Skip to content
FREN
Menu

Standards and regulation

Standards and regulation

What C2PA, DDEX, the EU AI Act and labelling laws elsewhere in the world actually establish, where their limits lie, and why the manifesto argues for a simpler declaration scale.

Towards a common language of provenance

Every track delivered to a streaming platform comes with metadata recording who made it, who owns it and where the money goes. Until recently, none of that metadata said anything about how the track was made. Three developments are now taking place almost simultaneously. Generators are beginning to sign their output, the music industry has agreed on a shared metadata field for declaring AI involvement, and the European Union has made transparency a legal obligation. Together, these developments are beginning to establish a common language for provenance. Each has limits that need to be understood.

C2PA / Content Credentials

C2PA is an open technical standard maintained by an industry coalition. It allows signed provenance information to be attached to a media file, and the resulting provenance records are known as Content Credentials. The current specification is version 2.4, published in April 2026. Among its additions are a dedicated AI disclosure assertion and a JSON serialisation of Content Credentials (spec.c2pa.org, v2.4).

A C2PA manifest brings together three elements. It contains one or more assertions, which are statements about the file, such as "generated by tool X on date Y". A claim brings these assertions together, and a cryptographic signature secures the whole. If the file is modified without updating the manifest, the signature becomes invalid.

In music, Suno says it embeds Content Credentials in files downloaded from its service, describing them as "an industry-standard, machine-readable label that travels with the file". It also offers a public tool for checking Suno credentials (suno.com/safety, page updated 01/10/2026; suno.com/suno-credentials). These pages do not say when Suno started doing so, and we have been unable to verify the often-cited start date of January 2026. The available evidence does not establish that Udio embeds C2PA manifests. A third-party check in September 2026 found none (Undetectr, 09/2026). There is also a widespread assumption that Spotify, Apple Music or Deezer read C2PA manifests when they receive files. To our knowledge, none of those platforms has confirmed this, and we treat the claim as unverified.

The signature establishes which declarations a file carried when it was signed and that the file has not been altered since. For music generators, this provides a reliable way to say "this came from me".

There are limits to what this establishes, because C2PA signs provenance as declared at the source. The specification itself states that it "SHOULD NOT provide value judgments about whether a given set of provenance data is 'good' or 'bad'". It confines itself to checking that the assertions are correctly formed and have not been tampered with (spec.c2pa.org, v2.4). A file without a manifest therefore proves nothing either way. Most recordings made by people carry no C2PA data, and a manifest can be lost simply by re-encoding a file. Conversely, a manifest is only as trustworthy as the entity that signed it, because it records a declaration rather than an observation. Above all, C2PA does not establish human provenance. It can show that a file was generated by a known AI tool, but it can never show that it was not.

AI disclosure in DDEX

DDEX is the organisation that standardises the exchange of music metadata between record labels, distributors and platforms. Its Electronic Release Notification format (ERN) is used to deliver releases to streaming services. The latest published version, ERN 4.3.2, allows users to state that a recording, or an individual contribution to it, was made wholly or partly with a generative AI tool (DDEX knowledge base, ERN). That page does not give the publication date of version 4.3.2, which we have been unable to verify. Professionals implementing the standard describe two markers. A ContainsAI flag attached to the resource takes the values All, Partly or None, while a GenerativeAI contributor role names the tool (Sound Credit, 2026).

Platforms have begun using the standard. On 25/09/2025, Spotify announced that it would support DDEX AI disclosures in track credits (Spotify newsroom, 25/09/2025). A beta version followed on 16/04/2026, with DistroKid as the first distribution partner. These disclosures cover vocals, lyrics, instrumentation or composition and appear in track credits on mobile (Digital Music News, 22/04/2026; Rights Docket, 2026). Apple Music launched its AI Transparency Tags on 04/03/2026, initially on an optional basis. On 20/08/2026, Apple announced that, later in the year, disclosure would become mandatory when AI had been used to create a substantial part of the content. A "Made With AI" label would be visible to all listeners. As of 03/10/2026, we had found no date for the requirement to take effect (MacRumors, 20/08/2026).

On its own, this declaration proves nothing. It is self-reported. The artist or distributor chooses whether to make it, and the distributor passes it on without any supporting evidence. It is useful because it follows a standard structure, accompanies the release and can be shown to listeners. Those uploading the music still have to provide the information, though. The declaration tells us nothing about tracks for which they choose to disclose nothing.

The EU AI Act, Article 50

Article 50 of Regulation (EU) 2024/1689, known as the AI Act, sets transparency requirements for certain AI systems. Two paragraphs concern music. Article 50(2) requires providers of systems that generate synthetic audio, images, video or text to mark their outputs in a machine-readable format so that they can be detected as artificially generated or manipulated. Article 50(4) applies to deployers, meaning professional users, who must disclose deepfakes and label AI-generated text published to inform the public on matters of public interest. Audio deepfakes that reproduce a real person's voice fall under this paragraph (European Commission FAQ on Article 50).

