Tessera · EU AI Act Article 50 Audio Ingest Gate
Tessera runs a label's release batch through one Article 50 ingest gate. For each track it shows, on screen, that the C2PA metadata is stripped by a real social transcode while the soft-binding watermark UUID is recovered and the manifest re-resolves from a ledger. It cites the exact clause per verdict, and when a mark genuinely does not survive it routes the track to human review instead of certifying. Agents advise, code decides.
7 of 12
Releases auto-cleared COMPLIANT, 2 routed to remediation, 3 blocked, a 58 percent auto-clear
Fixed 12-release synthetic corpus, re-run 2026-08-07
BER 0.0
Soft-binding UUID recovered across mp3-128, aac-128, opus-96; hard binding survived 0 social channels
Our spread-spectrum mark, real ffmpeg transcodes
100%
Dossier coverage: every one of the 12 tracks carries a cited Article-50 clause verdict, 0 unexplained
HTML and JSON dossier on the fixed synthetic batch
A runnable demo of the mechanism on a fixed synthetic batch of 12 releases. It runs offline with no API key; the survival numbers come from real ffmpeg transcodes, and the optional agents are the only part that can use a model.
Marking without survival, and a manifest no social platform keeps.
The EU AI Act's Article 50 takes effect Aug 2, 2026: outputs of generative audio must be marked in a machine-readable format and stay detectable after common modifications, with Article 99 penalties up to 15M euro or 3 percent of global turnover (EU AI Act; Commission draft Code of Practice, Jan 2026). The reflex across the industry is to add C2PA and call it done.
The trap is that C2PA is hard binding. The manifest lives in file metadata, and that hard binding is stripped by most social platforms on upload, described as the single biggest operational weakness in the C2PA ecosystem today (Veriprajna WP31 solution source, 2026). A label that tagged its catalog is not actually covered the instant a track hits TikTok or Instagram. The only thing that survives is soft binding: an imperceptible watermark carrying a tiny UUID that re-resolves the manifest from a ledger after the metadata is gone.
The gap is wider than the mark. DDEX ERN 4.3 has no AI-disclosure fields, and most aggregators such as CD Baby, DistroKid, and Believe do not pass granular AI disclosure through (Veriprajna WP31 solution source, 2026), which is itself an Article 50 exposure. The volume is real too: on Deezer about 28 percent of daily uploads are fully AI-generated, roughly 70 percent of plays on AI-only tracks are fraudulent, and royalty fraud runs at 2 to 3 billion dollars a year (Beatdapp/Beatport, cited in WP31 research, 2026). Marking a catalog is easy. Proving that each track's provenance survives the chain it actually travels is the hard part, and it is the part a regulator will ask about.
One ingest gate, run one stage at a time with real per-stage latency. The trust core is plain, unit-tested code.
The gate runs a label's distribution batch, 12 synthetic releases queued for roughly 180 DSPs. Per release the pipeline runs in order: channel delivery through a real ffmpeg transcode, multi-standard mark detection, soft-binding resolution against the ledger, a survival matrix, DDEX AI-disclosure extraction, the Article 50 policy gate, agentic remediation and adversarial review, and a regulator dossier. Every number that decides a verdict is computed before any agent runs.
The part outside any language model. Each release is pushed through the channel it arrived on: social (an mp3-128 transcode), analog-gap (a speaker-to-mic recapture model), or clean (a direct WAV handoff), which is what strips hard binding. A real spread-spectrum decoder (numpy FFT) recovers the embedded 32-bit asset key plus CRC from the delivered waveform; the key looks up the C2PA manifest stand-in in a SQLite ledger while a hard-binding read from file metadata is attempted and fails, side by side. The survival matrix re-encodes the master through mp3-128, aac-128, and opus-96 with real ffmpeg and measures bit-error rate per codec. Plain code a regulator can cross-examine.
