C2PA watermarks and state AI laws are changing political advertising by requiring campaigns to document where digital media came from, disclose when artificial intelligence altered an image, video, audio clip, or text, and maintain records that can be checked after publication. C2PA supports this process through cryptographically verifiable Content Credentials. At the same time, election laws and regulatory directions set rules for visible labels, machine-readable markers, distribution restrictions, takedowns, penalties, and responsibility for deceptive synthetic media. Together, these measures are pushing campaigns to treat content authenticity as part of production, legal review, publishing, and incident response.
Political campaign teams can no longer treat AI disclosure as a caption added seconds before publication. A campaign ad might pass one platform’s review and still violate a state rule because its label is too small, its audio disclosure appears too late, its metadata is missing, or it was distributed during a restricted pre-election period.
The result is a new operating model. Creative teams, media buyers, consultants, legal reviewers, data teams, candidates, and platform managers must work from the same verified asset record. Every material edit needs a clear owner, every AI-assisted element needs classification, and every final export needs to match the rules of the place where it will run.
Why Political AI Advertising Now Requires More Than a Disclaimer
A visible disclaimer tells voters that a piece of media contains AI-generated or digitally altered material. It does not, by itself, record who produced the file, what was changed, when the change occurred, or whether someone replaced the original media after approval.
C2PA addresses a different part of the problem. Its Content Credentials architecture stores signed provenance information associated with a digital asset. The specification supports information about creation, edit actions, capture details, content bindings, and other production events. These records are digitally signed and attached to a manifest that can be validated by compatible software.
Political AI rules then add legal duties. Depending on the jurisdiction, a campaign can face requirements covering visible disclosures, audio notices, metadata, publication timing, candidate consent, parody exceptions, civil remedies, criminal penalties, or removal procedures.
This means campaigns need two connected controls.
The first is technical provenance, which helps verify the origin and editing history of the asset.
The second is legal disclosure, which communicates the artificial or manipulated nature of the media in the form required by the applicable rule.
Neither control replaces the other.
C2PA Is a Provenance Standard, Not Merely a Visible Watermark
The term “AI watermark” is often used to describe several different technologies. It can refer to a visible label placed over an image, an invisible signal embedded in pixels or audio, a metadata record, a digital signature, or a broader content-authentication system.
Research reviewing AI transparency policy found that legislative documents often use “watermark” inconsistently. Some rules treat it as an invisible marker, while others use it as a general name for all disclosure and provenance methods. This lack of precision can produce compliance requirements that are difficult to interpret or technically unrealistic.
C2PA is better understood as a standard for Content Credentials. A compliant credential can contain signed information about an asset’s origin, production history, edits, and relationship to other source files.
A voter might see a small Content Credentials icon or disclosure interface, but the useful information sits behind that interface. A validator checks the digital signature, the relationship between the credential and the media file, and whether the protected content matches the signed record.
For campaigns, this makes C2PA useful as an asset-control system. It can help distinguish an approved campaign export from a copied, altered, re-encoded, or impersonated version circulating elsewhere.
How Cryptographic Content Binding Works
C2PA uses content bindings to connect a digital asset to its provenance record. A hard binding relies on cryptographic hashes that identify the whole asset or a defined part of it. A validator can use that binding to confirm that the manifest belongs to the asset and check whether protected portions of the file changed after signing.
This matters in political advertising because a small edit can change the meaning of an approved asset. Someone could replace the voiceover, shorten a statement, alter subtitles, modify a candidate’s facial expression, or add fabricated footage while keeping the same file name and visual branding.
A valid hard binding can show that the circulated file does not match the signed campaign version. It does not automatically identify who altered it, but it gives investigators, platforms, journalists, and campaign teams a stronger technical basis for separating the approved original from an altered copy.
C2PA also supports soft bindings. These can use fingerprints or invisible marks to identify related content even after the raw file changes through resizing, compression, or re-encoding. A soft binding can also help reconnect a file to provenance information stored elsewhere when embedded metadata has been removed.
Campaigns should not depend on only one binding method. A safer setup combines signed provenance, durable identifiers, visible disclosure, controlled source storage, and an archive of every published version.
What C2PA Can Verify
C2PA can help establish that provenance information was signed, that the signer’s credential can be checked, and that the protected asset has not changed in an unrecorded way.