A provider develops an AI system and places it on the EU market under its own name. A deployer uses the system professionally. A music generator is therefore a provider, while a record label or producer using a voice generator is a deployer. Personal, non-professional use falls outside the scope. These obligations apply to the tool's developer and its professional user rather than to streaming platforms as such. They do not require anyone to document a human creative process.

The question is how this definition applies to music. The Commission defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and could falsely appear authentic. Audio is explicitly included, so a cloned voice of a real artist, released as a recording of that artist, falls within the definition. For deepfakes that form part of "evidently artistic, creative, satirical, fictional or analogous works or programmes", the disclosure requirement is reduced but still applies. Disclosure must be made in a way that does not interfere with listening (European Commission FAQ).

The Commission also provides EU icons for identifying content generated or manipulated by AI. The icons are optional, although disclosure is mandatory, and signatories to the code of practice commit to following its placement rules. In every case, people must be able to perceive the disclosure "at the latest at the time of first exposure" to the content (European Commission, EU icons, updated 24/09/2026).

The timetable

Article 50 has applied since 02/08/2026 (European Commission FAQ). A limited deferral applies to generative systems already placed on the market before 02/08/2026. For these systems, the machine-readable marking requirement under Article 50(2) applies only from 02/12/2026. The obligations on deployers under Article 50(4) were not deferred (Morgan Lewis, 08/2026).

Two instruments support implementation of the regulation. The first is a voluntary code of practice on the transparency of AI-generated content, published on 10/06/2026. The Commission assessed it as adequate on 08/07/2026, followed by the European Artificial Intelligence Board on 09/07/2026. The second is a set of Commission guidelines published on 20/07/2026 (Reed Smith, 07/2026).

Where the regulation falls silent

Article 50 is limited to marking at the source and disclosing deepfakes. It does not require platforms to display an "AI" label on every generated track, says nothing about how detection should be audited and is silent on hybrid works. The manifesto's first demand calls for this information to appear on the screens people use to listen to music, which goes beyond the letter of the regulation.

Elsewhere in the world

The European Union is not alone in legislating. Several countries now require AI-generated content, including audio, to be marked or labelled, but responsibility varies between jurisdictions. In China and India, platforms themselves must label content. In the EU, South Korea and California, the obligation rests mainly with AI system providers.

Jurisdiction Law In force since Obligations for audio
European Union AI Act, Article 50 02/08/2026 (02/12/2026 for marking by systems placed on the market before 02/08/2026) Machine-readable marking by providers; disclosure of deepfakes, including cloned voices, by professional deployers.
China Measures for labelling AI-generated or synthesised content 01/09/2025 A perceptible label, taking the form of a spoken notice or sound cue at the beginning, at the end or during playback, together with marking in the metadata, including by distribution platforms.
South Korea Framework Act on Artificial Intelligence 22/01/2026 Disclosure that content was produced by generative AI, through a visible notice or machine-readable marking; fines of up to 30 million won following an announced year of lenient enforcement.
India 2026 amendment to the intermediary rules (IT Rules) 20/02/2026 Clear and prominent labelling of synthetic content by platforms, with an audible disclosure for audio; on large social networks, a mandatory user declaration checked by automated tools.
California (United States) AI Transparency Act (SB 942), amended by AB 853 02/08/2026 For providers with more than one million users a month, invisible marking in audio files, a visible disclosure offered as an option and a free detection tool.
New York (United States) Synthetic Performer Disclosure Law 09/06/2026 A clear disclosure in any advertisement featuring a synthetic performer; the law covers advertising only.

The United States

No federal law in the United States requires AI-generated content to be labelled. Two bills are under discussion in Congress. The NO FAKES Act would create a federal right protecting people's voices and likenesses against digital replicas, with procedures for takedowns and appeals. The Senate Judiciary Committee approved it unanimously on 18/06/2026, but it was blocked on the Senate floor on 30/09/2026 when Senator Ted Cruz objected to its passage without a vote. The AI Labeling Act, introduced in the Senate on 25/06/2026, remains at an early stage. It would require generative AI providers to use visible disclosures and machine-readable marking, and large platforms to identify AI-generated content.

At state level, the most direct protection for musicians remains Tennessee's ELVIS Act, in force since 01/07/2024, which protects people's voices against unauthorised cloning. A presidential executive order dated 11/12/2025 seeks to challenge state AI laws deemed too burdensome. So far, however, we have found no legal challenge to a labelling law.

The United Kingdom

In its report on copyright and AI dated 18/03/2026, the British government states: "There are no obligations in the UK for AI-generated content to be labelled". It proposes working with the sector on good labelling practice, without setting a legislative timetable, and considering a right over digital replicas that would cover voice and likeness. The same report abandons the copyright exception with an opt-out that the government had favoured for AI training. A consultation on digital replicas had been announced for summer 2026, but we have been unable to verify whether it was launched. At the end of August 2026, more than eighty performers wrote to the Prime Minister to call for a legal right over their voices.

