What Just Changed in Europe?
On August 2, 2026, the European Commission's AI Office began enforcing the transparency obligations under Article 50 of the groundbreaking EU AI Act. These rules apply to any company whose AI-powered services or content are used within the EU, regardless
of where the company is based. In essence, if you interact with a chatbot, it must disclose that it's an AI. More significantly, providers of generative AI systems must ensure their outputs—images, audio, video, and text—are marked in a machine-readable format so they can be detected as AI-generated. Deployers of deepfakes must also clearly label them as artificial. The goal is to reduce deception and allow people to make informed choices, with non-compliance carrying hefty fines of up to €15 million or 3% of global turnover.
The Limits of a Simple Label
While a positive step, the EU’s framework primarily relies on disclosure and watermarking. This creates a false sense of security. A visible label stating "Made with AI" can be easily cropped out. An audible disclosure can be clipped. Even more robust machine-readable watermarks are not foolproof; they can be degraded or removed through compression, re-encoding, or other common file manipulations. The rules set a new global baseline, but they treat the symptom—undisclosed AI content—rather than the root cause: the lack of a verifiable chain of custody for digital media. A determined bad actor will not be stopped by a rule that requires them to self-identify their manipulated content. The real battle for trust requires a more fundamental solution.
Enter Cryptographic Source Verification
This is where source verification, or content provenance, becomes essential. Technologies like the C2PA (Coalition for Content Provenance and Authenticity) standard offer a different approach. Instead of just labeling something as AI-generated, C2PA attaches a tamper-evident manifest to a piece of content, cryptographically signed by its creator. This manifest acts like a digital birth certificate, recording who or what created the file, with what tools, and any subsequent edits. It’s not about declaring content “real” or “fake”; a deepfake could have a valid C2PA credential stating it was made with an AI tool. Rather, it provides a verifiable history, allowing a user to trace the content back to its source and see how it has been altered. This is a crucial distinction from simple watermarking, which often doesn't survive basic editing.
Why This Is a Non-Negotiable Next Step
In an information ecosystem flooded with sophisticated synthetic media, trust is the most valuable commodity. Source verification provides the technical foundation for that trust. For news organisations, it’s a way to prove their images and videos are authentic. For businesses, it protects brand identity from being hijacked by deepfakes. For creators, it secures intellectual property. The EU’s transparency rules are the floor, not the ceiling. They establish that disclosure is necessary, but they don't solve the harder problem of how to make that disclosure trustworthy and resilient. Adopting cryptographic provenance standards like C2PA is the logical and necessary next step to build a system where the authenticity of content is a verifiable attribute, not just a matter of faith.
The Ripple Effect for India
The EU AI Act's extraterritorial reach means this is not a distant European affair. Indian IT, SaaS, and BPO companies with clients in the EU must now ensure their AI systems are compliant with these new transparency rules. NASSCOM has estimated that over 1,200 Indian IT firms have EU clients potentially affected. This regulatory push from the world’s largest single market will inevitably create a new global standard. The conversation in India must therefore shift from basic compliance to strategic advantage. By leading in the adoption and development of robust source verification technologies, Indian firms can position themselves not just as compliant vendors, but as global leaders in building the infrastructure for a more trustworthy digital age. This regulation is an opportunity to get ahead of the curve, transforming a compliance burden into a competitive edge.
