Tessera · EU AI Act Article 50 Audio Ingest Gate

The metadata you added is stripped the moment a track hits social. We built the gate that proves provenance survives anyway.

Tessera runs a label's release batch through one Article 50 ingest gate. For each track it shows, on screen, that the C2PA metadata is stripped by a real social transcode while the soft-binding watermark UUID is recovered and the manifest re-resolves from a ledger. It cites the exact clause per verdict, and when a mark genuinely does not survive it routes the track to human review instead of certifying. Agents advise, code decides.

7 of 12

Releases auto-cleared COMPLIANT, 2 routed to remediation, 3 blocked, a 58 percent auto-clear

Fixed 12-release synthetic corpus, re-run 2026-08-07

BER 0.0

Soft-binding UUID recovered across mp3-128, aac-128, opus-96; hard binding survived 0 social channels

Our spread-spectrum mark, real ffmpeg transcodes

100%

Dossier coverage: every one of the 12 tracks carries a cited Article-50 clause verdict, 0 unexplained

HTML and JSON dossier on the fixed synthetic batch

A runnable demo of the mechanism on a fixed synthetic batch of 12 releases. It runs offline with no API key; the survival numbers come from real ffmpeg transcodes, and the optional agents are the only part that can use a model.

You added C2PA. The upload transcode already threw it away.

Marking without survival, and a manifest no social platform keeps.

The EU AI Act's Article 50 takes effect Aug 2, 2026: outputs of generative audio must be marked in a machine-readable format and stay detectable after common modifications, with Article 99 penalties up to 15M euro or 3 percent of global turnover (EU AI Act; Commission draft Code of Practice, Jan 2026). The reflex across the industry is to add C2PA and call it done.

The trap is that C2PA is hard binding. The manifest lives in file metadata, and that hard binding is stripped by most social platforms on upload, described as the single biggest operational weakness in the C2PA ecosystem today (Veriprajna WP31 solution source, 2026). A label that tagged its catalog is not actually covered the instant a track hits TikTok or Instagram. The only thing that survives is soft binding: an imperceptible watermark carrying a tiny UUID that re-resolves the manifest from a ledger after the metadata is gone.

The gap is wider than the mark. DDEX ERN 4.3 has no AI-disclosure fields, and most aggregators such as CD Baby, DistroKid, and Believe do not pass granular AI disclosure through (Veriprajna WP31 solution source, 2026), which is itself an Article 50 exposure. The volume is real too: on Deezer about 28 percent of daily uploads are fully AI-generated, roughly 70 percent of plays on AI-only tracks are fraudulent, and royalty fraud runs at 2 to 3 billion dollars a year (Beatdapp/Beatport, cited in WP31 research, 2026). Marking a catalog is easy. Proving that each track's provenance survives the chain it actually travels is the hard part, and it is the part a regulator will ask about.

A deterministic gate runs the whole chain; the LLM never touches the verdict

One ingest gate, run one stage at a time with real per-stage latency. The trust core is plain, unit-tested code.

The gate runs a label's distribution batch, 12 synthetic releases queued for roughly 180 DSPs. Per release the pipeline runs in order: channel delivery through a real ffmpeg transcode, multi-standard mark detection, soft-binding resolution against the ledger, a survival matrix, DDEX AI-disclosure extraction, the Article 50 policy gate, agentic remediation and adversarial review, and a regulator dossier. Every number that decides a verdict is computed before any agent runs.

channel delivery (ffmpeg transcode) → multi-standard mark detection → soft-binding resolution (ledger) → survival matrix (real ffmpeg) → DDEX AI-disclosure extraction → Article 50 policy gate (deterministic) → agentic remediation + adversarial review → regulator dossier

The deterministic trust core

The part outside any language model. Each release is pushed through the channel it arrived on: social (an mp3-128 transcode), analog-gap (a speaker-to-mic recapture model), or clean (a direct WAV handoff), which is what strips hard binding. A real spread-spectrum decoder (numpy FFT) recovers the embedded 32-bit asset key plus CRC from the delivered waveform; the key looks up the C2PA manifest stand-in in a SQLite ledger while a hard-binding read from file metadata is attempted and fails, side by side. The survival matrix re-encodes the master through mp3-128, aac-128, and opus-96 with real ffmpeg and measures bit-error rate per codec. Plain code a regulator can cross-examine.

The optional agents: bounded to advice

On top of the deterministic core, provider-swappable Pydantic AI agents interpret and communicate. A disclosure-extraction agent turns free-text production notes into structured DDEX fields, a Remediation agent drafts the concrete fix per gap, and an Adversarial Compliance Reviewer attacks each COMPLIANT certification and must tie every claim to stored evidence, so anything it cannot ground forces a downgrade to human review. All are skippable: with no API key the app runs a deterministic fallback and the survival and gate numbers are identical. The adapter defaults to Claude claude-opus-4-8 and swaps to OpenAI, Google, or Cloudflare. Agents advise, code decides.

