The final video file is no longer the final deliverable.
A marketing team can approve an AI-assisted commercial, upload it to one platform, crop it for another, localize the voice, and still have no reliable answer to a basic question: which public version contains the right disclosure, and which one still carries verifiable provenance?
That gap matters to global brands sourcing creative from China as much as it does to the production company. A platform checkbox may create a viewer-facing label. A Content Credential may create a machine-readable history. Neither, by itself, tells the brand how every released version was made, cleared, labelled, and maintained.
The better procurement unit is a two-rail release packet: one rail explains AI involvement to people; the other preserves signals that machines can validate. A version register joins the two.
The regulatory signal is real, but it is not a universal “label every AI edit” rule
Article 50 of the EU AI Act applies from 2 August 2026. The European Commission distinguishes between obligations for providers of certain AI systems and obligations for deployers that use those systems in professional contexts.
That distinction reaches advertising operations. In its Article 50 Q&A, the Commission says that a legal person such as an advertising company can remain the deployer even when employees, freelancers, or contractors operate the system on its behalf and under its control.
The same guidance also avoids a blanket conclusion. Standard editing assistance can fall outside the machine-marking obligation. Background generation, visual effects, and ordinary pre- or post-production are unlikely to create a deepfake when audiences are not led to believe that the represented person, object, place, or event is authentic or truthful. Context, resemblance, message, and reasonable audience expectations all matter.
For content that does qualify as a deepfake, however, the Commission is explicit: the deployer’s disclosure must be clear and perceivable at first exposure. A machine-readable mark alone does not fulfil that human-facing obligation.
For buyers, the practical conclusion is narrower and more useful than “put an AI badge on everything.” First map what was generated or materially altered. Then decide which market, platform, format, and audience require a human disclosure, a machine-readable provenance signal, or both. Legal counsel should make the jurisdiction-specific call; the production brief should make sure the required evidence exists.
Platforms already treat disclosure and provenance as separate inputs
Platform workflows reinforce the two-rail model.
YouTube requires disclosure when AI meaningfully alters or generates photorealistic content, including realistic scenes that did not occur. It can also carry forward information from valid Content Credentials in some circumstances.
TikTok provides creator-applied and automatic AI labels. It says Content Credentials can help trigger automatic identification and labelling of AI-generated content.
Google introduced a “How this ad was made” panel and AI labelling controls for its advertising products in July 2026. Google also warns that using its AI label setting does not, by itself, guarantee compliance with a specific law.
These are not interchangeable distribution switches. They are channel-specific ways to receive a disclosure decision. A global campaign therefore needs a controlled source record upstream of the platform UI.
Provenance answers “what happened to this file,” not “is every claim true?”
Content Credentials, based on the C2PA standard, can carry signed information about an asset’s origin, ingredients, editing actions, and AI involvement. C2PA 2.4, released in April 2026, added a dedicated AI Disclosure assertion alongside existing provenance signals.
That is valuable, but its limits are commercially important. A valid credential can help a verifier determine who signed a statement, whether the statement remains bound to the asset, and what the recorded workflow says. It cannot prove that a product demonstration is accurate, that a performance claim is substantiated, or that a likeness was properly licensed.
Provenance is therefore one layer of evidence, not a truth certificate. Product facts, advertising claims, talent consent, music rights, territory, term, and model restrictions still need their own review.
This is why the two rails cannot replace each other. A visible label may survive as pixels but carry no detailed production history. Rich metadata may record the history but be invisible to the person seeing the ad. A release-ready asset needs both where the risk and rules require them.
The ONCE two-rail release packet
The framework below turns that distinction into four contract deliverables.
1. Synthetic scope sheet
List the image, audio, voice, performance, product state, background, or text elements that were generated or materially altered. Separate them from routine work such as colour correction, cleanup, noise reduction, or standard compositing.
“AI was used” is too vague. The scope sheet should answer three questions: what changed, what remained factual, and what a reasonable viewer might mistake for a real capture or event.
