A label tagged its catalog with C2PA for the EU AI Act. I watched one transcode strip all of it.

The first time I pushed one of my own test tracks through a plain social transcode, I watched the C2PA provenance that a label would have paid to add vanish in a single pass. Nothing dramatic happened on screen. The file went in with a signed provenance header, the encoder did its ordinary job, and the file came out clean, lighter, and stripped. The provenance was simply gone, the way it goes the moment any real track hits TikTok or Instagram. I sat there feeling slightly sick, because I had sketched the whole demo on the assumption that adding C2PA was the answer, and I had just watched the answer evaporate.

That is what this essay is about. I set out to build an EU AI Act Article 50 ingest gate for AI-generated audio, a thing the app calls Tessera, and the build quietly took apart the assumption almost everyone in music rights is walking in with. The assumption is that Article 50 is a watermark problem you solve by tagging your catalog. It is not. It is a survival problem, and most of what the industry is busy adding does not survive. If you want to watch the gate decide for itself, it lives here: veriprajna.com/demos/ai-audio-licensing-provenance.

The reflex I started with was "just add C2PA"

I started this build believing the same thing every rights-tech deck I had read believed, which is that Article 50 compliance is a labeling exercise.

The regulation is real and the clock is real. The EU AI Act's Article 50 took effect on August 2, 2026, and it requires that generative-audio outputs be marked in a machine-readable format and stay detectable, in the language of the Commission's draft Code of Practice from January 2026, "after common modifications." Article 99 sets the teeth, penalties up to €15M or 3% of global turnover. The scale underneath it is not small either. Roughly 28% of Deezer's daily uploads are now fully AI-generated (Beatdapp/Beatport, cited in Veriprajna WP31 research, 2026). So the natural move, the move I made in my first sketch of the pipeline, is to attach a C2PA manifest to every AI track and call the catalog covered.

Here is the failure I had not internalized until I saw it happen. C2PA, as most people deploy it, is hard binding. The provenance lives in the file's metadata. And hard binding is stripped by essentially every social-platform transcode on upload, which the Veriprajna WP31 solution research (2026) calls the single biggest operational weakness in the C2PA ecosystem today. So a label that dutifully tagged its entire catalog is, operationally, uncovered the instant a track leaves the clean handoff and hits the wild.

The label did everything the guidance said. It added C2PA. And it was uncovered the moment the first track hit social, because the part it added is exactly the part that gets stripped.

The thing that actually survives is soft binding. An imperceptible watermark carries a tiny identifier, and after the metadata is gone you use that identifier to re-resolve the manifest from a ledger. It is unglamorous integration engineering. It is also, as far as I can tell, the whole ballgame.

The night my own watermark came back as garbage

I nearly abandoned soft binding on a Tuesday night, when my own watermark decoder started returning noise.

I had the pipeline running end to end. A track went through the delivery channel, a spread-spectrum decoder read the mark back out of the delivered waveform, and the recovered key looked up the manifest. Then I re-ran a batch I had cleared the day before, and the recovered keys came back as garbage. The bit-error rate on the watermark sat around 0.5, which is a coin flip, which is a decoder's way of telling you it is reading static. My first thought was that soft binding did not actually work, that the mark could not survive a real codec, and that the entire premise of the demo was wrong.

I spent a couple of hours convinced the approach was dead. It was not the approach. It was a stale on-disk corpus. An earlier cache had drifted out of sync with the deterministic seeds the tracks are generated from, so the decoder was reading marks that no longer matched the audio. I rebuilt the corpus from the seeds, re-ran everything through real ffmpeg transcodes, and the keys came back clean. That failure was worth more to me than any clean run, because it taught me to distrust a good number until I know exactly what produced it. Every benchmark in this demo was recorded only after that rebuild.

When it worked, that contrast was the clearest thing I had ever put on a screen. Take Neon Tide, a synthetic in-house-AI release delivered through the social channel (every track in this corpus is procedurally generated tone, no real music or artists, and the names are fixtures). Its hard binding is stripped by the transcode. Its soft-binding watermark is recovered at confidence 0.989, and the C2PA manifest re-resolves from the ledger. Hard binding died. Soft binding carried the provenance through. Side by side, on the same track, in the same pass. That one panel is the argument.

So did I just build a better watermark?

I get some version of this question in almost every conversation, and the answer is no, which tends to surprise people.

I did not build a watermark meant to beat anyone's, and I am careful to say so, because the temptation to imply otherwise is strong. The market-leading detectors, Google's SynthID-Audio, Meta's AudioSeal, Digimarc, sit in this demo as stub adapters behind a documented swap-for-SDK interface. SynthID's detector is Google-closed and AudioSeal needs a GPU, so in the demo they report presence at a fixed confidence and nothing more. The spread-spectrum mark I did write exists for exactly one job, to carry a 32-bit asset key and a CRC so the manifest can be re-resolved. It is not entered in any robustness contest, and I make no claim that it beats a vendor's.

What I built is the layer around the algorithm. Google and Meta can own the watermark. The part nobody ships as a single product is the integration: the multi-standard detector, the soft-binding architecture, the DDEX middleware, and the regulator-ready dossier. That layer is where the survival problem actually gets solved, and it is the part no single vendor is racing to hand you.

