{ "meta": { "kit": "ledger-kit", "buildDate": "2026-09-15", "lastVerified": "2026-09-15", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "cadence": "monthly, first Monday, and the same day for any C2PA specification release", "note": "Every row is a verdict about a document somebody else published, with the primary source and the date it was checked beside it. Verified means the document was fetched at its publisher on the date given. Reported means a reliable secondary carries it and the primary could not be reached; a reported row never carries a primary source and is never printed as verified. Announced means a body said it would act and no document exists. Absent means the ledger searched and found nothing, and the search itself is written into the row. Open means a question nobody has settled, posed and not answered.", "vocab": { "idPrefix": "CPS", "root": "/tools/content-provenance-checker", "title": "The Content Provenance Checker", "short": "Content Provenance Checker", "claim": "Whether a file carries Content Credentials, what its metadata declares, and what the standards and laws behind provenance actually require. Inspection in your browser; every standard a verdict about a document.", "changesHeading": "For a publisher, a platform or a newsroom", "kinds": [ { "key": "standard", "label": "Standard", "question": "What does the specification actually define?" }, { "key": "law", "label": "Binding law", "question": "What does the law require to be marked or disclosed?" }, { "key": "platform", "label": "Platform or model provider", "question": "What does a platform or model provider actually embed, display or verify?" }, { "key": "question", "label": "Open question", "question": "What has nobody settled?" } ], "jurisdictions": [ { "code": "US", "name": "United States" }, { "code": "EU", "name": "European Union" }, { "code": "CN", "name": "China" }, { "code": "KR", "name": "South Korea" }, { "code": "GLOBAL", "name": "Global" } ], "facets": [ { "key": "embed", "label": "Embeds a mark or manifest" }, { "key": "display", "label": "Displays or verifies" }, { "key": "require", "label": "What it requires" } ] }, "source": "https://www.gage.academy/tools/content-provenance-checker", "attribution": "GAGE (Global Academy of Generative-AI Education), Content Provenance Checker", "documentation": "https://www.gage.academy/tools/content-provenance-checker/data", "methodology": "https://www.gage.academy/tools/content-provenance-checker/method" }, "records": [ { "id": "CPS-2026-0001", "slug": "c2pa-technical-specification-2-4", "title": "The C2PA technical specification, version 2.4", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "Content Credentials is a published open specification, not a product claim. Version 2.4 is the current release and its own version history dates it to April 2026. It defines a manifest store serialized as JUMBF boxes, assertions in CBOR, a claim, and a claim signature in COSE, bound to the content by a hash.", "key_facts": [ "The specification index at spec.c2pa.org redirects to the 2.4 specification, and requests for versions 2.5, 2.6 and 3.0 return HTTP 404.", "The version history dates release 2.4 to April 2026 and lists a new JSON serialization called crJSON plus repository receipt and environmental sustainability assertions.", "A C2PA Manifest carries an assertion store, a claim and a claim signature; the last manifest in the store is the active manifest.", "The specification never promises that a manifest proves truth; clause 14 decides only whether a signature validates and whether its signer is on a trust list." ], "facets": [ { "key": "embed", "value": "It defines the manifest store itself, a JUMBF superbox labelled c2pa with type UUID 63327061-0011-0010-8000-00AA00389B71, embedded per format by Appendix A.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "It defines validation states and status codes, and clause 16 sets out disclosure levels for how a consumer is shown provenance.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "It is a voluntary specification. It requires nothing of anyone until a law, a contract or a conformance programme points at it.