AI Image Metadata: What Is Inside the File

General information, not legal advice — and the caveat earns its place here, because the two obligations in this article sit on different parties. The EU AI Act splits synthetic-content transparency in two: Article 50(2) puts a marking duty on the provider of the generative system, and Article 50(4) puts a disclosure duty on whoever publishes the output. We are the provider. You are the deployer. Both became applicable on 2 August 2026.

The practical translation: making the file machine-readable is our job, saying so to your audience is yours, and neither substitutes for the other. That is the part most AI-labelling advice gets wrong. A perfectly marked file under an unlabelled post is still an unlabelled post — and a properly labelled post carrying a file whose metadata got stripped somewhere in the upload pipeline is fine for you and a problem for us.

Before writing a line of marking code we pulled five finished renders straight out of production storage — the raw stored object, not a re-encoded thumbnail, because a re-encode would have destroyed the exact thing we were measuring — and parsed them chunk by chunk. Files between 3.7 MB and 5.4 MB. Every one was a PNG containing precisely a header chunk, image data and an end marker. Parsed byte count equalled file size, so nothing was hiding in the gaps.

No C2PA manifest. No XMP. No EXIF. No IPTC. Not even a colour profile. That result is worth sitting with, because the industry's comfortable assumption runs the other way: that generators bake provenance in and that careless pipelines downstream strip it out. For these files there was nothing upstream to preserve. Preserving harder would have preserved nothing. If a marker was going to be in the bytes, it had to be ours.

That is not a claim about every generator on the market, and it may not stay true of any single one — encoders change without announcements. It is a measurement, on a date, on files people had paid real money for. The habit it produced is smaller than the finding: check the bytes rather than the marketing page, including ours.

Machine-readable sounds like it demands a cryptographic ceremony. At the interoperable floor that image tooling reads today it is a few hundred bytes of XMP — a small XML packet carrying two properties. Iptc4xmpExt:DigitalSourceType is set to the IPTC NewsCodes value trainedAlgorithmicMedia, the standard vocabulary term for content created by a generative model. xmp:CreatorTool names the tool in plain language, for the human who opens the file in an editor rather than the crawler that parses it.

Where the packet lives depends on the container, and both destinations are deliberately boring, spec-shaped places that readers already inspect. Marking runs at two points in our pipeline: once when provider bytes enter storage, so the object at rest is already marked and every surface that later signs a URL inherits it for free, and once again in the browser at the single download seam — which covers assets stored before that change and keeps the marker independent of the anti-detection toggle, because a user preference must not be able to switch a legal obligation off.

Content Credentials are the standard everyone names, and they are genuinely stronger: a cryptographically signed manifest is tamper-evident in a way a plain metadata packet is not. The cost is infrastructure — a certificate, a signing service, key custody, rotation — and Article 50(2) mandates an outcome rather than a technology: marking must be effective, interoperable, robust and reliable as far as is technically feasible. The Commission's transparency work deliberately blesses no single standard.

So the sequencing is the interoperable floor first, because it is what platforms and image pipelines read today and it is writable in a few hundred bytes on every path that hands out a file. Signed provenance layers on top of that later; it does not replace it. Anyone telling you a metadata packet and a signed manifest are alternatives is describing a procurement decision rather than a technical one — and an invisible watermark is a third instrument again, living in the pixels rather than the tags.

Now the honest limitation, stated plainly so nobody has to rediscover it in a panic: metadata is strippable, and ordinary internet behaviour strips it constantly. This is a property of every metadata-based scheme, C2PA included, not a weakness of this particular one.

All of which is why the visible layer is not optional. Provenance metadata is a hint for machines and a useful input to a platform's automatic labelling. It is not what your audience sees, and it is not what survives a stranger reposting your image. The bio statement and the platform's own AI toggle carry that weight, every time. How platform AI labels work covers the per-platform mechanics, and what to label in 2026 covers the regulatory shape around them.

The reverse temptation is worth naming too, because it circulates in creator forums: stripping metadata on purpose so a platform will not auto-label the post. It does not work the way people hope — classifiers read pixels, not tags — and the downside is asymmetric. An AI content label costs you nothing measurable. An account caught presenting synthetic content as real costs you the account.

You should not have to take a vendor's word for what is in a file. ExifTool answers it in one line: exiftool -DigitalSourceType yourfile.jpg either returns the trainedAlgorithmicMedia URI or returns nothing at all. If you want the fully qualified form, the namespace sits in ExifTool's XMP-iptcExt group. Dropping the flag entirely — plain exiftool yourfile.jpg — dumps everything present, which is the faster way to discover that a file carries no metadata whatsoever, the state most generator output arrives in.

For signed provenance specifically, the C2PA ecosystem publishes verification tooling that will show a manifest and its signer when one exists. One reading rule matters more than the tools: absence proves far less than presence. An unmarked file is not evidence that a human made it, only that nothing survived to the point where you happened to look.