It can also store production information such as the editing actions performed, the software or device involved, references to source ingredients, and the relationship between an original and a later version.
For political campaigns, this supports several practical uses:
A campaign can show that a candidate video came from its approved production system.
A media buyer can confirm that the supplied ad matches the signed master file.
A platform can inspect machine-readable provenance before accepting or labeling the upload.
A fact-checking team can compare a suspicious viral clip with the campaign’s authenticated original.
A legal team can retain a record of the version approved for each jurisdiction.
A campaign can provide authenticated source media when responding to an impersonation incident.
These capabilities make provenance useful for both disclosure and defense.
What C2PA Does Not Prove
A valid Content Credential does not prove that every statement inside a political advertisement is accurate. It proves facts about origin, signing, and production history according to the information recorded by the signer.
An authenticated campaign ad can still contain misleading editing, selective context, inaccurate statements, or unfair comparisons. A credential shows that the identified source signed the file. It does not certify the political message as true.
C2PA also does not guarantee that every copy will preserve embedded provenance. Social platforms, messaging applications, editing tools, screenshot workflows, and file converters can remove metadata. Visible labels can be cropped. Invisible marks can be damaged. Detection systems can return uncertain results.
Researchers studying AI transparency policy warn that no single watermarking or detection method solves the entire problem. Technical systems need legal duties, platform controls, human review, public education, independent testing, and clear responsibility across the production and distribution chain.
Campaigns should therefore present C2PA as an authenticity signal, not as an absolute certificate of truth.
State AI Laws Are Creating a Political Advertising Patchwork
As of June 2026, 31 U.S. states had enacted laws regulating political deepfakes. Three used forms of prohibition, while 28 relied mainly on disclosure requirements. Some rules apply only within a defined period before an election, while others apply more broadly.
This patchwork makes national campaign distribution difficult. A single ad can be subject to different requirements based on the voter’s location, the candidate depicted, the type of media, the publication date, the sponsor, and the level of artificial alteration.
Some laws focus on media that creates a realistic but false depiction of a candidate. Others cover political advertising generated in whole or substantially through AI. Certain statutes require an intent to injure a candidate or deceive voters. Others place responsibility on the distributor once the person knows or reasonably should know that the content is synthetic.
A campaign cannot safely create one universal disclosure template and assume it works everywhere. It needs a jurisdiction matrix connected to its media plan.
Disclosure Laws and Prohibition Laws Work Differently
A disclosure rule generally permits synthetic political media when the advertisement contains the required notice. The notice might need to state that the content was generated, edited, altered, or manipulated using artificial intelligence.
A prohibition rule can restrict distribution even when a label is present. These laws tend to focus on deceptive synthetic media during sensitive election periods, especially when the content falsely depicts a candidate saying or doing something that did not occur.
Some states allow candidates to seek an injunction that stops further publication. Others provide damages, fines, attorney costs, or criminal penalties. The legal result can therefore extend beyond platform rejection. A campaign may face urgent court action during the final weeks of an election, when lost distribution time is difficult to recover.
Creative teams should classify the legal treatment before production begins. An idea that is permitted with disclosure in one state can face distribution restrictions in another.
Election Windows Change the Risk Level
Many political deepfake laws apply during a defined period before an election. Examples in current state rules include 45-day, 60-day, 90-day, and 120-day windows. Some extend beyond Election Day, while other requirements remain active throughout the year.
The publication date therefore becomes part of the compliance record.
Campaign teams should connect every synthetic asset to:
The relevant election.
The jurisdictions where it will appear.
The first and final publication dates.
The candidate, party, or ballot measure depicted.
The planned media channels.
The required disclosure format.
The responsible campaign entity.
The approved source files.
The date the final version was signed and archived.
This information should be available before a media buyer activates the advertisement. Waiting until a platform requests documentation increases the chance of missed deadlines and inconsistent explanations.
Metadata Requirements Are Becoming More Specific
Visible text is not the only disclosure method appearing in election rules. Colorado and Utah include additional requirements involving metadata or digitally embedded information. Colorado’s rule, for example, can require metadata describing the disclosure, the tool used to create the deepfake, and the time of creation.
Metadata requirements push campaigns toward structured production records. A generic note such as “edited with AI” is not always sufficient. The campaign might need to identify the tool, generation time, responsible party, or other file information.
