Spot AI images: which generators leave traces in the file

Comparison: what each generator leaves in the file

Status as of 11 October 2026. Every row is based on the vendor's help pages and developer documentation or on the public list of C2PA conforming products, and the links in the last column lead to the sources. “Not documented” means we found no source, not that the marking is absent.

“Left after upload?” refers to metadata (C2PA, IPTC, PNG fields). An invisible watermark is more robust, but it cannot be checked in the browser.

What the columns mean

• C2PA (Content Credentials): a signed provenance record in the file. It names the issuer, the tool and often the source type, such as “created using generative AI”. Any change made outside a C2PA-aware program breaks the signature.
• IPTC Digital Source Type: a field in the XMP metadata with a fixed value, for example trainedAlgorithmicMedia. Google Merchant Center requires it for AI images and reads it from your product feed.
• Invisible watermark: a signal in the pixels, such as SynthID from Google DeepMind. It survives cropping and compression better than metadata, but only the vendor's verification service can read it.
• PNG data: text fields such as parameters or workflow in which local programs store the prompt and settings. They are not a provenance record, but they are a strong hint.

Checking metadata is not AI detection

Our checker shows what is written in the file. It does not analyse pixels and does not estimate a probability.

A finding proves that AI was involved, but not what it did, whether it generated the whole picture, replaced a background or only removed noise. The labelling duty depends on that.

A missing finding proves nothing. Metadata is lost through screenshots, cut-outs, re-exports and many uploads. In addition, providers whose AI systems were placed on the market before 2 August 2026 only have to implement machine-readable marking under Article 50(2) by 2 December 2026 (Article 111(4) AI Act, added by Regulation (EU) 2026/1744). Until then, unmarked AI images can lawfully be in circulation.

What is left after uploading

Whether the traces survive the upload into your store depends on the platform. Shopify merchants reported in the community forum that the CDN stripped XMP metadata. Shopify staff wrote in July and September 2026 that this had been fixed, but there is no changelog entry. After re-encoding on delivery, the signature of a C2PA manifest no longer matches the file in any case.

According to the Content Authenticity Initiative, platforms may remove C2PA data if their software does not support the standard. Its answer is “Durable Content Credentials”, where a watermark or a fingerprint of the image points to a copy of the record stored online.

So check the original file from the generator, not the image in your store.

Generators one by one

Labelling in your store: the file is not enough

If you use an AI tool to create or edit images for your own store, you are a deployer under the AI Act (Article 3(4), Commission guidelines para. 12, 14). If the image is a deep fake, it has needed a visible label since 2 August 2026 (Article 50(4)). The generator's machine-readable marking does not count, because your customers cannot see it (para. 117). The labelling check tells you whether an image is affected, and the label tool adds the label.