Scan rule · RSC-PRV-018
Images without an origin note
For apps that generate images, checks whether the invisible “made by an AI” note is still attached to what they serve.
Why this matters
When an AI creates an image, it attaches an invisible note: “this is AI work, made on … by …”. You cannot see it; it sits inside the file. Since 2 August 2026 the AI Act requires AI-generated content to be identifiable, and the major providers attach that note automatically. The technical name is C2PA — you do not need to know it, only that the note should be there.
It is almost never lost on purpose. Nearly every app resizes its images, converts them to a leaner format or runs them through an image cache — and those steps discard extra information by default. The note is gone before the image reaches the first visitor. So the fault sits in the image pipeline, not in the intent.
We only check **whether** the note is there — never whether an image came from an AI. No tool could do that reliably, so we do not claim it. Conversely, a missing note proves nothing: it can be removed, and an ordinary photo never had one. Hence a low-severity hint, not a complaint.
Scan tier
How to fix it
Configure the image pipeline to keep that note — or re-attach it after processing.