New: try each tool in your browser, no account needed. Then one API key with 3 free tries of every API. Get your key →
OpenCorpo

Mark AI-generated images for EU AI Act Article 50

The EU AI Act requires AI-generated images to be marked in a machine-readable way. One API call adds a signed C2PA manifest, an invisible watermark and a perceptual fingerprint, and another checks any image for all three.

Try it free: sign an AI image or check one

3 free runs · no accountSign up free

Want it in your own app? A free account gives you an API key and 3 more free tries, then pay per use from €0.002 per image. No subscription, no card to start.

Create a free account →

Limits are enforced by the API, protected by Cloudflare Turnstile. Uploads and results are deleted within 24 hours. See the privacy policy.
  • Three independent layers, because each one can be lost on its own
  • Verify any image, including Content Credentials from other signers
  • €0.01 per image to sign, €0.002 per image to verify, no subscription

The problem

Do AI images need a watermark under the EU AI Act?

If you provide a system that generates images, yes: Article 50(2) requires the outputs to be marked in a machine-readable format and detectable as AI-generated. It applies from 2 August 2026, and from 2 December 2026 for generative systems already on the market before that. Breaches can be fined up to €15 million or 3% of worldwide annual turnover. The hard part is making a mark that survives.

Platforms strip metadata

Upload an image to many social networks or CMSs and the C2PA manifest is gone. Metadata alone is not robust.

Recompression erases watermarks

Invisible watermarks survive metadata stripping, but heavy JPEG recompression and resizing can wash them out.

You may have to prove it later

When a copy surfaces months later with every mark removed, you still need to show it came from your system.

Dates, scope and what the Code of Practice expects: Article 50 marking after the AI Omnibus.

How it works

Three layers in one call, checked in another

POST /v1/compliance/sign applies all three layers and returns a PNG (JPEG re-encoding would destroy the watermark). POST /v1/compliance/verify reports which layers any image still carries.

1. C2PA manifest

A signed record that the image is AI-generated, with the model, your organization and the time. The open standard behind Content Credentials.

2. Invisible watermark

An identifier hidden in the pixels, so it survives when platforms strip metadata. Heavy recompression can erase it, which is what the third layer is for.

3. Perceptual fingerprint

A fingerprint of what the image looks like, kept in a registry. Resized and recompressed copies still match.

  1. Send the image

    Right after generation: the file, the model that made it and your organization.

  2. Publish the signed PNG

    Visually identical. Keep the asset id the response gives you.

  3. Verify any copy

    Months later, check a copy you found: which layers survived, and whether it matches your registry.

Real output

One AI image, checked three times

We generated a product photo with Gemini (gemini-3.1-flash-image), signed it with the API, then re-saved the signed copy the way a social network would. These are the verify results, unedited.

AI-generated product photo of a sage green mug next to a succulent, after signing: it looks exactly the same
  • C2PA manifest
  • Invisible watermark
  • Fingerprint
A real image generated with Gemini and signed with this API. The marks are invisible.

As generated

The JPEG straight from Gemini. Google's own C2PA manifest is already in it.

  • C2PA manifest: found.Signed by Google LLC
  • Invisible watermark: not found.Not found
  • Fingerprint: not found.No match in the registry

Some layers found

After signing

The PNG returned by POST /v1/compliance/sign.

  • C2PA manifest: found.Signed by OpenCorpo
  • Invisible watermark: found.OpenCorpo watermark detected in the pixels
  • Fingerprint: found.Matches an image signed with OpenCorpo

All three layers found

After a social-media style re-upload

The signed image resized to 1000 px wide and re-saved as JPEG at quality 80.

  • C2PA manifest: not found.Not found (metadata stripped)
  • Invisible watermark: not found.Not found
  • Fingerprint: found.Matches an image signed with OpenCorpo

Some layers found

After the re-upload, the manifest and the watermark are gone, and the fingerprint still proves where the image came from. That is the point of using three layers.

Who it is for

Anyone who puts AI images into the world

Image generator providers

If your product generates images for users, with your own model or an API, Article 50(2) makes marking your job. Sign every output before you return it.

Apps built on image models

Wrapping an image API in your product? Mark outputs where you deliver them, with your organization in the manifest.

E-commerce and marketing teams

Publishing AI product shots, ads or illustrations? Sign them once and keep a registry of what you made.

Trust and safety, newsrooms

Check incoming images for Content Credentials from any signer, and for OpenCorpo marks.

For developers

Sign and verify in a few lines

Plain REST with one API key. Full reference in the API docs; a step-by-step guide in adding C2PA Content Credentials to AI images.

