Scanning methodology

What we inspect

We fetch one public HTML page, inspect possible widget script integrations and text notice excerpts, and download up to five image assets. Actual response bytes are bounded to 2 MB for HTML and 3 MB per image. Redirect targets are checked. The production Cloudflare configuration restricts fetches to public destinations.

The scanner does not execute JavaScript, open conversations, inspect iframe contents, or establish whether a widget's AI feature is enabled. A page-level notice does not prove that the right notice is shown before interaction. Hidden markup and script text are excluded, but CSS visibility still requires manual review.

Applicability before findings

Article 50(1) concerns AI interaction notices. Article 50(2) concerns providers' machine-readable marking of synthetic outputs; it does not prescribe C2PA as the sole technique. Article 50(4) covers deployer disclosures for deepfakes and certain AI-generated public-interest text, with exceptions. Article 50(3) concerns emotion recognition and biometric categorisation and is outside this scanner.

Your applicability answers are stored with each report. “No” produces “not applicable based on your answer”; “unsure” produces “unable to assess.” A missing text notice is flagged only after you confirm relevant AI-generated public-interest text requires disclosure.

Outcomes, not compliance scores

Reports contain potential issues observed, notices observed, not-applicable checks and checks we cannot assess. No numerical score or compliance certification is issued. Blocked or inaccessible websites return “unable to assess.”

Ordinary EXIF fields such as creator and software do not establish AI origin. Explicit AI-origin indicators are recorded separately from C2PA container markers. We do not cryptographically validate C2PA signatures or judge the effectiveness of other watermarking techniques.

Evidence and monitoring

Reports record the submitted and final URLs, UTC timestamp, rule version, applicability answers, disclosure excerpts, sampled image observations and SHA-256 of the fetched HTML. A hash identifies the fetched source; it is not a retained full copy or a notarised timestamp.

Verified workspaces retain up to 50 reports per URL for one year after the latest saved scan. Monitoring always performs a fresh scan. Daily change alerts compare availability, check outcomes, notices, widget integrations and sampled media indicators. Weekly and monthly schedules send a scan digest. These are scheduled observations, not instant or continuous surveillance.

Fresh rescans help verify markup changes. Human review is still needed for actual disclosure visibility, legal applicability, exceptions and live widget behavior. You can manually attach up to five PNG/JPEG screenshots per website, under 500 KB each. Reports record attachment time and a file fingerprint; source and capture timing are not independently verified. Automated screenshot capture and browser-rendered checks are not included.