EU AI Act: C2PA Workflows for AI Media in Practice

Note on the use of AI at TutKit.com: We have been using AI for a longer time to editorially optimize images and texts. Therefore, we label all our blog articles right at the beginning. The content continues to be reviewed, edited, and editorially controlled by us.

What actually applies since August 2026

The transparency obligations from Article 50 of the EU AI Act have been in effect since August 2, 2026. The commonly mentioned August 1 is the date when the regulation came into force in 2024. This distinction is important when informing customers or formulating internal policies.

Providers of generative AI systems must ensure that synthetically generated audio, image, video, and text content is identifiable as artificially generated or edited in a machine-readable format. For companies, agencies, and other professional users, disclosure obligations apply, particularly regarding deepfakes and certain texts that serve to inform the public.

Not every AI-supported isolation, noise reduction, or correction automatically qualifies as content requiring labeling as an AI work. Key factors include the nature and extent of the editing, the intended use, and the specific role of your company. There are also exceptions for journalistically or editorially reviewed texts if a natural or legal person assumes editorial responsibility.

The EU AI Act does not explicitly require C2PA or a visible watermark. However, C2PA is a practical technical standard for comprehensively documenting origin, editing steps, and tools used.

What C2PA metadata can achieve – and what it cannot

C2PA stands for Coalition for Content Provenance and Authenticity. The standard stores signed provenance information in so-called manifests. These can document, for example, which application was used to export a file, whether generative functions were involved, and which organization signed the details.

This gives customers more than a standard IPTC field. A valid signature makes subsequent changes to the manifest detectable. Nevertheless, Content Credentials do not automatically prove authorship or ownership of all usage rights. The legal permissibility of a motive, brand, or depicted person is also not verified.

Furthermore, there is a practical problem: Some platforms, messengers, image optimizers, and content management systems remove metadata upon upload. Therefore, the original proof should also be kept in the project archive. C2PA is a building block of documentation but is not a substitute for contracts, model releases, licensing documents, and a traceable release.

A sensible workflow for Photoshop and Lightroom

In Adobe Photoshop, Content Credentials – depending on program version, region, and account settings – can be activated for supported files and attached during export or stored in the cloud. Do not check the function just before submission, but on a test file.

A typical workflow for a campaign motif could look like this:

1. Store the unedited capture and the license document in the project folder.
2. Document generative extensions, retouches, and replaced image areas.
3. Activate available Content Credentials before final export.
4. Export the client version with the agreed color profile.
5. Check the exported file with an appropriate C2PA verification tool.
6. Keep the original file, final version, and release together.

In Lightroom and Lightroom Classic, direct support also depends on the version being used and the export method. If the installation does not produce suitable Content Credentials, you can initially export the selection normally and then sign the final file in a supported application. It is essential that your batch processing does not alter file names, IPTC details, and assignments.

An automated export preset saves work but should not be used blindly. After updates, check at random whether the manifest, copyright information, contact details, and color space remain intact.