SDK 0.7.2a1 · source review 2026-11-10.
This matrix separates binding law, voluntary Code measures and SDK engineering policy. “Reference verified” describes the tested kit, not an unknown product's live deployment. Read official excerpts, EU guidance and California guidance with the source/role conditions.
| ID / source | Requirement | Included measure and evidence | Remaining action / owner |
|---|---|---|---|
| EU-01 50(2) (law) | Machine-readable marking and detection | C2PA + watermark + verifier. Evidence: 217 installed tests; kit fresh exports (implementation, record) | Actual output coverage and modality applicability — shared |
| EU-02 50(2) (law) | Effectiveness, reliability, robustness, interoperability | Layered scheme and versioned protocols. Evidence: Scoped historical transforms + external C2PA read (implementation, record) | Representative delivery/error-rate assessment; known failures — shared |
| EU-03 111(4) (law) | Specific provider transition by placement date | Date-aware product planner. Evidence: Date-boundary regressions (implementation, record) | Actual placement date and exception facts — operator |
| EU-04 50(4)-(5) (law) | Applicable deepfake disclosure and accessibility | Optional baked-in label. Evidence: Reference component tests only (implementation, record) | Product wording, placement, audience and accessibility — operator |
| EU-05 50(1),50(6) (law) | Direct AI interaction and other applicable duties | Planner flags scope boundaries. Evidence: Profile checks (implementation, record) | App-specific duties outside visual marking — operator |
| CODE-01 1.1.1-1.1.2 (voluntary-code) | Layered signed metadata and watermark | C2PA, production timestamp gate, TrustMark Q. Evidence: Signature/hash read + fresh ID read-back (implementation, record) | Production identity/time policy; durability assessment — shared |
| CODE-02 2.1-2.3 (voluntary-code) | Available detection, signed download, clear results | Open decoder, UI/API, Ed25519 reports. Evidence: Kit HTTPS + report rejection/isolation (implementation, record) | Operation/accessibility/continuity for actual audience — operator |
| CODE-03 3.2-3.3 (voluntary-code) | Reliability and robustness measurement | Protocols and carried-forward corpus observations. Evidence: 22 clean clips and scoped positives in historical review (implementation, record) | Held-out content/threat assessment; no population pass claim — shared |
| CODE-04 3.4(c) (voluntary-code) | Chosen detection interoperability solution by 2027-02-02 | Read-only repository subset, provisional algorithms. Evidence: Matched recovery in own kit (implementation, record) | Universal routing/signpost/registered method not qualified — Ariadne + operator |
| CODE-05 4.1-4.4 (voluntary-code) | Document, test, monitor, train and cooperate | Evidence templates and versioned reports. Evidence: Engineering evidence only (implementation, record) | Adopt operator process and maintain records — operator |
| CA-01 22757.1(e),22757.6 (law) | Determine covered-provider scope and dates | Current amended planner without MAU threshold. Evidence: Profile date/scope regressions (implementation, record) | Actual production/public-access facts and exceptions — operator |
| CA-02 22757.2(a)(1)-(2) (law) | Verification and system-provenance output | UI/API + reviewed public-source fields. Evidence: HTTPS fixture verification (implementation, record) | Review fields/trust and actual deployment — shared |
| CA-03 22757.2(a)(3),(c)-(d) (law) | Personal-data minimization and access | Transient uploads, allowlist, no access logs in kit. Evidence: Cleanup, privacy and output tests (implementation, record) | Host/proxy logs and processing review; single-operator scope — operator |
| CA-04 22757.2(a)(4)-(6),(e) (law) | Public free upload-or-URL tool/API; third-party access | Upload API/UI; URL fetch intentionally absent. Evidence: HTTPS upload and API behavior (implementation, record) | Host availability, capacity, required product link — operator |
| CA-05 22757.2(b) (law) | Feedback and relevant improvement | Anonymous aggregate counters. Evidence: Persistence across restart (implementation, record) | Review and incorporate useful feedback — operator |
| CA-06 22757.3(a)(1)(A)-(E) (law) | Provider/system/version/time/UUID/action fields | Signed record; ID-to-registry recovery. Evidence: Record tests, future-date guard, metadata-only recovery (implementation, record) | Truthful fields, permanence of access, one system/version per kit — shared |
| CA-07 22757.3(a)(2)-(4) (law) | Removal resistance and verifier/standard compatibility | Watermark + C2PA, external standard read. Evidence: Known attacks/limits + c2patool validation (implementation, record) | Permanence not established; provisional soft-binding/discovery — shared |
| CA-08 22757.3(b) (law) | GenAI-system licensing notice/response process | Operator evidence template. Evidence: No automated process implementation (implementation, record) | Assign 72h/96h and reporting actions when applicable — operator |
| CA-09 22757.3(a)(1)(F) (law) | 2029 assistive-technology metadata | Planner flags missing future schema. Evidence: Future profile finding (implementation, record) | Not implemented; update before applicable date — Ariadne + operator |
| ENG-01 SDK production policy (engineering-policy) | Trusted timestamp and isolated keys | Separate provider/report/TLS keys and roots. Evidence: Local chain/EKU and TSA regression; mount isolation (implementation, record) | Supply production services; policy is not statute — operator |
| ENG-02 Economy/Resilient selection (engineering-policy) | Select compute/temporal coverage trade-off | 125ms windows per 5/2s or per-frame marking. Evidence: 6s cadence assertion; per-window/five-sample gates (implementation, record) | No mode is a statutory minimum or unremovable mark — shared |
Evidence and use
The 0.7.2a1 qualification binds exact SDK artifacts to 217 installed-media tests, the core matrix, clean installs and kit integration. Historical observations retain their original versions/corpora. They do not prove population error rates, statutory permanence or current production throughput.
Machine-readable copies: CSV and JSON. The repository's 15 implementation requirement records are a separate engineering tracker, not 15 statutory obligations. Open operator or evidence work remains open even where the implementing component exists.