On top of the deterministic core, provider-swappable Pydantic AI agents interpret and communicate. A disclosure-extraction agent turns free-text production notes into structured DDEX fields, a Remediation agent drafts the concrete fix per gap, and an Adversarial Compliance Reviewer attacks each COMPLIANT certification and must tie every claim to stored evidence, so anything it cannot ground forces a downgrade to human review. All are skippable: with no API key the app runs a deterministic fallback and the survival and gate numbers are identical. The adapter defaults to Claude claude-opus-4-8 and swaps to OpenAI, Google, or Cloudflare. Agents advise, code decides.
| Check | What it proves | Basis |
|---|---|---|
| Machine-readable mark | A generative track carries a decodable mark at all. | deterministic, Art. 50(2) |
| Soft-binding recovery | The asset key survives the delivery channel and re-resolves the manifest from the ledger. | deterministic |
| Survival matrix (BER) | The UUID re-decodes through mp3-128, aac-128, and opus-96, measured by bit-error rate. | real ffmpeg |
| DDEX AI-disclosure | Vocals, instrumentation, mixing, and mastering are all disclosed. | deterministic, Art. 50(4) |
| Named takedown owner | A human owner and an SLA exist for the track. | deterministic |
| Unrecoverable mark | When the mark does not survive, the gate abstains rather than certifies. | deterministic, abstains |
A track is COMPLIANT only if it is human-created and out of scope, or it is AI and carries a machine-readable mark and the soft-binding key is recovered after the delivery channel and the manifest resolves and DDEX disclosure is complete and a named takedown owner exists. Otherwise it is NEEDS_REMEDIATION (NEEDS PROOF, routed to human review) or BLOCKED (an active disclosure or marking violation). Each verdict cites the exact clause, whether Article 50(2), Article 50(4), the draft Code of Practice, or the takedown-owner expectation. Agents advise, this code decides.
Every release is synthetic: short procedurally generated tones, no real music, artists, labels, or takedown owners. The names are fictitious test fixtures. The numbers are the live engine's output, re-run 2026-08-07.
Twelve releases queue for distribution, and the gate returns 7 COMPLIANT, 2 routed to remediation, and 3 BLOCKED, a 58 percent auto-clear. That is the number a Head of Trust and Safety funds against: we cleared 7 of 12 automatically and flagged the rest with named owners. The header carries the market context that makes it urgent, Article 50 effective Aug 2, 2026 and penalties up to 15M euro or 3 percent of global turnover (EU AI Act), and the full-batch regulator dossier exports as HTML or JSON.
Neon Tide (REL-001) is an in-house-AI release delivered through the social channel. The panel shows the whole thesis side by side: hard binding via C2PA metadata reads STRIPPED on transcode, while soft binding via the watermark UUID reads RECOVERED at confidence 0.989, with the recovered asset key on screen and the manifest re-resolved from the ledger. The survival matrix re-encodes the master through mp3-128, aac-128, and opus-96 with real ffmpeg, and the UUID re-decodes at bit-error rate 0.0 on all three. DDEX disclosure is complete and a takedown owner is present, so the gate returns COMPLIANT on evidence under Article 50(2). This is the single most important real-world fact about C2PA, shown rather than asserted.
Glasshouse (REL-003) recovers its watermark at confidence 0.992, with BER 0.0 across all three codecs, so provenance is fine. The gate still returns BLOCKED, under Article 50(4): the DDEX AI-disclosure is incomplete, missing instrumentation, mixing, and mastering because the aggregator fixture did not pass them through. Shipping as-is would be an active Article 50 disclosure violation, so the track routes to a named owner with a 5 day SLA. Mark present is not the same as compliant, and the gate checks the whole chain rather than stopping at the watermark.
Radio Imaging Sweep 7 (REL-004) arrived through the analog gap, recaptured speaker-to-mic off an FM monitor. The mark did not survive: soft binding is Not recoverable at confidence 0.699 and the CRC fails, so the gate returns NEEDS_REMEDIATION, NEEDS PROOF, routed to human review, do not certify. The honest nuance is right there on screen: the survival matrix run on the clean master shows the mark would survive normal transcodes, but this track came through the analog-gap channel that actually broke it, and the gate refuses to bluff. That abstention is encoded as a unit-tested invariant, not a hope.
Every one of the 12 tracks exports to a dossier, HTML and JSON, carrying the verdict and cited clause, the recovered UUID and manifest id, the survival matrix with BER per codec, DDEX completeness, the remediation owner and SLA, and the adversarial reviewer's sign-off or downgrade. Solstice Engine (REL-009) shows a subtle case: the mark recovers at confidence 0.991, but no C2PA manifest was ever registered in the ledger, a process gap, so it routes to remediation with the fix spelled out. Coverage is complete, with every track carrying a cited-clause verdict and nothing left unexplained.