C2PA can support this process, but campaigns must map the legal requirement to the actual credential fields. Adding a Content Credential does not automatically satisfy every disclosure law. The manifest must contain the needed information, the final file must preserve it, and the receiving platform must be able to read it.
The legal disclosure should also remain understandable to ordinary viewers. Machine-readable data supports automated checking, while visible or audible language informs the voter.
Visible Labels Must Survive Every Ad Format
Political ads rarely remain in one aspect ratio. A campaign might begin with a 16:9 video, then create square posts, vertical reels, short clips, thumbnails, display banners, television versions, and messaging-app exports.
A label that is clear in the master file can disappear after cropping. It can also become unreadable on a mobile screen, sit behind a platform interface, or vanish when a distributor trims the beginning of the clip.
Compliance review must therefore happen after each final export, not only on the original design.
For visual media, teams should check the label’s size, position, duration, contrast, language, and relationship to platform interface elements.
For audio, teams should check the wording, volume, speaking speed, timing, and placement.
For multilingual campaigns, each version should carry a disclosure that the intended audience can understand.
For thumbnails and preview frames, the campaign should confirm whether a separate disclosure is required or advisable.
These checks should be recorded with screenshots and file hashes.
India’s Election Rules Show How Detailed Disclosure Can Become
Indian election directions provide a useful example of format-specific controls. Political parties, candidates, and campaign representatives have been directed to label synthetic or AI-altered campaign content using wording such as “AI-Generated,” “Digitally Enhanced,” or “Synthetic Content,” together with disclosure of the originating entity. Authorities also directed that unlawful or misleading AI-generated material be acted on within three hours after it is brought to a social platform’s attention.
Additional election guidance has described disclosures covering at least 10 percent of the visible display area for images or videos, with an audible notice during the initial portion of audio content.
These requirements should not be presented as universal global rules. The 10 percent placement standard and three-hour process arise from a specific election and regulatory context.
The wider lesson is still relevant. Regulators are moving from general instructions to measurable requirements covering label size, placement, origin information, and response time.
Campaigns operating across countries need separate compliance profiles for each market.
European Rules Add Machine-Readable Marking Duties
European transparency obligations add another layer for political campaign vendors and content systems serving European audiences. From August 2, 2026, providers of covered generative AI systems must support machine-readable marking that enables AI-generated or manipulated content to be detected. Deployers must disclose certain deepfakes and qualifying AI-generated public-interest material.
The requirements distinguish between the provider of an AI system and the person or organization using it. A political consultancy that creates its own generation workflow, custom interface, or integrated content system should assess whether it has responsibilities beyond those of an ordinary user.
The rules also recognize that minor assistive editing can differ from synthetic generation or material manipulation. Standard corrections and routine production assistance do not always receive the same treatment as realistically fabricated content.
Campaign vendors should document which functions their systems perform, what outputs are marked, how the marking survives export, and what visible notice appears when content is published.
Free Speech Limits Affect How Deepfake Laws Are Written
Political speech receives strong constitutional protection in the United States. Laws that restrict synthetic political content can face legal challenges when they are too broad, vague, or burdensome.
Courts have objected to rules that covered a wide range of political expression without tying liability to concrete harm. Disclosure requirements for satire and parody have also faced scrutiny when the required notice overwhelmed the message. California and Hawaii provisions have been struck down in federal court, although those decisions do not automatically invalidate laws in other states.
Future laws are therefore likely to focus more closely on realistic deception, voter interference, intimidation, impersonation, measurable harm, and clear knowledge standards.
Campaigns should not interpret a court decision against one law as permission to distribute deceptive synthetic media everywhere. Other state statutes, platform policies, defamation rules, right-of-publicity protections, election laws, fraud rules, and candidate remedies can still apply.
Campaign Compliance Must Start Before Content Generation
A safe workflow begins with the creative brief.
Before a designer, editor, strategist, or AI operator produces content, the brief should state:
Whether the asset will contain synthetic media.
Whether a real person’s face, voice, body, or mannerisms will be recreated.
Whether source footage will be materially altered.
Whether the content is satire, parody, commentary, advocacy, or a direct campaign advertisement.
Where the asset will run.
When it will be published.
Which disclosure rules apply.
Who owns final approval.
This prevents legal review from becoming a last-minute attempt to repair a finished advertisement.
