You may rely on your model provider's marking. But the responsibility to demonstrate it stays with you — reliance does not transfer it.
Providers are inconsistent
Coverage differs by provider and by modality, and open-weight models mark nothing at all. Multi-provider failover makes it worse.
Proof is the hard part
Running a check is easy. Showing, eight months later, what you checked and what it said at the time is not.
Start with the free checker
$ npx ai-act-verify ./generated-image.png
generated-image.png (PNG, 412.7 KB)
C2PA manifest PRESENT— PNG 'caBX' chunk
XMP present
validation NOT PERFORMED— presence is not validity
Open source, no account, no dependencies. It answers one question honestly:
is a provenance manifest there, or not?
What the product adds
Verify, then rely
Every generated asset is checked against the marking you expect from that provider, at the moment you ship it.
Evidence you can show
Append-only, hash-chained records: what was checked, when, under which policy version. Hashes only — never your prompts or outputs.
It also says "you're fine"
Several kinds of output are outside the marking obligation. Telling you that is part of the product, not a lost sale.
What we will not claim
We do not make anyone "legally compliant." We provide technical controls and evidence. Whether that satisfies an obligation is a legal question, and it stays yours.
Present is not valid. Detecting a manifest is not the same as validating its signature and trust chain. We label the two differently, always.
Text is not ready yet. Text detection APIs are not publicly available today, so for text we can record a dated assertion — not a verification. We start with images and audio, where verification is real.
Early access pricing
€199/ month
Verification of upstream marking on images and audio
Dated, hash-chained evidence records
Scope evaluation per output — including "no action needed"