If you are creating AI-generated images for commercial use in 2026, you are operating in a regulatory environment that did not exist 24 months ago. The EU AI Act is enforceable. C2PA Content Credentials are being adopted by every major platform. SynthID watermarks are embedded in every Google image. Disclosure requirements are tightening.
This is the production guide for what creators need to know: the 4 provenance systems, the watermark reality per model, the legal landscape (EU AI Act, US state laws, platform rules), the disclosure rules per use case, the operational workflow, and the pre-flight checklist before you publish a commercial AI image.
The 4 provenance systems creators need to understand
1. C2PA Content Credentials (the open standard)
The Coalition for Content Provenance and Authenticity (C2PA) is the open technical standard for cryptographic provenance. Adobe, Microsoft, Google, OpenAI, camera makers (Leica, Sony, Canon, Nikon), and news organizations (BBC, NYT) are members. The technical implementation is called Content Credentials.
How it works:
- A cryptographic manifest is attached to the image at creation or edit
- The manifest records: creator identity, creation timestamp, tools used, edit history
- The manifest is signed by the creating tool's certificate
- Anyone with a C2PA reader (built into Adobe apps, Microsoft Designer, and increasingly browsers) can verify the provenance
Adoption in 2026:
- Adobe Firefly: full C2PA support, every generated image has a Content Credentials manifest
- Microsoft Bing Image Creator / Designer: C2PA support
- OpenAI (DALL-E, GPT Image 2): C2PA support via the metadata
- Google (Imagen, Nano Banana 2): C2PA support + SynthID watermark
- Cameras (Leica M11-P, Sony A7 IV with firmware update): C2PA at capture
What it means for creators: if you generate with any major model, the image likely has a C2PA manifest attached. If you open the image in Photoshop, Lightroom, or a C2PA-aware viewer, the manifest shows "this was generated by [model] at [time]." Stripping the manifest is possible but degrades the image's authenticity signal.
2. SynthID (Google DeepMind's invisible watermark)
Google DeepMind's SynthID embeds an invisible watermark directly into the pixels of an AI-generated image. The watermark is imperceptible to humans but detectable by SynthID's tools.
How it works:
- The watermark is added at the moment of generation
- It survives common edits: cropping, filters, color grading, lossy compression, format conversion
- It is detected by Google's verification tools and (increasingly) third-party tools
- It works across image, audio, text, and video
Where it appears:
- Google Gemini / Nano Banana 2: SynthID embedded in every generated image
- Google Imagen: SynthID embedded
- Google Veo (video): SynthID embedded
- Google Lyria (audio): SynthID embedded
- Vertex AI (enterprise): SynthID available
What it means for creators: every image generated through Google's consumer or enterprise products has an invisible SynthID watermark. The watermark is detectable. There is no "remove the SynthID" workflow that survives detection. If you publish a SynthID-watermarked image and someone runs a verification tool, they will know it was AI-generated.
3. OpenAI provenance metadata
OpenAI attaches C2PA-compliant provenance metadata to every image generated by DALL-E 3, GPT Image 1.5, and GPT Image 2. The metadata includes the model, the timestamp, and the API call ID.
What it means for creators: the metadata is in the file's EXIF and XMP fields. Most image viewers do not show it, but verification tools can read it. Stripping the metadata is possible (export to JPG without metadata, take a screenshot) but degrades the provenance signal.
4. Platform-level AI labels (Meta, TikTok, YouTube, etc.)
Major platforms now label AI-generated content at the upload / distribution layer:
- Meta (Facebook, Instagram, Threads): labels AI-generated content automatically if detected; users must self-disclose AI content
- TikTok: requires disclosure of AI-generated content; labels it in the UI
- YouTube: requires disclosure of "realistic" AI-generated content; labels it in the player
- X (Twitter): community-notes system flags suspected AI content
- LinkedIn: AI-generated content policy under development
What it means for creators: the platform's labeling system is independent of the model's provenance system. Even if you strip the metadata, the platform may auto-detect AI content via ML and label it.
The legal landscape in 2026
EU AI Act (enforceable since 2025-2026)
The EU AI Act is the world's first comprehensive AI law. Article 50 imposes specific transparency obligations on AI-generated content:
Article 50 obligations:
- Providers of AI systems that generate synthetic content (images, audio, video, text) must ensure their outputs are marked in a machine-readable format as artificially generated
- Deployers (people using the AI to create content) must inform users when content is AI-generated, unless the content has gone through substantial human editing
- The marking must be effective, interoperable, robust, and reliable — C2PA and SynthID both qualify
- Non-compliance: fines up to 15M EUR or 3% of global annual turnover
What it means in practice:
- If you generate with any major model, the image is marked (C2PA, SynthID, or both)
- If you publish the image as "AI-generated," you are compliant
- If you publish the image as "real" or "photographed" — and someone can detect the AI origin — you are in violation
- The "substantial human editing" exception is narrow: it requires significant creative transformation, not just cropping or color grading
EU AI Act Code of Practice on Transparency (March 2026 draft):
- The Code of Practice operationalizes Article 50
- It requires deployers to disclose AI origin to end users "in a clear and distinguishable manner"
- It does not specify a UI pattern (label, badge, caption) — only that the disclosure must be visible
- The Code is open for stakeholder feedback; final version expected late 2026
US legal landscape (state-level)
There is no federal US AI law as of 2026, but state-level laws are active:
- California AB 2013 / SB 942 (2024-2026): requires AI providers to offer free AI detection tools; requires large platforms to label AI content
- New York (proposed): requires disclosure on AI-generated political and electoral content
- Texas (TRAIGA): requires disclosure on deepfakes
- Tennessee (ELVIS Act): protects voice and likeness from AI replication
- Other states: Colorado, Illinois, Washington have AI-related laws touching disclosure
What it means in practice: if you operate in the US, you are subject to a patchwork of state laws. The safe default is to disclose AI generation, regardless of jurisdiction.