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Read the version number before you quote a rule. A newsroom or platform policy that cites \"the C2PA spec\" without a version is citing a moving target, because 2.4 added serializations and assertions that 2.2 readers will not recognise. Pin the version in your policy, record the date you read it, and re read on each release, because the parsing your engineers build is written against one version of Appendix A and not against the idea of Content Credentials.", "sources": [ { "name": "C2PA Technical Specification 2.4", "url": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA specifications index", "url": "https://spec.c2pa.org/specifications/", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0002", "CPS-2026-0003", "CPS-2026-0004", "CPS-2026-0007" ], "tags": [ "c2pa", "content credentials", "specification", "manifest", "jumbf" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0002", "slug": "how-a-c2pa-manifest-is-embedded", "title": "Where a C2PA manifest actually sits in each file format", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "Appendix A of the specification names an exact marker, chunk or box per format. PNG uses a caBX chunk. JPEG uses APP11 marker segments. WebP and WAV use a RIFF chunk named C2PA. MP4 and HEIF use a uuid box. TIFF uses tag 52545. PDF uses an embedded file stream associated through AF.", "key_facts": [ "PNG: \"a chunk type of 'caBX' (as per PNG, 4.7.2)\", recommended before the IDAT chunks.", "JPEG: the store is the data of APP11 marker segments, marker 0xFFEB, constructed per ISO 19566-5:2023 D.2; multiple segments are contiguous and sequential.", "WebP, WAV, BWF and AVI: a RIFF chunk with the identifier C2PA, as the last sub chunk of the first RIFF header chunk.", "MP4, HEIF, HEIC and AVIF: a uuid box with extended type D8FEC3D6-1B0E-483C-9297-5828877EC481, placed after ftyp and before mdat and moov.", "GIF: an Application Extension block, introducer 0x21, label 0xFF, block size 0xB, identifier C2PA_GIF, the store split into 255 byte sub blocks.", "TIFF and DNG: an IFD tag with ID 52545 decimal, 0xCD41 hex, tag type 7, in the last IFD of the main chain.", "PDF: an embedded file stream whose Subtype is application/c2pa and whose AFRelationship is C2PA_Manifest, referenced from the catalog AF entry.", "SVG: the store Base64 encoded inside a c2pa:manifest element in the SVG metadata element, namespace http://c2pa.org/manifest.", "MP3 and FLAC: an ID3v2 GEOB frame whose MIME type field is the JUMBF media type application/c2pa.", "Clause 11.3 notes that formats which cannot hold arbitrary data, BMP among them, require an external manifest instead." ], "facets": [ { "key": "embed", "value": "Eleven common formats are covered by name, each with its own marker, chunk, box or dictionary key.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Nothing here concerns display. Appendix A is a placement rule; clause 15 decides what a validator may conclude.", "verdict": "absent", "source": 0 }, { "key": "require", "value": "The verbs are normative: the store shall be embedded in the named structure. A file that puts it elsewhere is not carrying a C2PA manifest.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Build your inspector against the clause, not against a library's behaviour. Each of these is a different read path, and a checker that only looks for one of them will report \"no Content Credentials\" on a file that carries them perfectly well. The two traps worth naming: a JPEG can carry APP11 segments for reasons other than C2PA, so presence of APP11 is not presence of a manifest, and an MP4 uuid box begins with eight bytes of merkle offset before the manifest bytes start.", "sources": [ { "name": "C2PA Technical Specification 2.4, Appendix A, Embedding manifests", "url": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html", "type": "primary", "date": "2026-09-15" }, { "name": "ISO/IEC 19566-5:2023, JPEG universal metadata box format", "url": "https://www.iso.org/standard/84635.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0001", "CPS-2026-0007", "CPS-2026-0006" ], "tags": [ "c2pa", "file formats", "manifest", "inspection", "jumbf" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0003", "slug": "c2pa-conformance-program-and-trust-list", "title": "The C2PA conformance programme, the trust list and the conforming products list", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "A signature is only as good as the list behind it. The C2PA conformance programme and the official C2PA Trust List launched in mid 2025, and the interim trust list was frozen on 1 January 2026. The conforming products list is public JSON, so anyone can check whether a named product was ever assessed.", "key_facts": [ "The programme holds generator products, validator products and certification authorities to the specification, the Certificate Policy and the Security Requirements.", "The interim trust list was frozen on 1 January 2026: no new entries, no updates, though content signed during a certificate's validity stays valid against the legacy model.", "The conforming products list is a single JSON file in the C2PA organisation's own public repository, which means a checker can audit a claim rather than trust a press release.", "Every entry in the list read on 2026-09-15 carried status conformant, and each names the spec version it was assessed against, which for the whole list is 2.2." ], "figures": [ { "label": "conforming products listed", "value": 209, "unit": "products", "as_of": "2026-09-15", "source": 1 }, { "label": "generator products", "value": 185, "unit": "products", "as_of": "2026-09-15", "source": 1 }, { "label": "validator products", "value": 24, "unit": "products", "as_of": "2026-09-15", "source": 1 } ], "facets": [ { "key": "embed", "value": "The programme does not embed anything. It assesses the products that do.", "verdict": "absent", "source": 0 }, { "key": "display", "value": "The conformance explorer and the published lists are how the public sees who is on the trust list.