemini and an API to trusted partners.

Each layer covers another layer’s failure. That is good security design. It is also narrower than the marketing version of “AI detection.”

Provenance is not truth

A signed manifest can tell you that a particular tool generated or edited an image. It cannot tell you whether the scene is honest.

The C2PA specification is explicit about this boundary. Provenance supplies context for assessing an asset; it is not an oracle. A faithfully signed synthetic image is still synthetic. A camera image with intact credentials can still be staged. A true photo can arrive with no credentials at all.

Verification therefore produces useful positive evidence, not a binary verdict.

• Signal found: this tool probably participated, under the verifier’s stated conditions.
• Signal absent: origin remains unknown.
• Signature valid: the recorded history has not been altered since signing.
• Signature missing: no conclusion about whether the underlying event happened.

OpenAI warns that a failed check must not be read as proof that an asset is human-made. Provenance data can be stripped, and its verifier only recognizes supported OpenAI content.

That distinction matters the first time a moderator rejects a real submission or an employer accuses a writer from a detector score.

Text has fewer places to hide a mark

Google introduced SynthID for text in 2024. During generation, it nudges the probability of possible next tokens, creating a statistical pattern a detector can later test.

Google says the method works best in longer, varied writing. It may survive cropping, small word changes, and mild paraphrasing. Confidence can fall sharply after thorough rewriting or translation. Factual and highly constrained answers are harder because the model has fewer safe choices to alter.

This is not a bug that a larger database fixes. Images contain many pixel-level degrees of freedom that a person will never notice. Text is discrete, compressible, and easy to regenerate. A writer can preserve an argument while changing its statistical surface. A second model can do the same in seconds.

Short prose makes the problem worse. There may not be enough tokens to produce a strong signal without distorting the answer. The more precise the language must be—a quotation, an equation, a legal clause—the less room the generator has to move.

That leaves publishers with an uncomfortable split. Media provenance is becoming machine-operable. Prose provenance is still mostly a workflow problem.

What a publisher should build now

Do not wait for a universal AI detector. Add provenance to the content model.

For every submitted asset, preserve the original file. Validate C2PA credentials at ingestion. Record the signer, validation result, verification service, and timestamp. Keep a verifier’s “not found” result separate from “human-made.” Show available credentials to editors and readers without presenting them as proof of the depicted event.

For text, keep a different trail: author disclosure, source links, revision history, interview notes, and the editor who accepted responsibility. A disclosed AI-assisted draft with a strong source trail is more useful than a detector calling an undocumented draft 72 percent synthetic.

The first house rule can be one sentence:

Provenance present is evidence. Provenance absent is unknown.

The invisible label has arrived. The mature response is not to pretend it sees everything.

---

Source note: Scale and resilience figures above are company-reported. The EU AI Act sets transparency outcomes and technical-feasibility limits; it does not mandate C2PA, SynthID, or any single named technology.