EU AI Act · Article 50

AI provenance you can check.
Know what it does not prove.

Mark creates a signed record for an exact file. It can support your AI transparency workflow, but it is not an AI detector, a robust watermark, or a compliance certificate.

Read the source: EU AI Act Article 50(2)

What the law actually asks for

Article 50(2) requires providers of certain AI systems to mark synthetic outputs in a machine-readable format and make them detectable as artificially generated or manipulated. It calls for effective, interoperable, robust and reliable technical solutions, subject to the qualifications and exceptions in the regulation.

Mark offers a narrower capability: a signed receipt linking a fingerprint to an account, with daily batch anchoring. A verifier can compare the original file's exact bytes to that record. A public record does not independently establish whether the file was AI-generated.

Use it alongside your generation records and appropriate machine-readable and human-readable disclosures. A copied badge, a link, or a provenance receipt alone is not a guarantee that your disclosure meets the law.

Exact bytes matter. An unchanged re-upload can still match, but a screenshot, re-encoding, edit or transcription produces a different fingerprint. Mark does not make its label survive those transformations. This guide is not legal advice.

Working code: keep an exact-file provenance record

Hash the final bytes locally. Stamp them. Keep the receipt beside the unchanged file, rather than modifying the bytes you just stamped.

eu-ai-act-label.mjs
import { createHash } from "node:crypto"
import { writeFileSync } from "node:fs"

// 1. Finalize the output, including your own AI disclosure.
const aiOutput = { text: "AI-generated summary here…", aiGenerated: true }

// 2. Keep and hash exactly the same bytes. Nothing is uploaded.
const contentBytes = new TextEncoder().encode(JSON.stringify(aiOutput))
writeFileSync("output.json", contentBytes)
const hash = createHash("sha256").update(contentBytes).digest("hex")

// 3. Stamp it. One API call.
const res = await fetch("https://makemark.io/proof", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    "authorization": "Bearer pk_your_api_key",
  },
  body: JSON.stringify({
    contentHash: hash,
    contentType: "application/json",
    visibility: "public",
  }),
})
if (!res.ok) throw new Error(await res.text())
const receipt = await res.json()

// 4. Save separately so output.json still matches its fingerprint.
writeFileSync("output.mark.json", JSON.stringify(receipt, null, 2))
console.log(receipt.verifyUrl)
// Download the verification bundle after daily anchoring completes.

The receipt's verifyUrl points to the provenance record. Check it against output.json, not the separate receipt file. Your aiGenerated field is a publisher disclosure, not something Mark independently verifies or certifies as legally sufficient.

Provenance and content marking do different jobs

Embedded watermarks / metadata

  • Can carry machine-readable AI disclosures within media
  • Robustness depends on the format and implementation
  • Some metadata can be stripped on re-save
  • Evaluate the approach for your content and obligations

Mark stamp

  • Daily batch records anchor to Arweave; Base is optional
  • Signed receipt and Merkle path can be checked offline
  • A public verifyUrl lets others inspect the record
  • Matches exact bytes, not transformed representations

Common questions

Does my content leave my system?

No. You hash the content locally using SHA-256. Only the 64-character fingerprint is sent to the proof service. The original bytes never leave your infrastructure.

What if the Tatastu service shuts down?

Keep your original file and download the bundle after anchoring. You can check the signed receipt and Merkle path offline without Mark. Daily batches anchor to Arweave; Base is optional and not currently enabled. Independently checking the public anchor requires ledger access.

Is this legally sufficient for Article 50?

No stamp alone establishes compliance. Article 50(2) concerns machine-readable marking and detection of artificially generated or manipulated outputs. Mark records a signer's claim about exact bytes; it does not detect AI generation or preserve a match after those bytes change. Assess your obligations and labeling approach with legal counsel.

How much does it cost?

Every durable account gets one lifetime sample stamp, and signed-in Mark accounts get 100 per month. Prepaid packs start at $1, agents can pay per stamp with x402, and verification is always free. Full pricing →

Add a checkable provenance record

Keep the original bytes, save your receipt, and build the disclosures your use case requires alongside it.

See the full API docs Verify an existing stamp