It signs the sender, not the sentence — A2A joins the Agentic AI Foundation and Article 50(2) still has no carrier

Google's Agent2Agent protocol became a hosted project of the Agentic AI Foundation on 17 August 2026, putting both halves of the agent stack under one neutral governance body. A2A version 1.0 already ships Signed Agent Cards - canonicalised JSON, cryptographic signature, client-side verification - so the protocol is not naive about trust; it answers who sent a message and says nothing about what produced its content. The specification defines no provenance, watermarking or C2PA semantics, and the extensions documentation's own data-only example is GDPR compliance data in an Agent Card. AI Act Article 50(2) puts the machine-readable marking duty on providers of AI systems generating synthetic text; Article 50 has applied since 2 August 2026 and the marking obligation lands 2 December 2026. A standards foundation is not a provider of an AI system and owes nothing under Article 50, so the spec's silence is permanent and the deadline is not. In a chain it is 50(4) that bites: the deployer disclosure for AI-generated text published to inform the public, whose exception is human editorial review - which an autonomous agent chain by construction does not have.

Post

Google moved A2A to the Agentic AI Foundation on 17 August. Both halves of the agent stack now sit under one neutral roof — and neither half can tell you whether a machine wrote the text passing through it.

A2A joins MCP, goose, AGENTS.md and agentgateway. One governing board, one technical committee. Axios puts AAIF past 250 members.

Adoption is real: at its first anniversary in April, A2A counted 150+ organisations, up from 50+ a year earlier, with five production SDKs.

Now the correction.

A2A v1.0 shipped Signed Agent Cards — canonicalised JSON, cryptographic signature, client-side verification. That answers "is this agent who it claims to be". It answers nothing about the content in the Artifact it returns.

The extension mechanism exists too: AgentExtension objects in AgentCapabilities, an A2A-Extensions header, four scopes. The spec's own example of a data-only extension is GDPR compliance data in an Agent Card. The hook is there. Nothing hangs on it for provenance.

Now the European part.

Article 50(2): providers of AI systems generating synthetic audio, image, video or text shall ensure the outputs are marked in a machine-readable format and detectable as artificially generated. Article 50 has applied since 2 August 2026. The marking obligation lands 2 December 2026.

The reasonable reading is that neutral governance will eventually put provenance in the spec. But Article 50 binds providers of AI systems — a standards foundation is not one. The spec can stay silent for a decade and your December date does not move.

And 50(4) is what bites in a chain. Deployers publishing AI-generated text to inform the public must disclose it, unless the content went through human editorial review. An autonomous agent chain, by construction, did not.

What I'd do Monday:

  1. Declare a provenance extension URI in your Agent Card. Data-only, not required. Invent it if you must — a declared field beats a December scramble.
  2. Treat every Artifact arriving over A2A as unmarked. Default to marking on republish.
  3. Record which remote agent produced each Part, beside the task ID. Article 30 asks. Article 50(4) asks.
  4. Name the human performing your editorial review, or stop claiming the exception.

The stack got a signature for the sender. It still has none for the sentence.

Which of your agents could prove, this morning, that a human wrote its last output?

#AgenticAI #EUAIAct #AIEngineering #AIGovernance #Berlin

First comment

Sources, primary first —

Agentic AI Foundation — the hosted projects in one place: A2A alongside MCP, goose, AGENTS.md and agentgateway, plus the eight working groups (one of them Governance, Risk & Regulatory Alignment) https://aaif.io/

Axios, 17 August 2026 — the exclusive on the move, the 250+ member figure and Google Cloud's framing https://www.axios.com/2026/08/17/a2a-agentic-ai-foundation-open-ai-standards

Techzine, 17 August 2026 — independent coverage of the same transfer, with the two-tier governance description https://www.techzine.eu/news/devops/143659/google-transfers-a2a-to-the-agentic-ai-foundation/

Linux Foundation, 9 December 2025 — AAIF's formation: the three anchor projects and the named members at launch https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation

A2A first-anniversary release, 9 April 2026 — where 150+ organisations, the five SDKs and Signed Agent Cards in v1.0 come from https://www.prnewswire.com/news-releases/a2a-protocol-surpasses-150-organizations-lands-in-major-cloud-platforms-and-sees-enterprise-production-use-in-first-year-302737641.html

A2A specification — the data model itself. Read AgentCard, Message, Part and Artifact, and note what the metadata map is not defined to carry https://a2a-protocol.org/latest/specification/

A2A extensions — the mechanism you would use: AgentExtension in AgentCapabilities, the A2A-Extensions header, and the four scopes https://a2a-protocol.org/latest/topics/extensions/

AI Act Article 50 — paragraph 2 is the machine-readable marking duty on providers, paragraph 4 the deployer disclosure and its editorial-review exception https://artificialintelligenceact.eu/article/50/

Code of Practice on Transparency of AI-generated Content, 10 June 2026 — the voluntary route to 50(2), and worth reading before you design your own field https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content

Commission, on enforcement from 2 August — the transparency rules starting to apply https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august

One point cut for length: the membership numbers disagree at the starting line. Axios describes AAIF as growing "from fewer than 40" members; the Linux Foundation's own December release names 47 — 8 platinum, 18 gold, 21 silver. The 250+ figure is Axios's and I have not found a second source for it, so treat the growth as directionally right and the endpoints as one outlet's count.

Claims

Sources

Corrections

None for this edition. The membership figures are handled with care rather than repeated: Axios describes the Agentic AI Foundation as growing from fewer than 40 members, while the Linux Foundation's own formation release names 47 - 8 platinum, 18 gold and 21 silver. The 250+ current figure is Axios's alone and is carried as attributed context, not as a verified claim. The absence of provenance semantics in A2A is stated from the specification and the extensions documentation directly, not inferred from commentary.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.