Home › AI image generation › C2PA and Content Credentials

C2PA and Content Credentials: what they prove and what they don't

C2PA is an open standard for attaching signed provenance data to images, video and audio, including AI-generated content. This guide explains how it works, what a manifest and a binding are, what the standard deliberately does not claim, and how it relates to the EU's labelling rules. It belongs to our AI image generation section; for the law, read the EU AI Act explained.

Quick answerC2PA is an open standard for signed provenance data attached to media; Content Credentials is the name for that data as shown to users. It records who made or edited a file and detects later changes, but it does not judge whether content is true, and the data can be stripped from a file.

Prices last verified against official provider pages on November 13, 2026. How we verify prices. Written by the Chelure Enterprises Editorial Team.

What C2PA is

C2PA stands for the Coalition for Content Provenance and Authenticity. It describes itself as a project of the Joint Development Foundation, a non-profit based in Washington, that combined the efforts of the Content Authenticity Initiative and Project Origin to focus on open, global technical standards. It develops specifications for establishing content provenance and authenticity, identifies provenance requirements, and publishes best practices. The Content Credentials site says the Content Credentials specification is a project hosted by C2PA and that the effort has grown into a collaboration of hundreds of companies, led by organisations including Microsoft, Adobe, Intel, the BBC, Truepic, Sony, Publicis Groupe, OpenAI, Google, Meta and Amazon.

How it works

Term (C2PA specification 2.2)	Meaning
Manifest	The set of information about the provenance of an asset, made of one or more assertions (including content bindings), a single claim and a claim signature, bound into a verifiable unit
Assertion	A statement about the asset, for example how it was made or edited; assertions are trust signals a person can weigh
Hard binding	One or more cryptographic hashes that uniquely identify the entire asset or a portion of it, letting a validator check that the manifest belongs to the asset and that the asset has not been modified
Soft binding	A binding computed from the content itself rather than its raw bits, which can help match an asset to its manifest if the manifest has been stripped and a copy survives elsewhere

What it does not prove

The specification states that C2PA specifications should not provide value judgments about whether a given set of provenance data is good or bad. A valid manifest tells you who signed which claims and whether the file has changed since; it does not say the content is true, and an image without credentials is not necessarily fake. Credentials can also be lost: the specification notes that an asset can become separated from its manifest through removal or corruption of its metadata, which is why soft bindings exist.

C2PA and AI labelling rules

Under Article 50(2) of the EU AI Act, providers of AI systems that generate synthetic audio, image, video or text must make outputs machine-readable and detectable as artificially generated, using solutions that are effective, interoperable, robust and reliable where technically feasible; deployers must disclose deepfakes under Article 50(4). The text we read does not name C2PA, and the Commission is to encourage codes of practice on detecting, marking and labelling AI-generated content. Dates and scope are in our EU AI Act timeline.

What this means in practice

For creators: keep credentials intact where you can; exporting through tools that strip metadata removes them.
For viewers: treat a valid credential as a statement about origin and editing, not a verdict on truth.
For publishers: pair credentials with other checks. Nothing in the standard promises that every copy of an image carries its manifest.

Frequently asked questions

What is C2PA?

C2PA is the Coalition for Content Provenance and Authenticity, a project of the Joint Development Foundation that develops open technical standards for establishing where content came from. It combined the efforts of the Content Authenticity Initiative and Project Origin.

What are Content Credentials?

Content Credentials is the name for the provenance information built on the C2PA specification. The Content Credentials site says the specification is a project hosted by C2PA and that a pin signals the content contains information about its provenance, letting viewers see how it was created and its editing history.

Does C2PA prove an image is real?

No. The specification says it should not provide value judgments about whether a given set of provenance data is good or bad. It records and signs claims about an asset, and a person decides how much to trust them.

Can the credentials be removed?

Yes, the data can become separated from the file. The specification notes that an asset can become separated from its manifest through removal or corruption of metadata, and defines soft bindings, computed from the content itself, to help match an asset to its manifest when that happens.

Does the EU AI Act require C2PA?

In the Article 50 text we read, the Act requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable, detectable format using effective, interoperable, robust and reliable solutions where technically feasible. It does not name C2PA there.

Sources

Primary sources opened on November 13, 2026. Prices come from our verified price table (see the methodology).