C2PA and provenance for AI content

In short: C2PA is an open standard that embeds verifiable provenance in image, video and audio files: who or what created the file and which edits followed. The display in programs is often called “Content Credentials”.

How it works

1. A camera, editing program or AI service writes a manifest into the file: creator, time, editing steps.
2. The manifest is signed with a digital certificate (see Digital signatures).
3. Whoever checks the file can verify the signature and see whether the content changed since signing.

Watermarks in the image

There are also invisible watermarks computed into the pixels that partly survive scaling or light compression. With enough effort they can be removed or disturbed.

Limits

• A missing manifest proves nothing: screenshots and some platforms strip the data.
• A present manifest only proves what the signer claims, not that the image is “true”.
• Not all devices and services take part.

The standard therefore helps mainly to prove genuine recordings and complements the detection described in Deepfakes and AI detection. Legally the EU AI Act also plays a role, requiring labelling of AI content.

See also: Video generation with AI