AI and automation
Content Credentials and C2PA: provenance for brand assets
Quick answer
Content Credentials are tamper-evident provenance records, defined by the C2PA technical specification (version 2.4, April 2026), that travel with an image, video or document. They show who created it, which tools edited it and whether AI was used. For brands, a DAM must ingest, preserve, display and re-sign these records across renditions and delivery.
Key takeaways
- C2PA specification 2.4, released in April 2026, is the current version; 54 products from 31 companies had passed the C2PA conformance programme by 14 May 2026.
- Validators report a credential as Valid when it is intact and Trusted only when the signer's certificate is on the C2PA Trust List.
- EU AI Act Article 50 marking duties have applied since 2 August 2026, and the June 2026 Code of Practice calls for at least two marking layers where necessary, such as metadata and watermarks.
- Embedded manifests are lost when platforms strip metadata, so durable Content Credentials combine manifests with watermarks and fingerprints.
- Test every DAM stage, from ingest to CDN delivery, with signed sample files before you sign a contract.
Content Credentials give brand assets a signed, tamper-evident history, and in 2026 they moved from pilot to compliance tool. The C2PA specification reached version 2.4 in April 2026, cameras, phones and AI generators now sign files by default, and EU AI Act Article 50 requires machine-readable marking of AI output. For brands, the DAM is where provenance is either preserved or silently stripped.
How Content Credentials and C2PA work
A Content Credential is a signed manifest attached to a file that records its origin and edits. C2PA, the standards body that defines it, was founded in 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic and operates as a project of the Joint Development Foundation, an affiliate of the Linux Foundation. Each manifest holds assertions (capture device, editing actions, ingredients, AI use), a claim and a cryptographic signature from an X.509 certificate. A hash binds the manifest to the pixels, so any undeclared change breaks validation.
Trust depends on who signed. Validators report Valid when a credential is intact and Trusted only when the signer appears on the C2PA Trust List. The C2PA conformance programme certifies generator and validator products; 54 products from 31 companies had passed by 14 May 2026. A separate identity assertion from the Creator Assertions Working Group (CAWG) adds a second signature recording authorship and editorial responsibility.
Who supports Content Credentials in 2026
Adoption now spans capture, creation and distribution, so brand assets increasingly arrive with credentials. On the capture side, Leica (M11-P, 2023), Sony, Canon (EOS R1, 2025) and Nikon (Z6III firmware, 2025) sign images in camera; Nikon later revoked certificates after a vulnerability was found. Google's Pixel 10 has signed photos in the Pixel Camera app since September 2025. AI generators from OpenAI and Google Gemini attach credentials to output.
On distribution, LinkedIn (2024), YouTube (2024) and Cloudflare (2025) read or preserve credentials. Many other platforms still strip metadata on upload. That gap explains the C2PA concept of durable Content Credentials: a manifest combined with an invisible watermark and a fingerprint, so provenance can be recovered after metadata is removed.
Why the EU AI Act makes provenance a compliance topic
Article 50(2) of the EU AI Act (Regulation (EU) 2024/1689) requires providers of generative AI systems to mark output in a machine-readable, detectable format from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, gives systems already on the market before that date until 2 December 2026. The Commission's final Code of Practice on marking and labelling, published on 10 June 2026, states that no single technique is sufficient and calls for at least two layers where necessary, such as metadata and watermarks.
The marking duty sits with model providers, while deployers must disclose deepfakes under Article 50(4). A brand therefore needs its DAM to keep provider marks intact, so it can prove which assets are AI-generated and label them correctly. Our guide to the EU AI Act and marketing content covers deployer duties.
What a DAM must do with Content Credentials
A DAM must handle credentials at five stages, and each one can be tested in a vendor demo.
| Stage | Requirement | Demo test |
|---|---|---|
| Ingest | Read and validate manifests, store Valid or Trusted status | Upload a signed camera file and an AI-generated file |
| Storage | Keep originals intact, index AI-use assertions as metadata | Search for all AI-generated assets |
| Renditions | Preserve or re-sign manifests on crop, resize and format change | Download a WebP rendition and verify it |
| Delivery | Keep manifests in files served via CDN | Inspect a delivered URL |
| Display | Show credential details to users | Open the asset detail view |
Vendor support is uneven. Adobe Experience Manager Assets displays Content Credentials in its Assets view and keeps them intact when assets are downloaded, published or shared. Cloudinary introduced a C2PA option in 2024, initially in beta, that validates and preserves credentials through edits and adds its own assertion stating whether delivery changed the asset's meaning. Add these tests to your DAM selection checklist and to image CDN evaluations.
What to do next
- Inventory which sources already deliver signed files: cameras, agencies, AI tools and stock providers.
- Add the five-stage test table to your next DAM or CDN RFP and run it with your own files.
- Create metadata fields for credential status and AI involvement, and make them searchable.
- Agree with legal how credentials support Article 50 deepfake disclosure, as part of your AI governance policy.
- Sign your own published assets with a certificate on the C2PA Trust List once your tooling supports it.
Frequently asked questions
What is the difference between C2PA and Content Credentials?
C2PA is the standards body and technical specification; Content Credentials is the consumer-facing name for the provenance data that the specification defines. A file carrying a C2PA manifest is said to have Content Credentials, often shown with a small 'Cr' icon.
Does the EU AI Act require C2PA?
No specific standard is mandated. Article 50(2) requires providers of generative AI systems to mark output in a machine-readable, detectable format, and the June 2026 Code of Practice recommends layered measures such as metadata and watermarks. C2PA manifests are a widely adopted way to deliver the metadata layer.
Do Content Credentials survive social media uploads?
Support varies by platform. LinkedIn and YouTube read Content Credentials, while other platforms strip embedded metadata on upload. Watermarks and fingerprints, combined with a manifest, let a verifier recover provenance after metadata is removed.
Sources
- C2PA: Content Credentials Deployment Guidance, version 1.0 (July 2026)
- Content Credentials (Wikipedia)
- European Commission publishes final Code of Practice on marking and labelling AI-generated content (Jones Day, June 2026)
- Adobe Experience Manager Assets: Content Credentials
- Cloudinary: C2PA standard implementation