Watermark vs C2PA: why AI content needs both
Invisible watermarks and C2PA manifests fail in different ways. A side-by-side comparison, measured robustness results, and why the EU Code of Practice expects more than one layer.
6 min read · Updated 27 October 2026 · Markproof
In short
- A C2PA manifest says a lot (who made the file, with what, that it was AI-generated) but it lives in metadata, which platforms routinely strip.
- An invisible watermark lives in the pixels or the audio signal, so it survives stripping and re-compression, but it carries only a short code.
- Used together, each covers the other's weakness. The EU's Code of Practice expects at least two layers of marking for this reason.
Two different kinds of mark
Article 50 of the EU AI Act requires AI-generated content to be marked in a way that's effective, interoperable, robust and reliable. No single technique achieves all four, and the Commission's own Code of Practice says as much. The two techniques in wide use fail in opposite ways.
| C2PA manifest | Invisible watermark | |
|---|---|---|
| Where it lives | In the file's metadata | In the content itself: pixels or audio samples |
| What it can say | A lot: AI-generated, which tool and model, when, any edits | A short code, which links to a record |
| Tamper evidence | Strong: cryptographically signed, so edits break the signature | None by itself |
| Survives metadata stripping | No | Yes |
| Survives re-compression and resizing | No, unless re-signed | Yes, within limits |
| Who can read it | Any C2PA-aware tool | Only a detector for that watermark |
| Main weakness | Easily lost when files are re-saved or uploaded | Can be degraded by heavy edits or deliberate attacks |
Why you need both
Think about where an AI-generated image actually goes after you create it:
- Downloaded and shared as-is: the C2PA manifest survives and tells the full story.
- Uploaded to a social platform: the platform usually re-encodes it and strips the metadata. The manifest is gone, but the watermark is still detectable.
- Edited or screenshotted: the manifest is lost or no longer valid. The watermark usually survives, and its code points back to the original record.
With only a manifest, the second and third cases leave nothing. With only a watermark, you can tell a file was marked, but there's no signed, standard record of what it is. Together they keep the file detectable as AI-generated across far more of its life.
How robust is a watermark in practice?
We tested Markproof's image watermark on real AI-generated images (a portrait, a sunset gradient, a detailed landscape, a desk scene with text and a text-over-photo graphic) at full resolution, 1024 to 1536 pixels wide. Every marked image was put through each edit separately and then checked for its exact code.
| Edit | Exact code recovered |
|---|---|
| None (as marked) | All images |
| JPEG re-save at quality 75, and at quality 50 | All images |
| Resized to 50% | All images |
| 10% cropped from the edges | All images |
| Converted to WebP | All images |
| Screenshot-style: downscaled to 80%, saved as JPEG | All images |
Across repeated runs with fresh codes, that was 105 of 105 checks on real images. Image quality stayed high (PSNR 45–50 dB, SSIM 0.997 or above), and at normal viewing size the marked images look identical to the originals.
Don't forget detection
Marking is only half of Article 50(2): content must also be detectable. The Code of Practice expects providers to give deployers, users and authorities a way to check content. With Markproof that's the verify API, the free checker anyone can use, and a public record page for every marked file.
Sources
This guide is general information, not legal advice. Laws and guidance change; check the sources, and talk to a qualified lawyer about your situation.
Check your own output in seconds.
Drop a file into the free checker to see whether it carries a watermark and Content Credentials. Then mark your files with one API call: 250 free calls a month, no card required.