The brief should also identify prohibited uses, such as unauthorized voice cloning, fabricated endorsements, false voting instructions, impersonated election officials, or altered statements that change a candidate’s meaning.
Every AI-Assisted Asset Needs a Production Record
Campaigns should create an asset record as soon as production starts. The record should follow the media through drafting, review, approval, export, and publication.
A useful record includes the project name, asset owner, generation tools, source files, prompts where retention is permitted, reference media, editing actions, human reviewers, disclosure decision, jurisdiction, approval status, final file hash, Content Credential status, and publication links.
The record should distinguish minor assistance from material generation.
Spell-checking, noise reduction, basic color correction, background cleanup, translation assistance, synthetic voice generation, face replacement, lip synchronization, scene creation, and fabricated candidate footage should not be grouped under one generic “AI used” field.
The category affects both legal treatment and voter interpretation.
Campaigns Need a Signed Master and Controlled Derivatives
The final approved asset should become the signed master version. The campaign should retain this file in a controlled repository together with its provenance data, legal approval, disclosure text, and publication plan.
Every derivative should be generated from that master or from an approved source version.
A vertical cut, translated version, shortened clip, new thumbnail, compressed export, or subtitled copy should receive its own review and asset identifier. The team should not assume that approval automatically carries over after editing.
When possible, each derivative should have a new Content Credential that records its relationship to the earlier asset.
This creates a traceable chain between the original production, approved master, and platform-specific versions.
Platform Uploads Need a Final Authenticity Check
Before publication, the campaign should verify the exact uploaded file rather than checking only the file stored locally.
Platforms sometimes re-encode videos, compress images, remove metadata, generate preview versions, or alter playback behavior. A campaign should inspect the live or scheduled post to confirm that the visible disclosure remains readable and that any supported provenance indicator appears correctly.
The publishing operator should retain:
A screenshot of the final post.
The publication time.
The platform and account.
The uploaded file identifier.
The live URL.
The disclosure shown to viewers.
The Content Credential validation result.
The person who completed the check.
This information becomes useful when responding to an objection, platform review, legal notice, manipulated repost, or false attribution.
Political Deepfake Response Plans Need a Three-Part Process
A campaign’s response plan should cover detection, verification, and action.
Detection includes social monitoring, candidate impersonation alerts, platform reports, journalist inquiries, supporter submissions, and internal review.
Verification compares the suspicious media with signed source files, archived footage, original audio, approved scripts, and production records. Teams should avoid relying on a single AI detector because detection tools can produce uncertain or incorrect results.
Action can include submitting authenticated originals to platforms, publishing a correction, contacting election authorities, issuing a legal notice, briefing the candidate, preserving the suspicious file, and documenting its distribution.
The plan should assign decision authority before an incident occurs. A rapid response is difficult when no one knows whether the legal team, campaign manager, communications lead, candidate, or platform representative has final control.
Watermark Removal and Forgery Remain Serious Risks
A determined actor can attempt to remove visible labels, strip metadata, damage invisible signals, or manufacture a false authenticity marker.
Research has also raised concern that poorly understood watermark systems can create false confidence. A bad actor could attach a familiar-looking label to deceptive content, while voters assume the label itself proves authenticity.
This is why verification must inspect the cryptographic record, signer identity, content binding, and validation status. A logo or icon copied onto an image has no value without a valid signed provenance record behind it.
Laws that prohibit watermark removal also require careful drafting. Normal operations such as compression, translation, copying, formatting, or metadata removal can damage disclosures without malicious intent. Overbroad rules can also interfere with security testing and research that examines weaknesses in transparency systems.
Campaign policy should distinguish accidental loss, routine processing, authorized editing, deliberate concealment, and hostile manipulation.
YouTube Campaign Teams Need Compliance-Aware Testing
Political YouTube teams can still use AI for title development, thumbnail concepts, hook analysis, topic research, and performance review, but testing must remain connected to the approved content record.
For title variations, AI can help produce clear options for different audience intents. The final title should accurately represent the video and avoid language that falsely attributes words or conduct to an opponent.
For thumbnail testing, every variation should be reviewed for synthetic candidate depictions, altered facial expressions, fabricated scenes, disclosure placement, and potential impersonation.
For hook analysis, AI can compare opening scripts for clarity and retention without creating a false quotation or misleading edit.
For topic selection, teams can group voter concerns from lawful research sources and develop content themes without generating fake public reactions or fabricated testimonials.
