After a second draft in March, the final text asks providers to embed machine-readable marks that survive common transformations, to publish detection tools or APIs, and to document reliability. Deployers get templates for deepfake and AI-text disclosures. The code is voluntary but is the Commission's stated benchmark for compliance.
What to do: implement C2PA-style credentials plus watermarking for images, audio and video, test survival through compression and cropping, and prepare the detection interface.