Laws still in preparation

As of 03/10/2026, two bills had yet to be adopted. In Spain, the draft organic law on the proper use and governance of AI, approved by the Council of Ministers on 26/05/2026, is being debated in Parliament and provides for heavy fines for failure to label content. In Denmark, a proposed amendment to the copyright act would give everyone a right over their voice and likeness against realistic digital imitations, with specific protection for performers. Its entry into force had been announced for 2026, but we have been unable to verify whether it has taken effect.

International organisations

No international organisation has adopted a binding rule on AI-generated music. Their work has so far focused on assessing the impact, setting out positions and developing future standards.

On 18/02/2026, UNESCO published its global report Re|Shaping Policies for Creativity, covering more than 120 countries. It projects that by 2028 AI-generated content could cost music creators 24% of their income and audiovisual creators 21%, while 79% of the cultural professionals surveyed see it as a threat. A few months earlier, culture ministers meeting in Barcelona for MONDIACULT 2025 had adopted a final declaration on 01/10/2025. It commits them to recognising and appropriately protecting artists' and creators' intellectual property rights, including copyright and related rights, in the context of AI. It also calls for fair remuneration and transparent use of AI in the cultural sector that strengthens human agency. None of these documents is binding. The general framework remains UNESCO's Recommendation on the Ethics of Artificial Intelligence, adopted in November 2021.

WIPO (the World Intellectual Property Organization) discusses generative AI through its standing committee on copyright. The committee held an information session on copyright and generative AI during its 48th session in May 2026. The organisation also runs a series of Conversations on Intellectual Property and Frontier Technologies. To our knowledge, no treaty is in preparation.

CISAC (the International Confederation of Societies of Authors and Composers) has published a study with PMP Strategy that estimates that nearly a quarter of music creators' income is at risk by 2028, amounting to €10 billion over five years. CISAC calls for enforceable transparency obligations, prior authorisation from authors to train models on their works, and fair remuneration. We examine these projections and their limitations in our article on impact studies.

In 2024, the ITU, ISO and IEC launched a collaboration on AI and multimedia authenticity standards (AMAS), with C2PA among the organisations involved. The collaboration groups existing standards into five categories (content provenance, trust and authenticity, identifiers, rights declarations, digital watermarking). This work is laying the technical foundations for labelling.

The Council of Europe's framework convention on AI and human rights, opened for signature in 2024, has yet to enter into force. It requires five ratifications. The EU was reportedly the only party to have ratified it as of 07/09/2026, according to a secondary source we have been unable to verify. The convention addresses human rights and democracy rather than music specifically.

None of these texts requires artists to prove the human provenance of their music. They address the output of AI tools and, where voices are concerned, imitations of real people. The labels seen on Deezer, TIDAL, YouTube and, soon, Apple Music follow each platform's own policies, which we compare in Platform rules.

A simple declaration scale

C2PA and the EU AI Act largely treat a track as either "AI" or "not AI". DDEX goes further and already distinguishes three cases (all, partly, none). The manifesto calls for that distinction to become the rule, with a three-level scale that artists can fill in themselves.

  • Human creation: the music is composed, performed and produced by people, using the usual studio tools.
  • AI-assisted: a person directs the creative work, with named AI tools contributing to part of it (a sound, mastering or an initial draft).
  • AI-generated: the track was produced by a generative model from a prompt or source material.

This scale corresponds to what ERN 4.3.2 already allows (All / Partly / None) and what some platforms have begun to display. Since 01/07/2026, Traxsource has labelled every track "Human-Made" or "AI-Assisted" and removed wholly AI-generated music. Its detection partners, SH Labs and SoundPatrol, assign the labels rather than relying on artists' declarations, and content providers who challenge a label can appeal (Decoded Magazine, 23/06/2026). Deezer flags albums containing wholly AI-generated tracks. TIDAL stopped paying royalties on tracks it identifies as wholly AI-generated on 29/06/2026 and has labelled them since mid-July 2026 (Resident Advisor, 30/06/2026; TIDAL Support, 20/07/2026).

In France, the Higher Council for Literary and Artistic Property (CSPLA), which advises the Ministry of Culture, has drawn a similar line from the standpoint of copyright law. Its mission report on the status of AI productions, published on 16/07/2026, distinguishes "hybrid creation, in which humans retain a creative role and which may qualify for copyright protection if the originality threshold is met" from "synthetic production, generated without significant human intervention and which remains outside the scope of copyright" (French Ministry of Culture, 16/07/2026).

The manifesto adds one principle. The declaration must come from the artist first and name the tools used, and artists must have a right of appeal whenever a platform's detection reaches a different conclusion.

Sources

Quotations from French-language sources are our own translations.

Updated 13/10/2026