I want to be exact about what that survival matrix means, because honest scope is the whole point of building at a company named Veriprajna, which means true wisdom. On a fixed synthetic corpus of 12 releases, my mark, re-encoded through mp3-128, aac-128, and opus-96, re-decodes at bit-error rate 0.0, while hard binding survives none of those social channels. That is a real measurement with real ffmpeg. It is not a universal "survives everything" claim, and the demo itself contains a track where the mark does not survive at all, which is the part I am proudest of.

I did not build a better watermark. I built the layer that decides whether the provenance you still have is enough to certify, and refuses when it is not.

The track I badly wanted to wave through

I remember staring at Radio Imaging Sweep 7 and wanting to let it pass, and that is the moment this whole demo earned its name.

It is a broadcast cut that arrived through what I model as the analog gap, a speaker-to-microphone recapture off an FM monitor. Its mark did not survive that path. The decoder read it back at confidence 0.699, the CRC failed, and there was no recoverable identifier left to resolve a manifest with. Here was the temptation, sitting right there on the screen. The survival matrix, run on the clean master through the social codecs, shows the mark would survive a normal transcode. So I could see a version of the logic that said the mark is basically fine, this is just a bad channel, wave it through. Article 99 is what killed that instinct. A false "compliant" under a €15M or 3% penalty regime is the expensive kind of wrong.

So the gate does the harder thing. When a mark genuinely does not survive the channel a track actually came through, it returns NEEDS PROOF and routes the track to a human, with the analog-gap failure and a named owner attached. It does not certify. I wrote that as a unit-tested invariant, a test literally named for the watermark dying in the analog gap, because I wanted the abstention to be a property of the system and not a mood. Abstention is not the gate failing. Abstention is the gate refusing to bluff, and refusing to bluff is what a Head of Trust and Safety is actually buying.

A false "compliant" is not a small mistake under Article 99's penalties. It is the expensive kind of wrong, which is exactly why the gate is built to abstain before it will bluff.

Isn't a recovered watermark enough?

I assumed, early, that recovering the watermark was basically the finish line, and Glasshouse is the track that corrected me.

Glasshouse recovered its mark cleanly, at confidence 0.992, bit-error rate 0.0 across all three codecs. Provenance, in the narrow sense, was perfect. And the gate blocked it anyway. The reason is the rest of the chain. DDEX ERN 4.3 has no AI-disclosure fields, and most aggregators (CD Baby, DistroKid, Believe) do not pass granular disclosure through, per the Veriprajna WP31 research (2026). Glasshouse arrived through DistroKid with three of its four disclosure fields missing: instrumentation, mixing, and mastering. Under Article 50(4), shipping it as-is would be an active disclosure violation, so the verdict is BLOCKED, with that exact clause cited on screen.

That is why the gate checks the whole chain and not just the mark: a machine-readable mark, plus soft-binding recovery after the delivery channel, plus complete DDEX disclosure, plus a named takedown owner. Miss any one link and you do not get a green light. Across the full batch of 12 releases the split came out to 7 certified COMPLIANT, 2 routed to human remediation, and 3 blocked, and every one of the 12 carries a verdict with a cited clause. That coverage is the part I care about, because a Head of Rights Tech does not fund a black box, they fund something they can cross-examine ("why was Glasshouse blocked? Article 50(4), three DDEX fields missing").

And the decisions that carry legal weight are deterministic on purpose. Watermark recovery, survival measurement, the soft-binding lookup, and the Article 50 pass/fail are plain code, sitting outside the language models. There are agents in the system, one that extracts disclosure fields from free text and one that adversarially attacks each certification, but they advise. They do not decide, and the whole thing runs keyless on a deterministic fallback, so the gate's numbers are identical with or without an LLM. Agents advise, code decides.

I should be just as clear about what this is not, because the brand does not survive an overclaim. The manifests are JSON C2PA stand-ins in a SQLite ledger, not cryptographically signed C2PA 2.0. The DSP and aggregator connectors are mocks. The releases are synthetic tone, not real recordings, and the tool supports an Article 50 answer, it does not hand anyone legal certification. What is real is the mechanism: the recovery, the survival measurement, the whole-chain gate, and the dossier it exports.

A recovered watermark told me the provenance was intact. The regulator still cares whether the disclosure is complete and who owns the takedown. Those are different questions, and the gate has to ask all of them.

The question I ask before I let anything certify

I found that building this changed a smaller thing in me than the grand thesis did, and the smaller thing has lasted longer.

I stopped asking whether an AI track has provenance, because I can usually answer that and it turns out not to be enough. Neon Tide had provenance and so did Glasshouse, and one certified while the other was blocked. The question I ask now, before anything leaves the gate as COMPLIANT, is whether I can prove the provenance survived the specific channel this track actually came through, and whether every other link in the chain holds, and whether I would rather abstain than guess when it does not.

That is not a question a better watermark answers. As Google's and Meta's models improve, and they will, the value does not move to the algorithm, because they already own the algorithm. It stays in the integration layer that makes provenance survive the real world, and in the discipline to say NEEDS PROOF when even soft binding fails. The durable part of this build is not a robustness score that ages out the next time SynthID gets better. It is the survival measurement, the whole-chain gate, and the honesty invariant, none of which get easier or harder as the watermark improves. If you want to see where I landed, the gate is here once more: veriprajna.com/demos/ai-audio-licensing-provenance.

And if you would rather watch it than read me describe it, here is the whole gate running end to end.

So the question I would leave you with is the one the August 2 deadline is quietly asking every label right now. You added the mark. Can you prove it survived the trip? Because on the far side of a single social transcode, the tag you were counting on is already gone, and the only thing that certifies is whatever you built to recover what is left.