Content credentials explained: what provenance can show

Some image viewers now show a panel listing the camera, the editing app and whether AI was involved. That panel is reading a content credential, a record built to the C2PA standard from the Coalition for Content Provenance and Authenticity.[1] It is one of the signals in our guide to how to spot AI-generated content, and the one most often misread. Here is what a credential records, what checking it establishes and where it stops.

What a manifest contains

The C2PA specification, now at version 2.4 (April 2026), defines a manifest as a combination of assertions, "a single claim, and a claim signature".[1] Four parts do the work.

Assertions describe origin, edits and use of AI. Edits are named actions such as c2pa.created, c2pa.edited and c2pa.resized; AI involvement is flagged in a digitalSourceType field, for example trainedAlgorithmicMedia.[1][2]

When a file is built from others, those become ingredients and their manifests travel inside the new file, forming what the C2PA explainer calls a family tree.[2] The newest manifest, whose bindings can still be checked against the file, is the active manifest.[1] The figure below shows such a chain.

What checking a credential can prove

The specification grades a manifest as well-formed (it follows the rules), valid (unmodified since signing, with a good signature) or trusted (the signing certificate chains to a trust list the validator accepts).[1] If the content hash also matches, the asset counts as valid. That lets you say three things:

1. Who signed. The signer is the holder of the certificate, "identified by the subject of the credential".[1] That is usually the organisation behind a device or app, not necessarily the person who pressed the shutter.
2. What was declared. Only the assertions in the claim's created_assertions field are attributed to the signer; gathered assertions are not.[2]
3. That nothing changed afterwards. Any change to the file or the record breaks a hash, so tampering is evident.[2][3]

What it cannot prove

The C2PA's own explainer is direct about the first limit.

“provenance information alone cannot tell you whether the digital content is true, accurate or factual.”

— C2PA, C2PA and Content Credentials Explainer, section 7.2.2.[2]

A credential reports what a signer said. A camera can honestly sign a photograph of a staged scene, and a location assertion is a statement, not a measurement the validator repeats. The Adobe-founded Content Authenticity Initiative (CAI), which builds open-source tools for the standard, says credentials are not meant to indicate whether content is "real".[3]

Second, history can be incomplete. If someone crops a file in a tool that does not support C2PA, the record is not updated. The next signer "implicitly attests" to that unrecorded step by signing over it.[2]

Third, ingredients are checked once. An ingredient's own hashes cannot be re-verified later because its original data is usually not included; the record shows only that it validated when it was added.[2]

Fourth, and most important, absence proves nothing. Credentials are optional, and the explainer warns against judging trustworthiness "purely based on its usage of Content Credentials".[2] They are also easy to lose: OpenAI says they "can be lost through everyday actions, such as taking a screenshot or converting a file".[4] An unlabelled image may be an AI image that lost its record, a photo from a camera that never made one, or anything else.

Watermarks: the complement

C2PA plans for stripping with soft bindings: a fingerprint or invisible watermark that lets a viewer find a manifest removed from the file.[1][2]

Google DeepMind's SynthID embeds imperceptible watermarks in AI-generated images, audio, text and video, which Google says are designed to withstand cropping, filters and lossy compression.[5] Its developer documentation is equally clear about the limits: text detection is probabilistic, detector confidence "can be greatly reduced" after thorough rewriting or translation, and "SynthID Text is not designed to directly stop motivated adversaries from causing harm."[6]

The trade-off is detail against durability. A watermark may still say "a marking model made this" after a screenshot; a manifest says who signed and what was edited, but only while it survives. Neither says whether the content is accurate. How both compare with classifier-style detectors is the subject of AI detectors vs. content credentials.

Where adoption stands, according to the companies themselves

Only official statements, checked 16 October 2026: OpenAI says images from ChatGPT, Codex or its API carry both Content Credentials and SynthID, with coverage that "may vary by product, model, export path, file type".[4] Google says Gemini, Search and Chrome check uploads for SynthID.[5] The CAI lists Leica and Nikon as building credentials into cameras.[3] Support in a tool does not mean every file, or every platform showing it, keeps the record. For how the files are made, see how AI image generators work and how AI video generators work.

What the EU AI Act requires

Article 50(2) requires providers of systems generating synthetic audio, image, video or text to ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated", robustly "as far as this is technically feasible".[7] Recital 133 lists watermarks, metadata, cryptographic provenance methods, logging and fingerprints as options.[8] Neither text names C2PA or SynthID.

The obligations apply from 2 August 2026; providers whose systems were on the market before then have until 2 December 2026 to meet Article 50(2), under Article 111(4) added by the Digital Omnibus.[9][10] A voluntary Code of Practice, published 10 June 2026, sets out how signatories can comply.[10] Our EU AI Act explainer covers the wider law; this is context, not legal advice.

A worked example: one photo, three signatures

Hypothetical. The newsroom, apps and file are invented; nothing here describes a real product or test.

A newsroom receives a photograph of a flooded street. Its verification desk opens it in a C2PA validator and finds three manifests.

• Manifest 1, signed by a camera app. Action c2pa.created; digital capture; time and location assertions.
• Manifest 2, signed by a photo editor. The camera file is an ingredient. Actions c2pa.opened and c2pa.edited, one edit flagged as made by a trained model (a generative fill removing a road sign).
• Manifest 3, signed by a picture agency. Action c2pa.resized. This active manifest is valid, trusted and its hash matches.

AI Chronicle

The desk can now say that three certificate holders signed this history, the agency's copy is unchanged and an AI-assisted edit was declared. It cannot say more: the time and place are the camera app's statement, the camera manifest was validated when added rather than today, and nothing shows the flood happened as the caption claims. Reporting still has to answer that.

A day later a screenshot of the photo circulates with no credential. That absence proves nothing. A watermark check helps only if the editing tool watermarked its output; otherwise the screenshot needs ordinary verification.

Questions readers commonly ask

Does a content credential mean an image is real?

No. It means a signer made statements about the file and the file is unchanged since. Whether the scene is genuine needs independent checks.

If an image has no credential, is it fake?

No. Credentials are optional and often stripped by screenshots, conversions and uploads. Treat absence as "unknown".

Can someone forge a credential?

Changing a signed file or record breaks the hashes. Anyone can sign their own manifest, though, which is why the trust list and the signer's identity matter.

Does the credential identify the creator?

Not necessarily. The core standard focuses on the content rather than people. Identity is an optional extension, and the signer is often the organisation behind a tool.[2][3]

The next step

A credential answers "who signed, and what did they declare?"; detectors guess "was this made by AI?" from the content alone. Read AI detectors vs. content credentials to see when each check fits.

About these sources

All pages accessed 16 October 2026.

Related reading

• Build an AI voiceover workflow with review
• AI training and copyright: the important distinctions