Five weeks before the 2 December 2026 deadline, generators sign their files, but the workstation wipes the signature at the first export. An investigation into the missing link in the middle.
An AI-generated track goes through three stages before it reaches your ears. It comes out of a generator, passes through a workstation where someone cuts, mixes and masters it, then goes to a distributor who delivers it to the platforms. We have already looked at how Spotify, Deezer or Tidal detect and label AI music. That leaves the middle stage, the least documented: what Suno, Udio, Google, Ableton, Steinberg or iZotope do, or do not do, so that a file keeps a trace of its origin. The question becomes concrete on 2 December 2026, and the answer fits in one sentence: the chain breaks in the studio.
2 December 2026, a deadline that does not apply to everyone
Article 50 of the EU AI Act has applied since 2 August 2026. Its paragraph 2 requires providers of generative systems to mark their outputs in a machine-readable format. The omnibus agreement reached in May 2026 granted a reprieve to a single category: systems already on the market before 2 August have until 2 December to comply. The note published on 21 September by the Cloud Security Alliance points this out, along with a second date few people are watching: signatories of the code of practice must offer an interoperable detection mechanism by 2 February 2027. The stakes are not symbolic: a breach falls under the regulation’s general penalty scale, up to 15 million euros or 3% of worldwide turnover.
Suno and Udio are squarely in that case, with generators launched well before August. Workstation makers are not. Their AI features, stem separation or assisted mastering, count as assistance for standard editing, which the text exempts from the obligation. A plugin maker therefore has nothing to mark. That is consistent in law, and it is precisely what weakens the chain.
Signed metadata or watermark: two techniques, two weaknesses
The code of practice published on 10 June 2026 describes two complementary mechanisms. The first is digitally signed, time-stamped metadata stating whether content is AI-generated or manipulated; in practice, only the C2PA standard meets those criteria. The second is an imperceptible watermark, written into the signal itself. A fingerprint logged in a registry remains optional.
The two do not withstand the same attacks. A C2PA manifest is cryptographically solid: any alteration invalidates the signature. But it lives next to the sound, in the file container. A format conversion, a re-encode or a simple bounce in a piece of software erases it silently. A watermark travels with the waveform and should survive compression. The C2PA coalition itself talks about “Durable Content Credentials” when the two are combined: the manifest says where the file comes from, the watermark makes it possible to find it again once the manifest is gone.
A practical consequence that is rarely understood: a missing manifest proves nothing. A file without Content Credentials may come from an entirely human studio as easily as from a generator whose export was converted. A label that is present carries information; its absence carries none.
Suno signs its files, not yet the sound
Suno chose metadata. Since August, every track downloaded from the platform carries C2PA Content Credentials identifying it as made with Suno, with a public detector and a free API that returns three verdicts: verified, no Suno provenance, or inconclusive. Two limits are spelled out on the company’s page. The labelling only applies to new downloads, not to the existing back catalogue. And the tool only recognises Suno’s signature: it is not a general-purpose AI detector. For a label or a distributor, the API still changes the game: it lets them check an entire catalogue in bulk, without going through the interface.
The audio watermark, for its part, is still only an announcement. On 6 August, CEO Mikey Shulman promised watermarking and fingerprinting technology without publishing any specification. Until that second layer exists, a Suno file loses its label at the first conversion.
Things get more complicated with Suno Studio, a browser-based workstation that imports audio and stems. When a producer mixes a recorded vocal with a generated backing track there, what does the export’s manifest say? Suno does not document it.
Google watermarks, Udio closes the door
Google took the other route. Every track produced by Lyria 3 carries a SynthID watermark, presented as detectable even after the audio has been modified. Google is also among the signatories of the European code, which commits it to interoperable detection.
Udio moved the problem elsewhere. After its deal with Universal in late 2025, the platform switched off downloads, giving users 48 hours to retrieve their tracks, Music Business Worldwide reports. In this walled-garden model, labelling becomes almost secondary: a file that never leaves does not need a label to circulate. It is a commercial answer as much as a regulatory one.
Ableton, Steinberg, iZotope: the link that erases
The list of signatories of the code, updated on 24 September 2026, counts 95 organisations in its section for providers. It includes Google, OpenAI, Meta, Mistral and, on the audio side, Resemble.ai, Hastings Music and Studio Funk. It includes neither Suno nor Udio, nor Ableton, Steinberg, iZotope or Native Instruments.
The technical consequence is real all the same. The code asks signatories to preserve existing markings when their system transforms content. That rule only binds signatories. None of the major music software makers publicly documents reading or passing on a C2PA manifest on export. A Suno stem dropped into Live comes out as a brand-new WAV with nothing but the sound, as my test below shows; nothing suggests Cubase or Logic behave differently. If the generator did not add a watermark, provenance stops there.
It would take very little: an import that reads the manifest, an export that copies it and adds the mixing step. Adobe already does this for images in its editing software. No music software maker has announced it for sound.
In the field: a sonic identity delivered to a client
Take a common B2B case. An agency commissions an independent sound designer to create a brand’s sonic identity: a three-second audio logo, two on-hold loops for the phone line, a pad for corporate videos. The contractor generates a texture in Suno, cuts it up in their workstation, layers it over their own synths and delivers clean masters. No manifest has survived. On the regulatory side, the brand probably has nothing to disclose: a jingle is not a deepfake. On the contractual side, the matter stays open. If the client later discovers that part of its sonic identity came out of a generator, the rights question will arise with no proof of origin.
Three habits limit the risk:
- keep the original generated files, with their Content Credentials intact, in the project archive;
- state in the delivery note which elements come from a generator, and which one;
- run a doubtful file through the vendor’s detector before using it.
This is documentary traceability, not compliance in the strict sense. For now, it is also the only kind that holds all the way to the client.
In my studio, the export test
My first two albums began in a mobile sketchbook before moving into Live. Discomposed, released on 5 October, followed an even shorter chain: a MIDI keyboard for the first track, the Launchpad Pro MK3 for the other five, all in Live on the same computer.
I wanted to check rather than assume. First test: a project exported as WAV from Live 12.4.6 Suite, at 48 kHz and 24-bit. The C2PA reader finds no manifest. The file holds three chunks, the format, the audio and a padding chunk, nothing else. Second test, more telling: an eight-second test file, signed in C2PA with a test certificate and declared as created by an algorithm. Before import, the verifier reads its signature correctly. I dropped it into Live, then exported it again without any processing. The sound is intact, same frequencies, same peak level. The manifest, however, is gone: the 3 KB chunk that carried it no longer exists in the output file.
The only information about how my files were made was therefore whatever I chose to provide myself. The whole system still rests on the author’s word. And when that is not enough, a detector decides: one of the EP’s tracks was wrongly taken for generated music, when no machine had composed it.
Listen to what the hand made
On 2 December, generators will have to sign their files. The studio will remain a blind spot until music software makers decide to read and pass on those signatures. Until then, a track’s provenance depends on what its author chooses to say. To hear atmospheric electronic music composed by hand, the Electronica – Electronic Music Anthology playlist travels through imaginative music from the 1950s to today, with Rê>ON tracks slipped in among the pioneers.
A correction, a source to share, your own experience with exports? Get in touch.
Every new Rê>ON track lands in your library the day it comes out. Follow.
