An example of how to comply with EU AI Act Article 53 using JPEG Trust

What Article 53 requires

Article 53 of the EU AI Act establishes obligations specifically for providers of general-purpose AI models — foundation models, large language models, and image-generation models that are designed to be integrated into downstream AI systems. It entered the final text of Regulation (EU) 2024/1689 and its transparency provisions took effect on 2 August 2025.

Why GPAI transparency matters

General-purpose AI models are the building blocks of a growing number of downstream AI systems. A single foundation model may power thousands of applications across different sectors. Without transparency about how these models were built — what data they were trained on, how they were evaluated, and what their limitations are — downstream providers cannot fulfil their own regulatory obligations, and regulators cannot assess systemic risks.

Article 53 addresses this gap by requiring GPAI model providers to create a documentation chain that follows the model downstream. When a GPAI model is used to generate or manipulate images, this documentation chain intersects directly with the provenance metadata that Article 50 requires on the output content.

How Articles 50 and 53 work together

Articles 50 and 53 form a complementary chain of transparency. Article 53 governs upstream: what the GPAI model provider must document about the model itself. Article 50 governs downstream: what must be embedded in every piece of AI-generated content. Together, they create an end-to-end accountability trail from model training to content consumption.

How JPEG Trust supports Article 53 compliance

When a GPAI model generates or modifies an image, JPEG Trust embeds provenance assertions that document the model's involvement — creating the machine-readable link between the Article 53 documentation and the Article 50 output labelling. These assertions carry forward the key information that Article 53 requires model providers to make available.

Python example: embed GPAI model provenance

from jpegtrust import embed_image, create_profile, save_profile

# 1. Create a profile from the built-in checks
profile = create_profile(
    check_ids=["signature_chain", "ai_declaration", "data_mining",
               "copyright", "digital_source_type", "edit_history"],
    name="Article 53 Compliance",
)
save_profile(profile, "article53.yml")

# 2. Embed provenance into generated output. gpai_metadata.json holds the
#    declaration assertions, for example:
#      "c2pa.actions.v2": {"actions": [{"action": "c2pa.created",
#        "softwareAgent": {"name": "MyFoundationModel", "version": "2.1"},
#        "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"}]},
#      "cawg.training-mining": {"entries": {
#        "cawg.ai_training": {"use": "notAllowed"},
#        "cawg.data_mining": {"use": "notAllowed"}}}
embed_image(
    "model_output.jpg",
    "gpai_metadata.json",
    "labelled_output.jpg",
    digital_source_type="trainedAlgorithmicMedia"
)

# The output file now contains:
#   - c2pa.actions.v2 (softwareAgent identifies the generating model)
#   - cawg.training-mining (AI training and data-mining permissions)
#   - digitalSourceType "trainedAlgorithmicMedia" on the c2pa.created action

CLI example

# Embed provenance metadata (actions and training-mining entries) from JSON
jpegtrust embed model_output.jpg gpai_metadata.json -o labelled.jpg \
    --digital-source-type trainedAlgorithmicMedia

# Inspect what was embedded
jpegtrust extract labelled.jpg

How JPEG Trust can verify the Article 53 documentation chain

Downstream AI system providers, platforms, and regulators can verify an image's provenance metadata against a trust profile built from the built-in checks below. Together they check the signature, the declared AI training, inference and data-mining permissions, rights information, the digital source type and the action history.

Python example: verify compliance

from jpegtrust import verify_image

# Verify against the Article 53 profile
report = verify_image("labelled_output.jpg", "article53.yml")

print(f"Verdict: {report.status}")
print(f"Checks passed: {report.passed_checks}/{report.total_checks}")

if "ai_declaration" in report.failed:
    print("WARNING: No AI training/inference permission declared")

if "data_mining" in report.failed:
    print("WARNING: No data-mining permission (rights reservation) declared")

CLI example

# Verify against the Article 53 profile
jpegtrust verify labelled.jpg article53.yml

# Batch-verify a folder of GPAI model outputs
jpegtrust batch verify ./model_outputs article53.yml

Article 53 compliance checklist

Use this checklist to track your organisation's compliance with Article 53 obligations. JPEG Trust directly supports the items marked with a provenance metadata tag.

Get started

JPEG Trust is available as a Python package, a browser-based tool, and an HTTP API. Choose the integration that fits your workflow.