Yes. This is one of the quietest ways an otherwise-compliant setup fails, because everything looks fine and nothing warns you.
The mechanics: provenance metadata (C2PA/Content Credentials, IPTC fields) lives inside the file, and the infrastructure between generation and the viewer routinely rewrites files. Image optimisers, CDN transforms, resizing services, format converters (JPEG to WebP is a classic), and some upload pipelines strip metadata by default, because smaller files are their job. The AI marking your model provider dutifully embedded can be gone by the time the image reaches anyone.
Who this bites, in order: if you're a provider of a generative system relying on upstream marking, the draft guidelines let you lean on what the model provider embeds, but without prejudice to your own responsibility to demonstrate compliance, and a pipeline that strips the marks means the outputs you deliver aren't marked. You must be able to show the marking survives end-to-end. If you're a publisher of AI content, keeping provenance intact on republish is the corresponding good practice. Deliberately or carelessly stripping the machine-readable evidence that content is AI-made undercuts the system the marking duty exists to build, and keeping originals plus intact metadata is part of the evidence trail worth maintaining.
The test is cheap: generate a sample output, push it through your real production path (upload, optimise, CDN, final rendered page), download what a user actually receives, and inspect it. A C2PA/Content Credentials inspector or a plain EXIF viewer will do. Do it per format you serve. Keep the dated before/after results.
The fixes are usually configuration, not engineering: most CDNs and optimisers have a preserve-metadata option. Enable it for AI-generated assets, or route those assets around the transform. And note what this duty is not: your visible labelling duty for realistic AI imagery under Article 50(4) is separate and survives regardless of what happens to metadata. A visible "AI" label can't be stripped by a CDN.
Not sure how this applies to your specific setup? The free 2-minute check tells you which of the four Article 50 duty areas likely apply to your company. No email required.
Take the free check Generate disclosure text