2. Human disclosure plan
For each market and channel, specify the approved wording, language, placement, timing, duration, and accessibility treatment. A sound-off feed may require a visible treatment. An audio-led placement may require an audible one. A responsive ad may crop creative-edge labels, so the plan must test actual renderings rather than only the master canvas.
Record the approver and the applicable version. Do not leave the decision to the person uploading the file at the end of the campaign setup.
3. Machine provenance packet
Where the workflow supports it, deliver a master with Content Credentials or another relevant provenance signal, plus a validation result, signing identity, tool-chain summary, and recorded generation or editing actions.
The acceptance test belongs after the final export. “Our software supports C2PA” is not proof that the released file validates. If a transcode, crop, or platform process removes a credential, the packet should record where that happened and whether the team re-signs the derivative or preserves an external verification record.
4. Release version register
Assign a stable identifier to every aspect ratio, language, voice, market, and platform version. For each identifier, record the source master, synthetic scope, disclosure copy, provenance status, rights term, and live destination.
This is where the two rails meet. A reviewer should be able to select any live version and answer: what did viewers see, what could a machine validate, and which rights and approvals applied?
If a project uses a real person’s likeness, a cloned voice, restricted reference material, or third-party models, attach those permissions to the relevant versions. ONCE’s earlier guide to control rights in automated creative systems covers approvals, change logs, and exit controls; this release packet applies those controls to the public asset itself.
Compare suppliers by the cost of a verifiable release, not the cost of adding a badge
A disclosure overlay can be cheap. Maintaining a trustworthy release family is the actual work.
Use this conditional cost model:
Cost per verifiable released version = (creation and finishing + source and rights review + human disclosure adaptation + provenance packaging and validation + version archive and withdrawal preparation) ÷ versions that pass both rails.
The formula intentionally avoids an invented industry average. It exposes missing work instead.
A low quote may cover one label on the horizontal master but no verification of the vertical and localized cuts. A vendor may promise embedded metadata without testing the final file. A campaign may have perfectly valid permissions but no register showing which live versions must be removed when those permissions expire.
Four stress tests make the comparison concrete:
- No-tool test: Can an ordinary viewer receive the required disclosure without opening a specialist inspector?
- Re-export test: After cropping, compression, dubbing, or captioning, does the provenance still validate? If not, is there a defined re-signing or external-record process?
- Derivative test: Does a new market, language, or platform trigger a fresh disclosure and rights check rather than copying the old answer?
- Withdrawal test: If a right expires or a claim changes, can the team identify every live version that is affected?
Set the review depth by what the audience could reasonably believe
Not every use of AI needs the same production response.
Routine cleanup, noise reduction, standard editing, and unpublished internal prototypes can usually remain in the production log unless another rule or contract says otherwise.
Material synthetic changes to product appearance, use context, voice, or performance deserve a synthetic scope sheet and market-specific disclosure assessment, even when the creative treatment is visibly stylized.
Photorealistic representations of identifiable people, voices, real places, events, or product capabilities require the highest level of review when they could be mistaken for authentic capture or truthful representation. For EU-facing work and other regulated markets, legal and platform review should happen before release, not after the upload form raises a warning.
This is a production decision framework, not legal advice. Its purpose is to move the right questions into the brief while there is still time to design the evidence.
The durable deliverable is a release map
Platforms and jurisdictions are unlikely to converge on one label, one icon, or one technical signal. A brand cannot control that landscape. It can control whether every released asset has a known origin, an approved human disclosure, a validated machine signal where supported, and an owner who can update or withdraw it.
So the next AI commercial brief should not ask only, “Can you add an AI label?” It should ask:
- Which elements are synthetic?
- What will the audience be told?
- What can machines verify in the final file?
- Who owns the register for every public version?
When those answers travel with the campaign, the brand has more than a file that can run today. It has an asset that can still be explained, adapted, and governed tomorrow.
