Ropemark Image Marking for the EU AI Act

Description

Since 2 August 2026 the EU AI Act (article 50) requires AI-generated and AI-manipulated images to be marked in a machine-readable way and, when they show people or scenes that look real, to be disclosed visibly to the public. If you publish virtual models, AI product shots, campaign visuals or any image made with Midjourney, Nano Banana, DALL·E, Firefly, Stable Diffusion or similar tools, this concerns your WordPress site.

Ropemark does four things: it marks files that lack the IPTC marking, keeps the marking in every size WordPress generates, discloses it on the page and documents it in the Media Library.

1. The visible disclosure

• AI badge: a round, semi-transparent “AI” mark overlaid on AI-generated images, in the corner you choose. Text or your own icon, diameter, colors, opacity, minimum image width and tooltip are settings; the markup carries CSS classes your theme can restyle.
• Provenance popup: a click on the badge opens a small panel with type, disclosure text, creator, credit, generator and marking of that image. It is plain HTML kept hidden in the page, readable by assistive technology and search engines.
• Per image: not every AI image needs the badge. Each attachment can follow the settings, always show it or never show it, one by one or in bulk.
• Text label under AI images, site notice at the end of every page, and a [ropemark_disclosure] shortcode plus an “AI disclosure notice” block for your transparency page, with the count of AI images.
• Data attributes (data-ai-generated, data-digital-source-type) and schema.org ImageObject with digitalSourceType for search engines and AI crawlers.

2. The machine-readable marking, written and kept

WordPress never touches the file you upload, but every size it generates (thumbnails, medium, large and the scaled copy it serves as “full”) comes out of GD or Imagick without XMP and IPTC. The marking your generator or your DAM wrote into the original is gone from the images your pages actually show.

• The plugin reads the provenance of each upload: the IPTC DigitalSourceType term (trainedAlgorithmicMedia, compositeWithTrainedAlgorithmicMedia, and the rest of the vocabulary), the disclosure text, creator, credit and rights, and whether a C2PA / Content Credentials manifest is present, with the names of the tools that signed it (Google, Adobe Lightroom, Photoshop, and so on).
• It carries the marking into every generated size, byte for byte, without re-encoding pixels: JPEG, PNG and WebP.
• You decide what to carry (the whole XMP and IPTC blocks, or only the provenance fields), into which sizes, and whether the original is left untouched or cleaned of post-production traces (Camera Raw settings, document history) while keeping the marking.
• Manual classification for files that carry no marking (most retouched images lose it): “AI generated”, “AI modified” or “not AI”, per image or in bulk. An AI classification writes the IPTC digital source type into the sizes and, unless the original carries a C2PA manifest, into the original. A manual choice becomes a machine-readable marking that travels with the file.
• Generator traces: files without a formal marking but with signs of Midjourney, DALL·E, Firefly, Stable Diffusion, ComfyUI, Google, OpenAI and others (software fields, PNG parameters, XMP) are listed as “Suspected AI, to confirm”, never marked automatically.

3. The audit trail in the Media Library

• A column and a badge in the list view, a badge on grid tiles.
• A read-only provenance panel in the attachment details: digital source type, disclosure text, creator, credit, rights, C2PA signers, and which generated sizes carry the marking.
• A filter: AI generated or modified, suspected AI, with provenance marking, without.
• Bulk actions to classify and to show or hide the badge, a library scan for everything uploaded before the plugin, a CSV export of the AI images for your audit file, and WP-CLI.
• The record is exposed on the REST API attachment endpoint for headless themes.

What the plugin does not do

• It does not guess whether an image is AI-made by looking at pixels. It reads what the file declares in the standard vocabularies (IPTC Photo Metadata, C2PA). Files with no marking are shown as “No marking”: write the marking in production, before upload (most generators do it; exiftool or any DAM can add DigitalSourceType).
• It does not copy C2PA manifests into resized copies. A C2PA signature covers the exact bytes of the original file, so a copy inside a derivative would validate as tampered. The original keeps its manifest; the plugin records the fact and the signers.
• It does not write AVIF yet. If your site converts sizes to AVIF, those sizes stay unmarked and the settings screen tells you.
• It is not legal advice. The AI Act distinguishes the machine-readable marking of the file (article 50(2)) from the visible disclosure to the person looking at the image (article 50(4)). The plugin gives you the tools for both; how you word the disclosure is your call, with your legal team.

Who it is for

Brands, e-commerce teams and agencies that publish AI-generated visuals (virtual models, product shots, campaign images, AI-retouched photos) and need the marking to survive publication, with proof in the Media Library. Works with WooCommerce galleries, the block editor, classic themes and headless setups.

Standards

• IPTC Photo Metadata Standard: Iptc4xmpExt:DigitalSourceType.
• IPTC IIM (Caption, By-line, Credit, Copyright) in the Photoshop APP13 segment.
• C2PA (Coalition for Content Provenance and Authenticity) manifests: detected and reported, never altered.
• XMP in PNG (iTXt XML:com.adobe.xmp) and WebP (XMP chunk with the VP8X flag).

For developers

• ropemark_get_provenance( $attachment_id ) returns the record; ropemark_is_ai_generated( $attachment_id ) returns a boolean.
• Filters: ropemark_should_preserve (per attachment), ropemark_decorate_image (badge and label per image), ropemark_badge_text, ropemark_label_text, ropemark_popup_rows.
• Constant ROPEMARK_CREDIT_DEFAULT (wp-config.php) to start with the credit line in the popup enabled.
• Action: ropemark_after_inject with the per-size outcome.
• WP-CLI: wp ropemark scan [--all] [--dry-run], wp ropemark status <id>.
• CSS classes for the front end: .ropemark-wrap, .ropemark-ai-badge, .ropemark-pos-bottom-right (and the other corners), .ropemark-popup, .ropemark-label, .ropemark-site-notice, .ropemark-disclosure, img[data-ai-generated].

Ropemark Image Marking for the EU AI Act is made by The Rope, a digital agency in Milan.