UK and other jurisdictions
- UK: no comprehensive AI law, but the Online Safety Act covers AI-generated harmful content
- Canada: AIDA (Artificial Intelligence and Data Act) under development
- Australia: industry codes under development
- Japan: light-touch approach, AI promotion-oriented
- China: deep synthesis regulations require AI-generated content to be labeled
The disclosure rules by use case
The disclosure requirement is not uniform. Different use cases have different rules.
Commercial product photography (Amazon, Shopify, Etsy)
Current state: No explicit "AI disclosure" required for product photos on Amazon/Shopify/Etsy as of 2026. Amazon has rules about misleading imagery but not AI-specific disclosure.
Best practice: Disclose AI generation in the product description if the product photo is significantly AI-generated. Maintain a C2PA manifest or SynthID watermark for authenticity.
Risk level: Low. The platforms do not (yet) require AI disclosure for product images. The risk is reputational if customers find out the photo is AI and were told it was real.
Social media content (Instagram, TikTok, X)
Current state: Platforms require self-disclosure of "realistic" AI content (TikTok, YouTube). The platforms auto-detect and label suspected AI content.
Best practice: Use the platform's built-in AI label when uploading. If the platform does not have a built-in label, disclose in the caption ("AI-generated image").
Risk level: Medium. Platform rules are enforced; non-compliance can result in content removal or account restriction.
Editorial / news / journalism (NYT, BBC, etc.)
Current state: News organizations have strict AI disclosure policies. Most require AI-generated images to be clearly labeled in the caption and metadata.
Best practice: Always disclose. Use the image's C2PA manifest as part of the editorial workflow. Never publish an AI-generated image as a "real" photograph.
Risk level: High. Reputational damage from undisclosed AI imagery is severe in journalism.
Marketing / advertising (paid social, display ads)
Current state: EU AI Act requires disclosure. US patchwork requires disclosure in some states. Most ad platforms have disclosure requirements for AI content.
Best practice: Disclose AI generation in the ad creative ("AI-generated visualization"). Maintain C2PA manifest. Use SynthID-aware workflows.
Risk level: Medium-high in EU, medium in US. Fines for non-compliance under EU AI Act are significant.
Fine art / portfolio / personal work
Current state: No legal requirement, but ethical norms are tightening. Galleries and collectors increasingly expect disclosure.
Best practice: Disclose AI generation. Include the model used in the metadata.
Risk level: Low legal, medium reputational.
Stock photography (Shutterstock, Adobe Stock, Getty)
Current state: Adobe Stock and Shutterstock accept AI-generated submissions but require:
- AI disclosure in the submission
- C2PA manifest attached
- No "real photograph" claims
- Models must be in the approved AI submission list
Best practice: Submit only on platforms that allow AI content. Always disclose. Never claim "real photograph."
Risk level: Medium. Platforms may remove or refuse submissions that are misrepresented.
The watermark reality per model (2026)
| Model | SynthID | C2PA | Visible watermark | Notes |
|---|---|---|---|---|
| GPT Image 2 (OpenAI) | No | Yes | No | C2PA manifest in metadata; consumer products may add visible label |
| DALL-E 3 (OpenAI) | No | Yes | No | C2PA manifest in metadata |
| Nano Banana 2 (Google) | Yes | Yes | Sometimes (Gemini app) | SynthID embedded; visible sparkle in consumer app, not in API |
| Imagen 4 (Google) | Yes | Yes | Sometimes | SynthID embedded |
| Seedream 5.0 Lite (ByteDance) | No | Limited | No | Provenance metadata limited; check per endpoint |
| Grok Imagine (xAI) | No | Limited | Sometimes | xAI has not committed to C2PA at full scale |
| Midjourney v7 | No | Yes (recent update) | No | C2PA manifest added in 2026 |
| Ideogram V3 / V4 | No | Limited | No | Limited provenance support |
| Flux (Black Forest Labs) | No | Limited | No | Limited provenance support |
| Stable Diffusion (open source) | No | No | No | User responsibility; no built-in provenance |
The takeaway: Google models have SynthID. OpenAI, Midjourney, and most others have C2PA. Open-source models (Stable Diffusion, Flux) have no built-in provenance. If provenance matters for your use case, generate with a model that has it.