What the deterministic gate checks per track

Check What it proves Basis
Machine-readable mark A generative track carries a decodable mark at all. deterministic, Art. 50(2)
Soft-binding recovery The asset key survives the delivery channel and re-resolves the manifest from the ledger. deterministic
Survival matrix (BER) The UUID re-decodes through mp3-128, aac-128, and opus-96, measured by bit-error rate. real ffmpeg
DDEX AI-disclosure Vocals, instrumentation, mixing, and mastering are all disclosed. deterministic, Art. 50(4)
Named takedown owner A human owner and an SLA exist for the track. deterministic
Unrecoverable mark When the mark does not survive, the gate abstains rather than certifies. deterministic, abstains

A track is COMPLIANT only if it is human-created and out of scope, or it is AI and carries a machine-readable mark and the soft-binding key is recovered after the delivery channel and the manifest resolves and DDEX disclosure is complete and a named takedown owner exists. Otherwise it is NEEDS_REMEDIATION (NEEDS PROOF, routed to human review) or BLOCKED (an active disclosure or marking violation). Each verdict cites the exact clause, whether Article 50(2), Article 50(4), the draft Code of Practice, or the takedown-owner expectation. Agents advise, this code decides.

Four verdicts, on screen

Every release is synthetic: short procedurally generated tones, no real music, artists, labels, or takedown owners. The names are fictitious test fixtures. The numbers are the live engine's output, re-run 2026-08-07.

The batch, and the operating number

Twelve releases queue for distribution, and the gate returns 7 COMPLIANT, 2 routed to remediation, and 3 BLOCKED, a 58 percent auto-clear. That is the number a Head of Trust and Safety funds against: we cleared 7 of 12 automatically and flagged the rest with named owners. The header carries the market context that makes it urgent, Article 50 effective Aug 2, 2026 and penalties up to 15M euro or 3 percent of global turnover (EU AI Act), and the full-batch regulator dossier exports as HTML or JSON.

The Tessera dashboard showing four tiles reading 12 releases in batch, 7 auto-cleared COMPLIANT, 2 routed to remediation, and 3 blocked on a disclosure gap, with the Neon Tide release open on the right showing a COMPLIANT verdict, and HTML and JSON buttons to export the full-batch regulator dossier.
The 12-release batch: 7 COMPLIANT, 2 to remediation, 3 BLOCKED, a 58 percent auto-clear, with the full-batch dossier one click away.

Hard binding stripped, soft binding recovered

Neon Tide (REL-001) is an in-house-AI release delivered through the social channel. The panel shows the whole thesis side by side: hard binding via C2PA metadata reads STRIPPED on transcode, while soft binding via the watermark UUID reads RECOVERED at confidence 0.989, with the recovered asset key on screen and the manifest re-resolved from the ledger. The survival matrix re-encodes the master through mp3-128, aac-128, and opus-96 with real ffmpeg, and the UUID re-decodes at bit-error rate 0.0 on all three. DDEX disclosure is complete and a takedown owner is present, so the gate returns COMPLIANT on evidence under Article 50(2). This is the single most important real-world fact about C2PA, shown rather than asserted.

The Neon Tide verdict panel with a hard-binding card reading STRIPPED on transcode next to a soft-binding card reading RECOVERED at confidence 0.989 with the recovered watermark UUID highlighted, above a survival matrix showing mp3-128, aac-128, and opus-96 each recovered at BER 0, and a COMPLIANT verdict citing Article 50(2).
Hard binding stripped by the transcode; the soft-binding UUID recovered at confidence 0.989, and survival at BER 0.0 across all three social codecs.

A recovered mark is not a clean bill

Glasshouse (REL-003) recovers its watermark at confidence 0.992, with BER 0.0 across all three codecs, so provenance is fine. The gate still returns BLOCKED, under Article 50(4): the DDEX AI-disclosure is incomplete, missing instrumentation, mixing, and mastering because the aggregator fixture did not pass them through. Shipping as-is would be an active Article 50 disclosure violation, so the track routes to a named owner with a 5 day SLA. Mark present is not the same as compliant, and the gate checks the whole chain rather than stopping at the watermark.

The Glasshouse verdict showing soft binding RECOVERED at confidence 0.992 and a survival matrix at BER 0 across mp3-128, aac-128, and opus-96, but a DDEX AI-disclosure row with instrumentation, mixing, and mastering marked Missing, producing a BLOCKED verdict under Article 50(4) with a remediation owner and a 5 day SLA.
Provenance recovered, still BLOCKED: three missing DDEX disclosure fields trigger Article 50(4).