It is the integration layer, the ingest gate, not a watermark meant to win a benchmark. We integrate the vendors' marks; we do not compete with them.
| Concern | Add C2PA and ship | Tessera |
|---|---|---|
| C2PA metadata after a social upload | Assumed intact, actually stripped | Treated as stripped; the soft-binding UUID is recovered instead |
| A watermarked track with missing disclosure | Ships as compliant | BLOCKED under Article 50(4), with the missing fields named |
| A mark that does not survive the channel | Certified on a guess | Abstains, NEEDS PROOF, routed to human review |
| Who renders the Article 50 verdict | Often an unaudited model | A deterministic rules engine outside any LLM, citing the clause |
| The watermark algorithm itself | Build or buy one and hope it wins | Integrate SynthID, AudioSeal, or Digimarc behind a swap-for-SDK interface |
| Durability as watermark models improve | The value rides on the algorithm | The value stays in the survival, disclosure, and dossier layer |
C2PA is hard binding: the manifest lives in file metadata, and that metadata is stripped by most social platforms on upload, the single biggest operational weakness in the C2PA ecosystem today (Veriprajna WP31 solution source, 2026). So a label that dutifully added C2PA is, operationally, uncovered the moment a track hits TikTok or Instagram. What survives is soft binding: an imperceptible watermark carrying a small UUID that re-resolves the manifest from a ledger after the metadata is gone. Tessera gates on that soft-binding recovery, not on metadata that will not be there in the wild.
No, and we make no such claim. We do not build a competing watermark algorithm; Google and Meta have that covered and we are happy to integrate their work. SynthID-Audio, AudioSeal, and Digimarc are stub adapters in this demo behind a documented swap-for-SDK interface, because SynthID's detector is Google-closed and AudioSeal needs a GPU. Our own spread-spectrum mark exists only to carry a 32-bit asset key plus CRC for soft binding, not to win a robustness benchmark against any vendor.
No. The bit-error rate 0.0 result is scoped: our spread-spectrum mark, on a fixed synthetic corpus of 12 releases, re-encoded through mp3-128, aac-128, and opus-96 with real ffmpeg. It is not an open-world guarantee, and the demo itself shows the opposite case: a broadcast track recaptured speaker-to-mic through the analog gap, where the mark does not survive at confidence 0.699 and the gate abstains rather than certifying. A survives-everything claim would be false and off-brand.
The manifests are JSON C2PA stand-ins stored in a SQLite soft-binding ledger, not cryptographically signed C2PA 2.0. Real C2PA 2.0 signing and an EU-residency manifest store are deferred. What the demo proves is the soft-binding mechanism itself: the recovered asset key looks up the manifest stand-in in the ledger, which is exactly the step that survives after the file metadata is stripped by a transcode.
Not in this demo. The DSP ingest webhook and the CD Baby, DistroKid, and Believe connectors are mocks and fixtures; live connectors are deferred. The releases, creators, aggregators, and takedown owners are synthetic test fixtures over procedurally generated audio, not real catalog. What is real is the gate logic: the watermark decode, the ffmpeg survival harness, the soft-binding lookup, and the deterministic Article 50 policy gate.
The Article 50 verdict is not made by an LLM. Watermark recovery, survival measurement, the soft-binding lookup, and the pass or fail rules are deterministic, unit-tested code outside any model, and each verdict cites the exact clause, for example Glasshouse blocked under Article 50(4) for three missing DDEX disclosure fields. The Pydantic AI agents only extract disclosure, draft remediation, and adversarially review, and any claim the reviewer cannot tie to stored evidence forces a downgrade to human review. Agents advise, code decides, and a regulator can cross-examine the rule that fired; this is a compliance-support gate and evidence dossier, not legal certification.
No API key is required. With no key the app runs a deterministic fallback and the survival and gate numbers are identical, because they never depend on the LLM. The stack is a Python FastAPI backend, a numpy spread-spectrum watermark with an ffmpeg survival harness, a SQLite soft-binding ledger, and a single index.html with vanilla JS, plus a provider-swappable Pydantic AI adapter defaulting to Claude claude-opus-4-8. What runs today is the real ingest-gate logic on a fixed synthetic batch; live connectors and real C2PA 2.0 signing are the named deferred items.
The research behind this demo — the architecture, the verification design, and the enterprise blueprint.
Provenance that survives the transcode, and the discipline to abstain when it does not.
If your rights-tech, trust and safety, or distribution team is working out how to show an Article 50 answer on Aug 2, 2026 without relying on metadata that social platforms strip, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.