Which AI image generators write provenance evidence?

Whether an AI image carries its own provenance depends on the tool that generated it, often on the individual model. This page is the reference for that: for each generator, model and tool, whether a provenance marker was in the file on 1 September 2026, what type it was, who signed it, and whether it still reached the copy that Shopify delivers to visitors on 30 September 2026. What a C2PA manifest contains and which export paths lose markers is explained in the guide Content Credentials and C2PA.

How was this measured?

The basis is the Easy AI Act Image Labels test bench. On 1 September 2026, it read 59 image files, each saved with the tool’s official download or export button in the output format offered:

• 47 catalogue entries from Magnific/Freepik, generated via API, one model per entry,
• 4 cross-checks from the same service’s web interface,
• 6 files from ChatGPT, Google Gemini, Canva (two), Adobe Firefly and Shopify Tinker,
• 2 controls: a phone photo and a screenshot, both without a marker, as expected.

43 of the 59 files carried a marker. The test bench measured the Shopify image editor separately on the same day, on the stored original in the store. On 30 September 2026, the second question followed: what reaches visitors? For this, 38 images with a marker were placed in a Shopify development store, and the stored original was compared with the copies Shopify delivers (unchanged, downscaled, as WebP or AVIF, and in the product page srcset).

How to read the columns:

• Marker on the original: whether the file, as it came out of the tool, carried a provenance entry.
• Type: C2PA is a signed manifest (Content Credentials); IPTC stands for the plain-text field DigitalSourceType in the XMP block; a cloud pointer is only a reference to a manifest online. trainedAlgorithmicMedia means fully AI-generated, compositeWithTrainedAlgorithmicMedia your own material with an AI component.
• Signer: the organisation in the signing certificate, as written in the file; this is not a verification of the signature.
• On the Shopify copy: whether the delivered copy still carried the marker on 30 September 2026. “Not measured” means the image was not part of that series.

Which chat, design and Shopify tools write evidence?

All evidence in this table states trainedAlgorithmicMedia, except the Canva photo with an AI background. Three findings:

• Canva distinguishes generated from edited. An image from a prompt only carries trainedAlgorithmicMedia and OpenAI’s signature, because gpt-image does the work there; your own photo with an AI background carries compositeWithTrainedAlgorithmicMedia, signed by Canva itself.
• Firefly writes no manifest into the file. The file contains only a reference to an online manifest at Adobe (705 bytes of XMP; resolved, 13,844 bytes, signed by Adobe Inc.). Reading the file without network access finds no marker.
• Shopify Tinker and the Shopify image editor behave in opposite ways. Tinker writes C2PA plus the IPTC value, signed by Google LLC, along with the entry “Tinker (product_still_life)”. The image from “Generate background” (PNG, 2,014,705 bytes) carried no metadata at all on the original; whether Shopify sets no marker or loses it in its own processing cannot be determined from the outside.

Which models in the Magnific catalogue write evidence?

Magnific (Freepik) bundles models from many makers. On 1 September 2026, 34 of the 47 catalogue entries generated via API carried a marker, 13 did not.

All markers in this table state trainedAlgorithmicMedia. What the table shows:

• The service writes nothing of its own. Freepik does not appear as a signer in any of the 51 Magnific files. The signer is the model maker or the inference service that runs the model: fal, for instance, for Flux-1, Qwen and Z-Image.
• The catalogue entry decides, not the model family. Qwen carried a manifest, Qwen Image 3-0 and 3-0 Pro did not; within Flux, the range runs from manifests by two different signers to entries without any metadata.
• Google names no model. Neither Gemini nor Nano Banana nor Cinematic writes a model name into the manifest; only the signer Google LLC is on record (analysis of 7 September 2026).
• Grok signs for itself. Both Grok files carry a complete manifest, issued by a “Self-signed ephemeral CA (Content Authenticity SDK)”. A verification tool sees that someone claims an AI origin, but not who.
• The web interface confirms the API. Of the four cross-checks, gpt 2, Seedream 5 Pro and Nano Banana 2 Lite carried the same markers as via API. Recraft V4-1 arrived as a JPEG download without a marker, while the same generation as a native PNG carried a manifest: the format conversion had deleted it.

Does the evidence survive the way through Shopify?

Two measurements, two answers:

1. The stored original keeps it. On 1 September 2026, all 47 Magnific images generated via API were in Shopify as product images after upload, with a file size byte-identical to the local file; all 34 markers were preserved.
2. The delivered copy mostly loses it. On 30 September 2026, of 38 images with a marker on the original, 6 still carried it in the best variant (delivered unchanged), and 5 in downscaled copies, as WebP or AVIF and in the product page srcset.

The pattern is clear: the Google images that also carry the DigitalSourceType as an IPTC field in the XMP survived in every variant; the Canva image from a prompt survived only as long as Shopify delivered the file unchanged. Markers that sit only in the C2PA manifest survived no re-encoded copy in this series (0 of 31).

This does not hold for every C2PA image: in a public store, Shopify delivered 6 of 224 image files with a readable C2PA manifest on 30 September 2026, edited in Adobe Photoshop with an AI component (compositeWithTrainedAlgorithmicMedia, AI tool according to the file Adobe Firefly, signed by Adobe). These JPEG files came through delivery unchanged.

What this means for you: if a verification tool finds no marker on an image from your store, the image is not checkable on the copy; that says nothing about its origin. Only the original is conclusive.

How do you check your own images?

1. Use the file as it came out of the tool. Official download button, native output format, no conversion, no screenshot. The export rules in detail are in the guide Content Credentials and C2PA.
2. Drop it into the AI image checker. It reads C2PA and IPTC DigitalSourceType directly in the browser; the file does not leave the device. It shows the tool, the issuer according to the certificate (it does not verify the signature), the action and the matching EU label.
3. Expect these particulars. For the Canva photo with an AI background, the checker suggests AI MODIFIED; for the other evidence in the tables, AI GENERATED. For Firefly files it shows “No AI evidence” and names the reference to the online manifest, but does not resolve it. For Grok, the issuer remains “not stated” because the chain is self-signed. For Google images, the tool shown is “Google C2PA Core Generator Library”, not a model name.
4. Do not check the store copy. An image you download from your store is a re-encoded copy (see above). For images already in the store, the app Easy AI Act Image Labels reads the stored original through the Admin API.

What does this mean for your labelling?

The tables show where evidence can be expected, not whether an image needs a label. The machine-readable marker is the responsibility of the provider of the AI system under Article 50(2) of the AI Act (Regulation (EU) 2024/1689); providers whose systems were placed on the market before 2 August 2026 have until 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744). As a deployer, you are responsible for the visible disclosure under Article 50(4), whether or not your generator writes a marker; under paragraph 117 of the Commission guidelines of 20 July 2026, deployers cannot rely on the embedded marker.

So a “No” in the table does not relieve you, and a “Yes” does not replace a label. Images you know come from an AI tool are yours to assess; which of them need a label is explained in the guide Do I have to label AI images in my online store? The law behind it is covered in Article 50 explained.

When will this be measured again?

The tables are a snapshot: providers change models and export paths all the time, and from 2 December 2026, providers of older systems must mark their output as well. The test bench is therefore repeated quarterly, with the next run after 2 December 2026; each row then gets its new measurement date. The Shopify image editor is scheduled for a new measurement in that run; for Midjourney, a test image is still missing. What the date means for your store is covered in the guide What changes on 2 December 2026 for AI images in your store?