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Conformance is voluntary, but the trust list is what decides whether a validator shows a signer as known.", "verdict": "verified", "source": 0 } ], "what_it_changes": "This is the list to check before you accept anybody's claim of conformance. A vendor saying it supports Content Credentials is saying something about its code; a vendor on the conforming products list has been assessed. For a newsroom, the practical rule is that a valid signature from a certificate outside the trust list tells you the bytes were not altered since signing and nothing at all about who signed them.", "sources": [ { "name": "C2PA Conformance", "url": "https://c2pa.org/conformance/", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0001", "CPS-2026-0009", "CPS-2026-0010", "CPS-2026-0017" ], "tags": [ "c2pa", "conformance", "trust list", "certificates", "validation" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15" }, { "id": "CPS-2026-0004", "slug": "iso-cd-22144-content-credentials", "title": "Content Credentials at ISO: ISO/CD 22144", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "The C2PA specification is being taken through ISO as ISO 22144, Authenticity of information, Content credentials. The catalogue entry read at iso.org shows it under development at stage 30.99, committee draft approved for registration as a draft International Standard, in ISO/TC 171/SC 2. It is not yet an International Standard.", "key_facts": [ "The ISO catalogue entry reads \"ISO/CD 22144\" with status \"Under development\" and stage \"CD approved for registration as DIS [30.99]\".", "The project was approved on 2024-10-28 and sits with ISO/TC 171/SC 2, the subcommittee for document file formats.", "The next lifecycle steps printed on the entry are DIS registered and a twelve week DIS ballot, neither of which has a date on the page.", "Until it is published, a procurement clause or a policy should cite the C2PA specification by version, not an ISO number that does not yet exist." ], "facets": [ { "key": "embed", "value": "The draft standardises the same manifest architecture the C2PA specification defines.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Nothing displays anything yet. A draft has no implementations to point at.", "verdict": "absent", "source": 0 }, { "key": "require", "value": "Nothing. A committee draft imposes no obligation on anybody.", "verdict": "absent", "source": 0 } ], "what_it_changes": "Do not write ISO 22144 into a contract or a tender yet. A buyer who requires conformity with an unpublished standard has written an unenforceable clause, and the number may move before publication. Cite the C2PA technical specification and its version, and set a review for when the ISO entry reaches stage 60.60. A publisher watching this should note who holds it: ISO/TC 171/SC 2, the document formats subcommittee, not an AI committee.", "sources": [ { "name": "ISO/CD 22144, Authenticity of information, Content credentials", "url": "https://www.iso.org/standard/90726.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0001", "CPS-2026-0005" ], "tags": [ "iso", "c2pa", "standardisation", "content credentials" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0005", "slug": "jpeg-trust-iso-iec-21617", "title": "JPEG Trust, ISO/IEC 21617", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "JPEG Trust is the other published standard in this lane, and it is a framework for judging trust in media rather than a container format. The catalogue entry shows a second edition, ISO/IEC 21617-1:2026, published in August 2026, and shows the 2025 first edition as withdrawn. Parts 2, 3 and 4 remain under development.", "key_facts": [ "ISO/IEC 21617-1:2026, Information technology, JPEG Trust, Part 1: Core foundation, status Published, edition 2, publication date 2026-08, stage 60.60.", "The lifecycle panel on the same entry shows ISO/IEC 21617-1:2025 as withdrawn, so a citation to the 2025 edition is now a citation to a superseded document.", "Part 1 specifies \"a framework for establishing trust in media\" covering authenticity, provenance, attribution, intellectual property rights and integrity.", "Part 2 trust profiles and reports, Part 3 media asset watermarking and Part 4 reference software are all at draft International Standard stage.", "The JPEG committee's own page states that the framework is built to integrate with JPEG 1, JPEG 2000, JPEG XS, JPEG XL and JPEG AI, and can apply to other modalities." ], "facets": [ { "key": "embed", "value": "Part 3, media asset watermarking, is the embedding part and is still a draft.