EU AI Act Article 50 — content-marking durability evidence
Article 50 requires providers of generative AI to mark AI-generated content so it is detectable. The endorsed technical rail is C2PA content credentials. We measured whether that marking actually survives ordinary handling — re-encoding, resizing, cropping, screenshots, format conversion.
The measurement and its signature were produced on an independent compute node. This page re-checks the signature in your browser against the published public key — nothing here depends on trusting CSOAI's server.
The finding
✅ signature valid · unalteredPlain English: the marking Article 50 relies on mostly does not survive the things people do to images every day. A provider cannot assume an embedded credential proves provenance downstream — which is exactly what an “adequate alternative means” gap analysis must document.
Survival by check
| Check | Survived | Rate | 95% CI (clustered) |
|---|---|---|---|
| manifest_present | 0/108 | 0% | [0.0, 24.3]% |
| digital_source_type | 0/108 | 0% | [0.0, 24.3]% |
| signature_valid | 0/108 | 0% | [0.0, 24.3]% |
| binding_intact | 0/108 | 0% | [0.0, 24.3]% |
| issuer_resolvable | 0/108 | 0% | [0.0, 24.3]% |
| Check | Survived | Rate | 95% CI (clustered) |
|---|---|---|---|
| manifest_present | 108/108 | 100% | [75.8, 100.0]% |
| digital_source_type | 108/108 | 100% | [75.8, 100.0]% |
| signature_valid | 108/108 | 100% | [75.8, 100.0]% |
| binding_intact | 0/108 | 0% | [0.0, 24.3]% |
| issuer_resolvable | 0/108 | 0% | [0.0, 24.3]% |
Machine-readable evidence
OSCAL is NIST's machine-readable compliance language (accepted in FedRAMP deliverables). Per FedRAMP RFC-0024, OSCAL does not itself mandate cryptographic signatures — this pack ships the Ed25519 signature inside the envelope, closing that gap.
Verify it yourself
Signatures above are checked in your browser (WebCrypto Ed25519). To verify offline:
python3 sign.py --verify provbench.json
ZnF3DZUFc5QOoy+y07rvzNUyxJgza2kUQmn1nv4S9SY=5e2d715348204bdf18f44fd034459a11bbc36325ba310c1171a0f29ff3e1e04aWhat is proven: the artifacts are unaltered and were signed by the holder of the published key; the survival rates are recomputed from the exact signed bytes.
What is not (yet) proven here: that the signing key belongs to CSOAI as a legal identity — that is a separate identity-binding step (a published key page and, per the roadmap, an SSL.com / C2PA conformance certificate). This page proves integrity, not attributed identity.
CSOAI is an independent measurement body. We issue measurements and signed attestations, never certificates of conformity. This evidence supports an Article 50 “adequate alternative means” case; it is not legal advice.