Five US states are writing "provenance data" into AI content law right now. Arizona, New York, Illinois, California, Oregon. Not better detection. Not voluntary labels. Cryptographic proof of origin, required by statute. Meanwhile Microsoft Research just published that detection alone doesn't scale. What works? Provenance tracking with cryptographic signatures. Legislators aren't asking "can AI spot AI?" They're asking "show your work." Receipts by default isn't a feature request anymore. It's becoming compliance.