When an AI-generated image carries a small disclosure label, or a watermark survives long enough for a fact-checker to trace where a video came from, it can look like a platform’s choice or a regulator’s win. Underneath both sits something far less visible: a technical standard that decides what that label means, how the mark is embedded, and what counts as detecting it. These standards can also define how content provenance, information about where digital content comes from and what has happened to it, is recorded and communicated. Those decisions are being made now, in standards committees most people have never heard of.
Laws set the obligations. Standards decide what meeting them means.
The EU’s AI Act, the European Union’s landmark law designed to regulate AI systems and protect fundamental rights, is the clearest example. Its obligations on high-risk AI systems are operationalised through harmonised standards: technical documents which, once cited in the EU’s Official Journal, give any company that follows them a legal presumption of compliance. In effect, the standard becomes what the law means in practice. The first of these standards, on Quality Management System for EU AI Act Regulatory, was published in July 2026, and the rest are expected by early 2027. Meanwhile the AI Act’s transparency obligations on AI-generated content became enforceable in August 2026, with the requirement to watermark synthetic content applying in full from December. The technical details agreed in the next eighteen months will shape how billions of images and videos are marked, verified and trusted for a decade, and through international standards bodies they will travel far beyond Europe.
Standards are written by whoever shows up
These processes are open and consensus-based in principle. In practice, the rooms are filled overwhelmingly by company representatives, because participation takes time, technical fluency and patience that few public-interest organisations can spare. The frameworks themselves make space for fundamental rights considerations. Whether that space gets filled, and with what, depends entirely on who is at the table. Right now, civil society is barely there.
Where WITNESS is working
Since March 2026, WITNESS has been participating as UK experts through the British Standards Institution (BSI), giving us a formal seat in the committees shaping both European and international AI standards. In the European committee developing the AI Act standards (CEN/CENELEC JTC 21), we have begun contributing to the computer vision standards, proposing definitions and evaluation methods for watermarking, and introducing content-provenance concepts into the drafts. We are also commenting on transparency and logging requirements in standards designed to ensure compatibility and performance across imaging and AI systems.
We have recently also joined the UK committee for ISO/IEC SC 29, the international standards committee behind JPEG and MPEG, widely used digital image and video formats. Within this committee, standards like JPEG Trust, an international standard for media authenticity and provenance, are building authenticity and provenance into media formats themselves.
This builds on work our community already knows: within the C2PA, the coalition behind Content Credentials, which develops standards for documenting the origin and history of digital content, we chair the task force that examines the specification for its potential to be misused and to cause societal harm. And we took part in the multi-stakeholder process that drew up the EU’s Code of Practice on the transparency of AI-generated content, the instrument through which the Act’s marking obligations are now being implemented.
What we argue for, in every room
Our positions are the same wherever we sit. Provenance systems, which document where content comes from and how it has been handled, should serve the people who most depend on credible media: journalists, human rights defenders and communities facing disinformation, not only the companies that build them. Marking should operate at the system level, disclosing how content was made, and must never become a vehicle for tracking or exposing the people who make it; privacy-protective design, including the ability to redact personal information from provenance records, is non-negotiable. And tools must be evaluated against the real world rather than the lab: our TRIED Benchmark, which assesses whether AI detection tools are reliable and effective in real-world conditions, showed how deepfake detection tools that perform well in controlled tests fail on the compressed, re-shared, low-bandwidth media that circulates where the stakes are highest.