# Sign an AI-generated image: C2PA manifest + invisible watermark + fingerprint
curl -X POST https://api.opencorpo.com/v1/compliance/sign \
  -H "X-API-Key: $OPENCORPO_API_KEY" \
  -F "file=@product-shot.jpg" \
  -F "generator=gemini-3.1-flash-image" \
  -F "organization=Acme Shop"

# Verify any image: which of the three layers are still there?
curl -X POST https://api.opencorpo.com/v1/compliance/verify \
  -H "X-API-Key: $OPENCORPO_API_KEY" \
  -F "file=@copy-found-online.jpg"

MCP server

Use it from Claude or ChatGPT

A C2PA MCP server: your assistant or agent signs AI images for EU AI Act Article 50 before they are published, and checks any image for Content Credentials. The same account, free tries and balance as the API, in Claude, ChatGPT, Claude Code, Cursor and VS Code.

  • One URL: https://api.opencorpo.com/mcp
  • Tools: sign_image, verify_image
  • Sign in once with your OpenCorpo account. Disconnect any app at any time.
Set it up in a minute

Ask, for example

  • Mark this AI image for the EU AI Act before I publish it: https://…/banner.png
  • Was this image marked as AI-generated? https://…/photo.jpg

Pricing

Pay per image. No subscription.

Prices, charged per use to a prepaid balance
OperationPrice
Free tries with an account3 free
Sign an image (C2PA + watermark + fingerprint)€0.01 / image
Verify an image€0.002 / image

What that comes to

  • 1,000 images signed€10.00
  • 10,000 images signed€100.00
  • 1,000 images verified€2.00
  • 10,000 images verified€20.00
  • 3 free tries per account, then each call is charged to a prepaid balance you top up by card.
  • Failed requests are never charged. If your balance cannot cover a call, the API answers 402 and charges nothing.
  • The same key and balance work for the Video and Metadata APIs.
Create your free account →

Every API on the pricing page. Prices exclude VAT where applicable.

FAQ

Questions about AI image marking

Does the EU AI Act require AI-generated images to be watermarked?

Article 50(2) requires providers of AI systems that generate images, audio, video or text to make sure the outputs are marked in a machine-readable format and detectable as artificially generated, with solutions that are effective, interoperable, robust and reliable as far as technically feasible. It applies from 2 August 2026; generative systems already on the market before that date have until 2 December 2026. The Act does not prescribe one technique, and the Code of Practice on marking AI-generated content favours combining several, such as signed metadata and watermarks.

Is a visible “AI-generated” label enough?

Not for Article 50(2): that marking has to be machine-readable. A visible label is how deployers disclose deepfakes under Article 50(4), which is a separate duty. Many teams need both: the label for people, the marking for machines.

What are C2PA and Content Credentials?

C2PA is the open standard behind Content Credentials: a cryptographically signed manifest inside the file that records that it was made by AI, with which model, for which organization and when. Adobe, Microsoft, Google and OpenAI already attach C2PA manifests to images their tools generate. OpenCorpo adds one signed with its certificate, alongside a watermark and a fingerprint.

Does the marking survive social media, resizing and recompression?

Not every layer, which is why there are three. Many platforms strip metadata, so the C2PA manifest is lost. Heavy JPEG recompression can erase the invisible watermark. The perceptual fingerprint is computed from what the image looks like, so resized and recompressed copies still match the registry, as in the example on this page. A tight crop or a heavy edit may not match.

Why does another verifier show the signer as untrusted?

Manifests are signed with OpenCorpo's own certificate. Until that certificate is on the C2PA trust list, independent verifiers read and validate the manifest but report the signer as not yet recognised (signingCredential.untrusted). The manifest's contents and integrity are still checked.

Can I verify images that someone else signed?

Yes. Verify reads any C2PA manifest from any signer (for example Google's on Gemini images), looks for an OpenCorpo watermark in the pixels, and checks the OpenCorpo fingerprint registry. A matching asset id is only returned for images in your own account.

Do you keep my images?

Images you sign are stored so you can download them again, until you ask us to delete them; verify does not store the image it checks. Images used in the free demo on this page are deleted within 24 hours.

How much does it cost?

Signing costs €0.01 per image and verifying €0.002 per image, charged to a prepaid balance with no subscription. Every account starts with 3 free tries, and the demo on this page needs no account at all.

Guides

Same key, same balance

Mark your AI images today

Create an account, get an API key in a minute and use 3 free tries. No card needed until you top up.

Get your free API key →Read the docs