For click-through-rate review, teams can compare impressions, CTR, watch time, retention, and traffic source by approved thumbnail and title version. Performance data should never become a reason to remove a required disclosure or exaggerate an artificial scene.
The experiment log should connect each title and thumbnail to the corresponding approved video asset.
Vendor Contracts Need Clear AI Content Duties
Campaign contracts should define who is responsible for AI classification, candidate consent, disclosure text, metadata, Content Credentials, legal review, source retention, platform compliance, and incident response.
A vendor should not deliver only a flattened final video with no production record.
Contracts can require:
Disclosure of all generative tools used.
Retention of source files and editing history.
Written approval for synthetic likeness or voice use.
Preservation of required metadata.
Support for C2PA signing where available.
Notification when a tool removes provenance information.
Delivery of platform-specific compliant exports.
Cooperation during takedowns or authenticity disputes.
Deletion or controlled storage of candidate voice and likeness models after the project.
Responsibility for subcontractors and external creators should also be stated.
Campaigns Should Build a Jurisdiction-Aware Compliance Engine
Large campaigns can reduce manual errors by connecting their asset library to a structured rules system.
Media type, AI use, depicted person, election, jurisdiction, publication window, disclosure language, label placement, metadata requirement, and approval status can tag each asset.
The publishing system can then block an export when required information is missing.
For example, a vertical video intended for multiple states could trigger different instructions for disclosure wording, metadata, election timing, and legal approval. An Indian campaign export could trigger label-size and originating-entity checks. A European deployment could trigger machine-readable marking and visible deepfake-disclosure review.
Automation should support human reviewers, not replace them. Election rules change, court orders affect enforceability, and creative context matters.
Verified Real Media Will Become a Campaign Asset
Campaign compliance is often described only as a restriction. Provenance also creates a positive use case.
A campaign can publish authenticated candidate speeches, policy announcements, interviews, emergency statements, debate clips, endorsements, and field footage with verifiable origin information.
When a manipulated copy appears, the campaign can point platforms and the public toward a signed original.
This approach shifts the campaign from merely labeling synthetic media to authenticating important real media.
The value is strongest when provenance begins at capture. Camera-based signing, controlled upload systems, source preservation, and authenticated editing histories can create a stronger record than adding metadata only at the final export stage.
Verified original media can also help journalists and election authorities review disputed content more quickly.
What Political Campaigns Should Do Now
Campaigns should begin with a full audit of current AI use. The audit should cover image generation, video editing, voice tools, translation, avatars, chat systems, text generation, targeting workflows, social publishing, and vendor production.
The next step is to classify every use by legal and reputational risk.
Low-risk assistance can follow a lighter review process.
Materially altered candidate media should receive legal, communications, and technical review.
Realistic synthetic speech, fabricated conduct, or unauthorized likeness use should face strict approval controls or prohibition.
Campaigns should then establish an asset register, disclosure templates, jurisdiction rules, Content Credential process, vendor clauses, platform checklists, and a deepfake response plan.
The final goal is not to label every file in the same way. It is to create a dependable process that identifies what changed, records who approved it, applies the correct disclosure, preserves the signed original, and supports fast verification after publication.
C2PA and AI election laws are moving political advertising away from informal creative production and toward accountable media operations. Campaigns that build these controls early will be better prepared for platform reviews, legal changes, authenticity disputes, and voter scrutiny.
C2PA Content Credentials and state AI laws are changing political advertising from an informal creative process into a documented compliance workflow. Campaigns must now track how media was created, identify material AI alterations, apply the correct disclosures, preserve approved files, and verify that labels and provenance data remain intact after publication.
C2PA helps establish an asset’s origin and editing history through signed provenance records, but it does not confirm that every political statement is accurate. Legal disclosures, human review, platform checks, source retention, and rapid response procedures are still necessary. Campaigns should combine visible labels, machine-readable credentials, secure archives, jurisdiction-specific rules, and clear vendor duties.
The safest approach is to build compliance into the campaign workflow before content production begins. Teams that authenticate real media, document synthetic content, review every platform-specific export, and prepare for deepfake incidents will be better equipped to protect candidates, meet election rules, and maintain public trust.
C2PA Watermarks and State AI Laws in Political Ads: FAQs
What Is C2PA in Political Advertising?