When the mark does not survive, it abstains

Radio Imaging Sweep 7 (REL-004) arrived through the analog gap, recaptured speaker-to-mic off an FM monitor. The mark did not survive: soft binding is Not recoverable at confidence 0.699 and the CRC fails, so the gate returns NEEDS_REMEDIATION, NEEDS PROOF, routed to human review, do not certify. The honest nuance is right there on screen: the survival matrix run on the clean master shows the mark would survive normal transcodes, but this track came through the analog-gap channel that actually broke it, and the gate refuses to bluff. That abstention is encoded as a unit-tested invariant, not a hope.

The Radio Imaging Sweep 7 verdict showing arrival via analog-gap, a soft-binding card reading Not recoverable at confidence 0.699 with no manifest to resolve, and a NEEDS REMEDIATION verdict citing the draft Code of Practice with the text NEEDS PROOF routed to human review, do not certify, while the survival matrix on the clean master shows the mark would otherwise survive.
The abstain beat: the mark does not survive the analog gap at confidence 0.699, so the gate routes to human review instead of certifying.

The regulator dossier, per track

Every one of the 12 tracks exports to a dossier, HTML and JSON, carrying the verdict and cited clause, the recovered UUID and manifest id, the survival matrix with BER per codec, DDEX completeness, the remediation owner and SLA, and the adversarial reviewer's sign-off or downgrade. Solstice Engine (REL-009) shows a subtle case: the mark recovers at confidence 0.991, but no C2PA manifest was ever registered in the ledger, a process gap, so it routes to remediation with the fix spelled out. Coverage is complete, with every track carrying a cited-clause verdict and nothing left unexplained.

The exported regulator dossier scrolling through per-track cards: a human-created track marked out of Article 50 marking scope under Article 50(2), Polyglot (FR Cover) COMPLIANT with the mark recovered and survival at BER 0.0, and Solstice Engine NEEDS REMEDIATION because the mark recovered at confidence 0.991 but no C2PA manifest was registered in the ledger, each with an adversarial compliance reviewer sign-off.
The dossier: a cited-clause verdict for every track, including Solstice Engine, where a recovered mark still routes to remediation because its manifest was never registered.

Where Tessera sits, and where it does not

It is the integration layer, the ingest gate, not a watermark meant to win a benchmark. We integrate the vendors' marks; we do not compete with them.

Concern Add C2PA and ship Tessera
C2PA metadata after a social upload Assumed intact, actually stripped Treated as stripped; the soft-binding UUID is recovered instead
A watermarked track with missing disclosure Ships as compliant BLOCKED under Article 50(4), with the missing fields named
A mark that does not survive the channel Certified on a guess Abstains, NEEDS PROOF, routed to human review
Who renders the Article 50 verdict Often an unaudited model A deterministic rules engine outside any LLM, citing the clause
The watermark algorithm itself Build or buy one and hope it wins Integrate SynthID, AudioSeal, or Digimarc behind a swap-for-SDK interface
Durability as watermark models improve The value rides on the algorithm The value stays in the survival, disclosure, and dossier layer

What this demo does not do

  • It does not build a watermark that competes with SynthID-Audio, AudioSeal, or Digimarc. Those are stub adapters behind a swap-for-SDK interface, and our spread-spectrum mark exists only to carry a 32-bit asset key for soft binding. We make no robustness claim against any vendor.
  • BER 0.0 is not a universal guarantee. It is measured on a fixed synthetic 12-release corpus, with our mark, through mp3-128, aac-128, and opus-96 only, and the demo shows the same mark dying in the analog gap.
  • The manifests are JSON C2PA stand-ins in a SQLite soft-binding ledger, not signed C2PA 2.0. Real C2PA 2.0 signing and an EU-residency manifest store are deferred.
  • There are no live DSP or aggregator connectors. The DSP ingest webhook and the CD Baby, DistroKid, and Believe connectors are mocks and fixtures.
  • Every release, creator, aggregator, and takedown owner is a synthetic test fixture over procedurally generated audio. There are no real recordings, customers, deployments, testimonials, or claimed ROI.
  • It is a compliance-support gate and evidence dossier, not legal advice, certification, or a guarantee of passing a regulator audit. The clause citations and the audit framing are engineering scaffolding.
  • The LLM is never in the trust path. Watermark recovery, survival measurement, soft-binding lookup, and the Article 50 pass or fail are deterministic; the agents only extract, draft, and review, and they are skippable with a deterministic fallback.
  • The stack is Python FastAPI, a numpy spread-spectrum watermark with an ffmpeg survival harness, a SQLite ledger, and a single index.html with vanilla JS, plus a provider-swappable Pydantic AI adapter defaulting to Claude claude-opus-4-8. Not React, not LangGraph, not a fine-tuned model.

