C2PA

C2PA (Coalition for Content Provenance and Authenticity) defines how to embed a tamper-evident manifest into an image, video, audio file, or document. The manifest is cryptographically signed, so if the metadata is altered the signature breaks. When you open a C2PA-signed file in a compatible tool, you can see a full chain of custody: which device or AI model created it, when, and what post-processing steps followed. Adobe, Google, Microsoft, OpenAI, Meta, and hundreds of others are coalition members, and the standard reached production-scale deployment across major AI tools in 2025 and 2026.

For builders shipping products that generate AI content, C2PA is increasingly a compliance requirement rather than a nice-to-have. The EU AI Act's Article 50 transparency obligations (enforcement began August 2026) and California's SB 942 both require machine-readable disclosure when AI generates content. C2PA is the technical layer that satisfies the machine-readable part. Anthropic confirmed in August 2026 that all Claude models released on or after August 2, 2026 automatically attach C2PA metadata to supported file types including SVG, PNG, and JPG.

C2PA and invisible watermarking (like Google's SynthID) are complementary, not competing. C2PA tells you the full provenance story but depends on metadata surviving file transfers and platform re-uploads, which is not guaranteed. Watermarking embeds a signal directly into the pixels or audio samples, surviving more transformations but carrying far less information. Serious implementations layer both: C2PA for the rich audit trail, watermarking for resilience when metadata gets stripped.