C2PA is a technical standard for attaching cryptographically verifiable Content Credentials to digital media. These credentials can record an asset’s origin, creator, editing history, source files, and production actions.
How Do C2PA Content Credentials Work?
Content Credentials connect a signed provenance record to an image, video, or audio file. Compatible systems can inspect the record to confirm who signed the asset and whether protected parts of the file changed after signing.
Are C2PA Credentials the Same as Visible Watermarks?
No. A visible watermark is text, a logo, or a label displayed on the media. C2PA primarily uses machine-readable provenance records, although platforms can display an icon or interface that allows users to view those records.
Can C2PA Prove That a Political Advertisement Is True?
No. C2PA can help verify where an asset came from and how it was edited. It does not verify the accuracy of political statements, policy comparisons, statistics, or campaign messages contained in the advertisement.
Why Are Political Campaigns Using C2PA?
Campaigns can use C2PA to authenticate official media, document AI-assisted editing, separate approved assets from manipulated copies, and provide platforms or journalists with verifiable source information during a dispute.
What Are State AI Laws for Political Advertisements?
State AI laws regulate the use of artificial intelligence and synthetic media in election communications. They can require disclosures, restrict deceptive deepfakes, create candidate remedies, and impose civil or criminal penalties.
Do All States Use the Same Political AI Rules?
No. Requirements differ by state. A disclosure that satisfies one state’s law might not meet another state’s rules concerning wording, placement, timing, metadata, consent, or prohibited content.
What Is a Political Deepfake?
A political deepfake is synthetic or materially manipulated media that realistically depicts a candidate, election official, public figure, or other person saying or doing something that did not occur.
Are All AI-Generated Political Advertisements Illegal?
No. Many jurisdictions permit AI-generated political media when it includes the required disclosure and does not violate rules concerning impersonation, deception, voter suppression, fraud, defamation, or candidate rights.
What Disclosures Can Political AI Advertisements Require?
An advertisement can require visible text, an audible notice, machine-readable metadata, sponsor identification, originating-entity information, or wording that states the media was AI-generated, synthetic, or digitally altered.
When Do Election Deepfake Restrictions Apply?
Some restrictions apply throughout the year, while others become active during a specific period before an election. The applicable period can vary by jurisdiction and election type.
Can C2PA Metadata Be Removed From Political Content?
Yes. Editing software, screenshots, file conversion, compression, and social media processing can remove or damage embedded metadata. Campaigns should retain signed originals and use additional disclosure and verification methods.
Can Someone Create a Fake C2PA Label?
A person can copy the appearance of a Content Credentials icon, but that does not create a valid credential. Verification requires checking the digital signature, signer identity, content binding, and manifest validation status.
What Is the Difference Between Provenance and Disclosure?
Provenance records how an asset was created and modified. Disclosure informs the audience that artificial intelligence or digital manipulation was used. Political campaigns often need both.
How Should Campaigns Store AI-Generated Political Assets?
Campaigns should keep source files, approved exports, prompts where appropriate, editing records, disclosure decisions, legal approvals, file hashes, Content Credentials, publication dates, and platform links in a controlled asset system.
Do Political Campaigns Need Candidate Consent for AI Voice or Likeness Use?
Consent requirements depend on the jurisdiction and the type of use. Campaigns should obtain written authorization before creating synthetic versions of a candidate’s face, voice, body, or mannerisms.
How Do State AI Laws Affect Political Ad Vendors?
Vendors can be required to document the tools they use, preserve source files, apply disclosures, retain provenance information, protect candidate likeness data, and support the campaign during takedown or authenticity disputes.
How Should Campaigns Respond to a Political Deepfake?
Campaigns should preserve the suspicious file, compare it with authenticated originals, document its distribution, report it to relevant platforms, notify legal and communications teams, and provide verified source media when requesting removal.
Can Campaigns Use AI for YouTube Titles and Thumbnails?
Yes. AI can help create title variations, thumbnail concepts, hooks, and topic ideas. Each version should accurately represent the video and avoid fabricated quotations, deceptive candidate depictions, or misleading synthetic scenes.
What Should Political Campaigns Do to Prepare for New AI Laws?
Campaigns should audit their AI tools, classify high-risk uses, create jurisdiction-specific disclosure rules, establish a C2PA workflow, update vendor contracts, retain approved media, and prepare a rapid deepfake-response process.