Questions buyers ask

We already added C2PA to our catalog. Why isn't that enough for Article 50?

C2PA is hard binding: the manifest lives in file metadata, and that metadata is stripped by most social platforms on upload, the single biggest operational weakness in the C2PA ecosystem today (Veriprajna WP31 solution source, 2026). So a label that dutifully added C2PA is, operationally, uncovered the moment a track hits TikTok or Instagram. What survives is soft binding: an imperceptible watermark carrying a small UUID that re-resolves the manifest from a ledger after the metadata is gone. Tessera gates on that soft-binding recovery, not on metadata that will not be there in the wild.

Did you build a watermark that beats SynthID or AudioSeal?

No, and we make no such claim. We do not build a competing watermark algorithm; Google and Meta have that covered and we are happy to integrate their work. SynthID-Audio, AudioSeal, and Digimarc are stub adapters in this demo behind a documented swap-for-SDK interface, because SynthID's detector is Google-closed and AudioSeal needs a GPU. Our own spread-spectrum mark exists only to carry a 32-bit asset key plus CRC for soft binding, not to win a robustness benchmark against any vendor.

You say BER 0.0. Does the mark survive everything?

No. The bit-error rate 0.0 result is scoped: our spread-spectrum mark, on a fixed synthetic corpus of 12 releases, re-encoded through mp3-128, aac-128, and opus-96 with real ffmpeg. It is not an open-world guarantee, and the demo itself shows the opposite case: a broadcast track recaptured speaker-to-mic through the analog gap, where the mark does not survive at confidence 0.699 and the gate abstains rather than certifying. A survives-everything claim would be false and off-brand.

Is this real C2PA, and does it actually sign anything?

The manifests are JSON C2PA stand-ins stored in a SQLite soft-binding ledger, not cryptographically signed C2PA 2.0. Real C2PA 2.0 signing and an EU-residency manifest store are deferred. What the demo proves is the soft-binding mechanism itself: the recovered asset key looks up the manifest stand-in in the ledger, which is exactly the step that survives after the file metadata is stripped by a transcode.

Does it connect to our DSP or aggregator like DistroKid, CD Baby, or Believe?

Not in this demo. The DSP ingest webhook and the CD Baby, DistroKid, and Believe connectors are mocks and fixtures; live connectors are deferred. The releases, creators, aggregators, and takedown owners are synthetic test fixtures over procedurally generated audio, not real catalog. What is real is the gate logic: the watermark decode, the ffmpeg survival harness, the soft-binding lookup, and the deterministic Article 50 policy gate.

An AI is deciding whether a track is Article 50 compliant. How is that defensible to a regulator?

The Article 50 verdict is not made by an LLM. Watermark recovery, survival measurement, the soft-binding lookup, and the pass or fail rules are deterministic, unit-tested code outside any model, and each verdict cites the exact clause, for example Glasshouse blocked under Article 50(4) for three missing DDEX disclosure fields. The Pydantic AI agents only extract disclosure, draft remediation, and adversarially review, and any claim the reviewer cannot tie to stored evidence forces a downgrade to human review. Agents advise, code decides, and a regulator can cross-examine the rule that fired; this is a compliance-support gate and evidence dossier, not legal certification.

Does the demo need an API key, and what actually runs today?

No API key is required. With no key the app runs a deterministic fallback and the survival and gate numbers are identical, because they never depend on the LLM. The stack is a Python FastAPI backend, a numpy spread-spectrum watermark with an ffmpeg survival harness, a SQLite soft-binding ledger, and a single index.html with vanilla JS, plus a provider-swappable Pydantic AI adapter defaulting to Claude claude-opus-4-8. What runs today is the real ingest-gate logic on a fixed synthetic batch; live connectors and real C2PA 2.0 signing are the named deferred items.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Build the gate that makes C2PA survive the real world

Provenance that survives the transcode, and the discipline to abstain when it does not.

If your rights-tech, trust and safety, or distribution team is working out how to show an Article 50 answer on Aug 2, 2026 without relying on metadata that social platforms strip, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.

Article 50 readiness assessment

  • ✓ Map where your provenance dies in the transcode-to-social chain
  • ✓ Design the soft-binding architecture and multi-standard detector
  • ✓ Close the DDEX AI-disclosure gap through middleware
  • ✓ Shape the regulator-ready dossier your team can defend

Build with us

  • ✓ A deterministic, unit-tested Article 50 policy gate outside any model
  • ✓ A soft-binding ledger and a real ffmpeg survival harness
  • ✓ Swap-for-SDK adapters for SynthID, AudioSeal, and Digimarc
  • ✓ Grounding-checked agents for disclosure and remediation, not black-box verdicts