Article 50: what the audit export contains

What the export contains

• Scope. The project, the period, the declared role, and the counts the rest of the document is built from — including how many jobs were still running when the report was generated, so a reader is not left to discover that by re-running the range.
• Marking coverage. Per output asset, the facts Wakemark holds: custody status, the SHA-256, and the C2PA state in the four values described in Provenance.
• A gap report. Which outputs carry no verified mark, broken down by cause and by provider, with the asset ids enumerated so the list is actionable rather than a number.
• Provenance chains. Where a job took another asset as input, the chain across providers — the preservation question rather than the marking question.
• The honesty statements. The paragraphs below, carried inside the document itself rather than left to a footnote on a website.

What it deliberately does not attest

These four sentences travel in every export, in the document, where the person relying on it will read them:

• It is not a certification, an audit opinion, or legal advice.
• It does not establish compliance with the EU AI Act or any other law. The obligations under Article 50 remain the customer's own.
• It does not satisfy the machine-readable marking obligation (Article 50(2)). Wakemark's ledger is supplementary logging under the Code of Practice (Sub-measure 1.1.3) and is explicitly not sufficient on its own.
• Adherence to the Commission's Code of Practice on Transparency of AI-Generated Content does not constitute conclusive evidence of compliance, per the Code's own text.

The Sub-measure 1.1.3 constraint

Sections of the report map onto the Commission's Code of Practice on Transparency of AI-Generated Content: marking coverage and the gap report onto Measure 1.1 (machine-readable marking, as embedded by the generating providers), the provenance chains onto Measure 1.2 (preservation of marks across transformation), and the logging layer onto Sub-measure 1.1.3 — fingerprinting and logging against a registry, which the Code itself treats as supplementary only.

This is the constraint that keeps the whole document honest, so it is worth stating without softening: a complete, well-kept Wakemark ledger does not discharge the marking obligation. Marking is embedded by whoever ran the model. Wakemark's contribution is preserving those marks intact and keeping a record that can be checked — a supplement to marking, never a substitute for it.

The role is declared, never inferred

Whether Article 50 reaches you as a provider, a deployer, or both is a legal determination about your own business. Wakemark does not detect it, does not infer it, and does not default it: an export is refused outright if no role is supplied, nothing about your usage influences it, and the duty sections follow your declaration and inherit its accuracy.

What the counts mean

“Jobs covered” counts every generation request admitted in the period — succeeded, failed, cancelled and still running alike — because each one is a ledger fact. It is not a count of outputs: a failed job produces none, one job can produce several, and a job still running when the report was generated has none yet. That last group is counted separately, so the same period re-run later showing more assets against the same job count is expected rather than alarming.