The operational workflow for commercial AI imagery
Step 1: Generate with a provenance-aware model. Use GPT Image 2, Nano Banana 2, Midjourney v7, or another model with C2PA / SynthID. Avoid open-source models for commercial work unless you add provenance yourself.
Step 2: Maintain the metadata. Do not strip the EXIF / XMP / C2PA manifest when exporting. Save the original generated file separately from any post-processed version.
Step 3: Document the workflow. Keep a record of: the model used, the prompt, the date, any post-processing applied. This is your provenance trail.
Step 4: Apply post-processing carefully. Heavy cropping, filters, or compositing may weaken the SynthID signal. Test the post-processed image with a SynthID verifier if provenance matters for the use case.
Step 5: Disclose appropriately. Add the disclosure required by the use case (caption, label, metadata, etc.).
Step 6: Store the original. Keep the original AI-generated file with its full metadata. If provenance is ever questioned, the original file is the source of truth.
The platform-specific disclosure patterns
| Platform | Disclosure pattern | Auto-detection? | Notes |
|---|---|---|---|
| Amazon | None required (yet) | Limited | EU AI Act may require disclosure on Amazon EU in 2026-2027 |
| Shopify | None required (yet) | Limited | Same as Amazon |
| Etsy | None required (yet) | Limited | Seller may disclose voluntarily |
| Built-in "AI-generated" label when uploading | Yes (Meta AI) | Use the platform label; do not strip | |
| TikTok | Required disclosure toggle | Yes | Toggle "AI-generated content" when uploading |
| YouTube | Required disclosure for "realistic" content | Yes | Use the "Altered or synthetic content" checkbox |
| X (Twitter) | Community notes | Limited | Self-disclose in the post |
| Under development | Limited | Self-disclose in the post | |
| Built-in label | Yes | Use the platform label | |
| None required | Limited | Self-disclose in the pin description | |
| Adobe Stock | Required on submission | Yes | C2PA manifest required |
The EU AI Act compliance checklist
If you operate in the EU (or sell to EU customers), verify:
- The AI image is marked in a machine-readable format (C2PA manifest, SynthID, or both)
- Users are informed the content is AI-generated (label, caption, badge)
- The disclosure is "clear and distinguishable" (not buried in a footer or fine print)
- The original AI-generated file is preserved with full metadata
- Substantial human editing is documented if you claim the "human editing" exception
- The model used is recorded in the workflow documentation
- The disclosure language is appropriate for the audience (technical for technical products, plain for consumer products)
- Internal records of the AI generation are maintained for 6+ months (typical EU retention requirement)
The model pick by provenance requirement
| Provenance need | Use this model | Why |
|---|---|---|
| Maximum provenance (EU AI Act, journalism) | GPT Image 2 or Nano Banana 2 | C2PA + SynthID, both standards |
| Strong provenance (commercial) | GPT Image 2 or Midjourney v7 | C2PA support |
| Basic provenance (personal, low-risk) | Any C2PA-supporting model | Most modern models have it |
| No provenance needed (private, internal) | Any model | Pick on quality / cost / speed |
| Open source (maximum control) | Stable Diffusion + add C2PA yourself | You control the metadata |
The pre-flight checklist
Before you publish a commercial AI image:
- Provenance is attached (C2PA manifest, SynthID, or both — depending on the model)
- The original generated file is preserved with full metadata
- The model used is recorded in the workflow documentation
- The disclosure is appropriate for the platform and use case
- The disclosure is "clear and distinguishable" (visible to users, not buried)
- The post-processed version still passes provenance verification (if the use case requires it)
- The "substantial human editing" exception is documented if claimed
- The workflow is compliant with EU AI Act if selling to EU customers
- The platform's AI label is applied if the platform has one
- Legal review has been completed for high-stakes uses (advertising, journalism, financial services)
Skip any of these and you have a compliance, legal, or reputational risk.
The summary
In 2026, AI image generation is a regulated activity. The 4 provenance systems (C2PA, SynthID, OpenAI provenance, platform labels) are the technical layer. The EU AI Act, US state laws, and platform rules are the legal layer. The disclosure rules vary by use case.
- Use a provenance-aware model (GPT Image 2, Nano Banana 2, Midjourney v7). Stripping metadata is possible but degrades the authenticity signal.
- Maintain the metadata — save the original file with its full provenance.
- Document the workflow — model, prompt, date, post-processing.
- Disclose appropriately — by platform, by use case, by jurisdiction.
- Verify post-processed images still pass provenance checks.
- Stay current — the regulatory landscape is moving fast; what is optional in 2026 may be mandatory in 2027.
The model is not the compliance boundary. The disclosure, the metadata, and the workflow are. Treat provenance as part of the production pipeline, not an afterthought, and you are operating safely in the new regulatory environment.
