A log is not a mark: what the EU's Code of Practice actually requires

The thing we are proudest of building is an append-only ledger — every provider call, every state change, every stored asset and its sha256, recorded when it happened and impossible to quietly revise. So it costs us something to write this sentence plainly: under the EU's final Code of Practice, a ledger, by itself, is not a mark. Our audit trail proves what happened. It does not, on its own, mark your content as AI-generated. Anyone in this market who tells you otherwise is selling you a false green tick.

The Code ranks three techniques. Ours is the optional one.

On 10 June 2026 the Commission published the final Code of Practice on Transparency of AI-Generated Content — the voluntary companion to Article 50's machine-readable marking duty. It is worth reading precisely, because it does something most compliance guidance avoids: it puts the marking techniques in a strict hierarchy, and it says out loud which one is not enough. Measure 1.1 lists three:

• Sub-measure 1.1.1 — digitally signed metadata. Record in the metadata that the content is AI-generated, then digitally sign and time-stamp it "in a secure and tamper-evident manner." This is the manifest layer — the category C2PA Content Credentials implements in the real world.
• Sub-measure 1.1.2 — imperceptible watermarking. A watermark "embedded within the content in a manner that is difficult for it to be separated," robust to the kind of re-compression, screenshotting, and cropping that Measure 3.3 enumerates.
• Sub-measure 1.1.3 — fingerprinting or logging (optional). Keep a record — a fingerprint or a log — that lets you check later whether a given asset came from your system. Supplementary. The Code marks it optional in its own heading.

And then, because no single technique satisfies all four of Article 50(2)'s requirements under the current state of the art, the Code requires at least two layers — and it names which two:

"Signatories will implement a multi-layered marking approach to ensure that the outputs of their generative AI systems are marked with at least two layers of machine-readable marking, as specified in Sub-measures 1.1.1 and 1.1.2."

Note the numbers. The two required layers are 1.1.1 and 1.1.2 — signed metadata and watermarking. Logging is 1.1.3, and it does not count toward the two. The Code is blunt about this in a way that regulatory documents rarely are:

Where Wakemark actually sits in that stack

We describe our provenance stance in four layers — preserve, detect, log, sign — and we are deliberate about which of them are real today:

Map that onto the Code honestly and the picture is unflattering in exactly one place. Our ledger plus the per-asset digest is a textbook 1.1.3 — the supplementary logging layer. It is genuinely good at what that layer is for: it is the record that lets you prove, months later, that a specific asset was produced by a specific model on a specific date and has not changed since, because the sha256 recorded at ingestion still matches the bytes. That is real evidence, and most pipelines cannot produce it.

But it is the layer the Code says is not sufficient on its own. Wakemark does not, today, sign a C2PA manifest of its own (1.1.1), and it does not embed an imperceptible watermark (1.1.2). We preserve a signed manifest a provider already embedded, we detect and read it, and we log everything around it. We do not mint the mark. Selling our ledger as if it discharged the marking duty would be the exact move this whole company exists to argue against.

Our audit trail proves what happened. It does not, by itself, mark your content. Those are different jobs, and the law now grades them separately.

So what actually marks your content?

The two required layers, done at or near generation:

• A signed manifest travelling with the file. If your model provider embeds Content Credentials, the 1.1.1 layer is already there when the output leaves the model — and your only job is to not destroy it. That is a custody problem, and it is the one Wakemark is built to solve: outputs stream into storage byte-exactly, so the manifest that was there at generation is still there at rest. Preserving a mark is not the same as making one — but a mark that gets stripped in transit protects no one.
• An imperceptible watermark surviving the lossy hops. Signed metadata dies the moment a file is re-encoded or screenshotted; the watermark is the second layer precisely because it can survive that. Today this comes from the model provider or a dedicated watermarking tool, not from us.

One more honesty note, because it reverses something we ourselves used to imply: the final Code does not name C2PA. The strings "C2PA" and "Content Credentials" appear nowhere in its 38 pages — it describes the technique generically as "digitally signed metadata" and points to "open standards." C2PA is the dominant real-world implementation of that technique, backed by a coalition that includes Adobe, Google, Microsoft, OpenAI, and the BBC, which is why we and everyone else reach for it. But "the Code names C2PA" is a claim you will read in a lot of posts, including two of our own older ones. It is wrong, and we have corrected them.

Why argue against our own convenience

Because in a market built on deepfakes, the honest verifier is the only one worth anything. The day we call a log a mark, or dress an absent manifest up as a pass, we stop being a proof layer and become another badge — and a badge that lies is worse than no badge, because someone relied on it. Our verification surface already says "I don't know" when it cannot check an invisible watermark, rather than faking a green tick. This is the same discipline pointed at ourselves.

And none of this is really about Europe. Article 50 is what made the marking duty dated, but a log that cannot mark, a mark that cannot survive transit, and a chain no single provider can see are problems that exist wherever synthetic media does. If the statute vanished tomorrow, the honest-provenance problem it named would still be sitting there. We are building for that, and telling you exactly which rung we are on while we do.