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Trust profiles and trust reports are the display and judgement side, defined in Part 2, also a draft.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing is required of anyone. It is a published framework, not a mandate.", "verdict": "absent", "source": 0 } ], "what_it_changes": "If your house style already cites ISO/IEC 21617-1:2025, update it: that edition is withdrawn and the current one is the 2026 second edition. The distinction worth carrying into an editorial policy is that C2PA gives you the manifest and JPEG Trust gives you a way to express what your organisation counts as trustworthy, which is a profile question and therefore a policy question, not a parsing question.", "sources": [ { "name": "ISO/IEC 21617-1:2026, JPEG Trust, Part 1: Core foundation", "url": "https://www.iso.org/standard/91405.html", "type": "primary", "date": "2026-09-15" }, { "name": "JPEG Trust overview, the JPEG committee", "url": "https://jpeg.org/jpegtrust/index.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0004", "CPS-2026-0001" ], "tags": [ "jpeg trust", "iso", "watermarking", "trust profiles" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0006", "slug": "iptc-digital-source-type-newscodes", "title": "The IPTC Digital Source Type vocabulary", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "This is the controlled vocabulary that says how a piece of media came to exist. It lives at cv.iptc.org, it is published under CC BY 4.0, and its terms are the values a C2PA action or an XMP field carries. The property name in XMP is Iptc4xmpExt:DigitalSourceType. Several older terms are retired and should not be written.", "key_facts": [ "The scheme URI is http://cv.iptc.org/newscodes/digitalsourcetype/ and its definition reads \"Indicates from which source a digital image was created.\"", "trainedAlgorithmicMedia is named \"Created using Generative AI\" and defined as media \"created algorithmically using an Artificial Intelligence model trained on captured content\".", "compositeWithTrainedAlgorithmicMedia is named \"Edited using Generative AI\", for augmentation or enhancement using a generative model, such as inpainting or outpainting.", "Other live terms include digitalCapture, computationalCapture, negativeFilm, positiveFilm, print, humanEdits, algorithmicallyEnhanced, digitalCreation, dataDrivenMedia, algorithmicMedia, screenCapture, virtualRecording and three composite terms.", "Three terms are marked RETIRED on the page: minorHumanEdits, softwareImage and digitalArt, each with a note naming the replacement.", "The C2PA specification allows an action's digitalSourceType to be an IPTC term or one of two C2PA terms, empty and trainedAlgorithmicData." ], "facets": [ { "key": "embed", "value": "The vocabulary is carried in XMP as Iptc4xmpExt:DigitalSourceType, namespace http://iptc.org/std/Iptc4xmpExt/2008-02-29/.", "verdict": "verified", "source": 1 }, { "key": "display", "value": "It is a value list, so what a reader shows is a label of its own choosing; IPTC supplies the English name and definition.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing is required. It is a vocabulary offered under CC BY 4.0, adopted by C2PA and by platforms that read metadata.", "verdict": "absent", "source": 0 } ], "what_it_changes": "This is the field a newsroom should read first, because it is the one that distinguishes a photograph from a generation from a retouch. Two practical cautions. A retired term in a file is not an error, it is an old file, so map minorHumanEdits to humanEdits rather than rejecting it. And algorithmicallyEnhanced is not generative AI: it covers sharpening and noise reduction, so treating it as an AI flag will label ordinary camera output.", "sources": [ { "name": "IPTC Digital Source Type NewsCodes", "url": "https://cv.iptc.org/newscodes/digitalsourcetype/", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA Technical Specification 2.4, Digital Source Type", "url": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0008", "CPS-2026-0012", "CPS-2026-0002" ], "tags": [ "iptc", "digital source type", "xmp", "vocabulary", "metadata" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0007", "slug": "jumbf-iso-iec-19566-5", "title": "JUMBF, ISO/IEC 19566-5:2023, the box format under every