Disclose AI-generated ComfyUI output: separate labels, embedded metadata and C2PA before delivery

Purpose and scope

Three questions are easy to conflate: what must be disclosed to people, what is embedded in the file, and what a signed provenance record adds. Not legal advice; jurisdiction and contracts matter.

Source-supported context

C2PA. C2PA develops standards for certifying the source and history of media Source 1. A Content Credential (C2PA Manifest) is a cryptographically bound provenance record that makes changes detectable. It does not prove content is true or prevent metadata removal; soft bindings such as watermarks can help recover manifests Source 2.

ComfyUI. Official docs say ComfyUI can embed the workflow in output files as prompt and workflow fields (PNG, WebP, MP4, WebM and others). The --disable-metadata flag or the Desktop setting "Disable saving prompt metadata in files" turns this off. The metadata is not a digital signature, and external re-encoding can strip it Source 3.

EU AI Act Article 50. In Regulation (EU) 2024/1689 as published Source 9: providers of AI systems generating synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using effective, interoperable, robust and reliable solutions as far as technically feasible (50(2)). Deployers of a system generating or manipulating image, audio or video content that constitutes a deep fake must disclose this; for evidently artistic, creative, satirical or fictional works the duty is limited to disclosure that does not hamper enjoyment of the work (50(4)). Information must be clear and distinguishable at the latest at first interaction or exposure (50(5)). Regulation 2026/1744 replaced only paragraph 7 (codes of practice); the service desk shows the consolidated text Source 4.

Dates, checked 2026-10-06. Article 113: the Regulation applies from 2 August 2026, with exceptions in its third paragraph (none concerns Article 50) Source 6. The 2024 text of Article 111 had no paragraph 4; Regulation (EU) 2026/1744 (Digital Omnibus on AI, 8 July 2026, OJ 24 July 2026) added it (recital 38: four months): providers of systems generating synthetic audio, image, video or text content placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026 Source 5 Source 7. It moved high-risk dates but contains no provision postponing Article 50, which applies from 2 August 2026, and the transition covers only 50(2) for earlier-placed systems. EUR-Lex lists 32026R1744 as the only amending act of 2024/1689 (plus corrigenda) on 2026-10-06 Source 10.

Platforms. YouTube requires creators to disclose realistic content made or meaningfully altered with AI through the "AI use" setting in YouTube Studio; it may label content, including automatically, and says repeated non-disclosure can bring penalties; wording may change Source 8.

Before you start

1. List destinations (client, platform, EU market) and contract clauses on AI use.

2. Identify the AI systems in your chain and their suppliers.

Steps and checks

The sequence below is an editorial procedure based on the cited context, not a diagnosis already confirmed for your environment.

Step 1. Classify each deliverable: synthetic or manipulated media or text; published, delivered or internal.

Step 2. Record your role for each tool (provider, deployer or neither); Article 50 duties differ by role, so ask qualified counsel.

Step 3. Decide the human-facing label per destination (legal wording, platform disclosure control, client clause) and who applies it.

Step 4. Decide whether files leaving your control keep the embedded workflow or use the disable option; record why.

Step 5. Inspect a sample export with a metadata viewer before publishing and after each re-encode.

Step 6. If a client asks for Content Credentials, record which tool signs the file and who holds the credentials; ComfyUI workflow fields are not a C2PA manifest.

Step 7. Keep a dated regulatory check with an owner who rechecks it.

Completion check

Each deliverable has a classification, label owner and metadata decision.

Limitations and cautions

Nothing here was tested. Articles 50 and 113 of Regulation 2024/1689 and Regulation 2026/1744 were read in full from EUR-Lex; later amendments are not covered. Provider or deployer status is not answered. C2PA pages cited are version 2.2; later versions were not read. No source says ComfyUI metadata satisfies Article 50(2). Codes of practice not checked.

Original sources

• C2PA spec 2.2 — checked 2026-10-06.
• C2PA explainer 2.2 — checked 2026-10-06.
• ComfyUI workflow metadata — checked 2026-10-06.
• AI Act Article 50 — checked 2026-10-06.
• AI Act Article 111 — checked 2026-10-06.
• AI Act Article 113 — checked 2026-10-06.
• Regulation 2026/1744 (EUR-Lex) — checked 2026-10-06.
• YouTube AI disclosure — checked 2026-10-06.
• EU AI Act 2024/1689 (EUR-Lex OJ text) — checked 2026-10-06.
• EUR-Lex record of Regulation 2024/1689 (amendments) — checked 2026-10-06.

Prepared 2026-10-06 from the sources above. No GPU run, quality measurement or runtime guarantee is supplied.

Related troubleshooting and guides

• Submit a ComfyUI workflow through its native API and track prompt_id
• Prepare a useful, redacted ComfyUI error report
• Check dependencies before importing someone else's ComfyUI workflow