manifest", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "Every C2PA manifest is a JUMBF structure, so the box format is the real floor of this layer. ISO/IEC 19566-5:2023, JPEG universal metadata box format, is published, and an Amendment 1 published in 2025 adds box compression and standalone JUMBF files. The text itself is sold by ISO and cannot be read without purchase.", "key_facts": [ "The catalogue entry reads \"ISO/IEC 19566-5:2023, Information technologies, JPEG systems, Part 5: JPEG universal metadata box format (JUMBF)\", status Published.", "Amendment 1:2025 is also published and is titled \"JUMBF box compression and standalone JUMBF files\", which is what C2PA compressed manifests rest on.", "The C2PA specification cites this document normatively for labels, toggles, content types, URI references and the multi segment JPEG construction.", "A C2PA manifest store is a JUMBF superbox labelled c2pa with type UUID 63327061-0011-0010-8000-00AA00389B71.", "A further edition, ISO/IEC CD 19566-5, is under development, and a reference software part, ISO/IEC 19566-10:2026, is published." ], "facets": [ { "key": "embed", "value": "It defines the boxes: description box, content boxes, labels, toggles and the URI scheme that C2PA addresses assertions with.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "It is a container format and displays nothing.", "verdict": "absent", "source": 0 }, { "key": "require", "value": "Nothing is required of a publisher. It is required of anyone writing a parser, as the document that defines the bytes.", "verdict": "absent", "source": 0 } ], "what_it_changes": "Budget for it. A team building its own reader will need the ISO text, because the C2PA specification delegates the segment level detail to Annex D of this document and prints none of it. That is also why an open source parser is usually the cheaper path: the library authors have already bought the standard. Whoever writes your inspector should be able to say which of the two documents each rule came from.", "sources": [ { "name": "ISO/IEC 19566-5:2023, JPEG universal metadata box format (JUMBF)", "url": "https://www.iso.org/standard/84635.html", "type": "primary", "date": "2026-09-15" }, { "name": "ISO/IEC 19566-5:2023/Amd 1:2025", "url": "https://www.iso.org/standard/88913.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0001", "CPS-2026-0002" ], "tags": [ "jumbf", "iso", "box format", "parsing", "c2pa" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0008", "slug": "digitalsourcetype-inside-a-manifest", "title": "What a manifest says when the content was generated by AI", "kind": "standard", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "Inside a C2PA manifest, the generative claim is not a flag. It is a digitalSourceType key on an action assertion, usually on c2pa.created, whose value is an IPTC term or one of two C2PA terms. Reading it correctly is the difference between saying a file was made with AI and saying its metadata claims so.", "key_facts": [ "The specification states that \"An action may include a digitalSourceType key, whose value shall be one of the terms defined by the IPTC or a C2PA specific value\".", "The two C2PA specific values are http://c2pa.org/digitalsourcetype/empty and http://c2pa.org/digitalsourcetype/trainedAlgorithmicData.", "trainedAlgorithmicData differs from the IPTC trainedAlgorithmicMedia in that the result is a data format such as CSV, not an image or a video.", "The specification names digital capture, digitised from negative and trained algorithmic media as the common uses alongside the c2pa.created action.", "For generative assets, ingredients may be added to the manifest to describe the inputs, referenced from a c2pa.placed or c2pa.created action." ], "facets": [ { "key": "embed", "value": "The value travels inside the manifest, in an action assertion in the assertion store.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "A validator that shows \"AI generated\" is rendering this key. The specification does not dictate the wording.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing requires a generator to set it, which is why a manifest without a digitalSourceType is common and is not evidence of anything.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Write your label from the action, not from the file's mere possession of a manifest. A camera original and a generated image both carry manifests; only the digitalSourceType separates them. And keep the hedge in your interface copy: the manifest records what the signing tool asserted at the moment of signing, so the honest sentence is that the file declares it was created using generative AI, with the signer named beside it.", "sources": [ { "name": "C2PA Technical Specification 2.4, Actions and Digital Source Type", "url": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html", "type": "primary", "date": "2026-09-15" }, { "name": "IPTC Digital Source Type NewsCodes", "url": "https://cv.iptc.org/newscodes/digitalsourcetype/", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0006", "CPS-2026-0001", "CPS-2026-0028" ], "tags": [ "c2pa", "actions", "generative ai", "digital source type" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0009", "slug": "openai-content-provenance", "title": "OpenAI: Content Credentials, SynthID and a verification tool", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "OpenAI publishes a layered position. It has added Content Credentials to generated images since 2024, it became a C2PA conforming generator product, it added Google DeepMind's SynthID watermarking to images, and on 31 July 2026 it extended SynthID to supported audio and opened verification through an API.", "key_facts": [ "OpenAI states it began adding Content Credentials to DALL-E 3 images in 2024 and later to ImageGen and Sora, and joined the C2PA steering committee.", "The post says \"We recently took the step of making OpenAI a C2PA Conforming Generator Product\", and the C2PA conforming products list carries an OpenAI Media Service generator entry.", "OpenAI is explicit that metadata \"can be stripped, lost through uploads and downloads, or broken by transformations like file format changes, resizing, or screenshots\".", "SynthID watermarking was added to images generated through ChatGPT, Codex or the OpenAI API, under a partnership with Google.", "The 31 July 2026 update extends SynthID watermarking to supported audio from ChatGPT and the API, and adds API access for verification.", "OpenAI says its verification tool is limited at launch to content generated by OpenAI, and that if nothing is detected the tool \"will not make a definitive conclusion\"." ], "facets": [ { "key": "embed", "value": "Content Credentials on generated images, and SynthID watermarking on images and, since 31 July 2026, supported audio.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "A public verification tool, in preview, reading both Content Credentials and SynthID, plus API access for verification.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing is required of a user. OpenAI states the behaviour as its own policy, not as an obligation it is passing on.", "verdict": "absent", "source": 0 } ], "what_it_changes": "Two things a publisher can act on. First, an OpenAI image may carry two independent signals, a C2PA manifest and a SynthID watermark, and they fail differently: the manifest dies on a screenshot, the watermark often survives it. Second, OpenAI's own refusal to conclude from absence is the standard you should copy into your newsroom guidance, because a verification tool that reports nothing has reported nothing, not innocence.", "sources": [ { "name": "Advancing content provenance for a safer, more transparent AI ecosystem, OpenAI", "url": "https://openai.com/index/advancing-content-provenance/", "type": "primary", "date": "2026-05-19" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0010", "CPS-2026-0003", "CPS-2026-0025", "CPS-2026-0028" ], "tags": [ "openai", "synthid", "content credentials", "verification", "audio" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0010", "slug": "google-synthid-and-c2pa", "title": "Google: SynthID watermarking, the SynthID Detector, and C2PA in Pixel and Photos", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "Google runs two layers. SynthID embeds an invisible watermark in images, audio, text and video from its generative products, and the SynthID Detector portal checks for it. Separately, Google products are the largest single block on the C2PA conforming products list, including Pixel Camera and Google Photos on Android and iOS.", "key_facts": [ "Google states that \"SynthID embeds digital watermarks directly into AI-generated images, audio, text or video\" and that the watermarks are imperceptible to humans.", "For images and video the watermark is \"designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression\".", "For audio, Google says the watermark is inaudible and \"can't be altered by common modifications like adding noise, MP3 compression, or changing the speed of the track\".", "SynthID Detector is a verification portal for images, audio, video and text made with Google AI; Google says it is working with journalists and media professionals to test it, with a waitlist.", "A user can also upload media to Gemini and ask whether it carries a SynthID watermark.", "In the C2PA conforming products list, Google LLC entries include Pixel Camera and Google Photos for Android and for iOS, all assessed against specification version 2.2 and generating image/jpeg." ], "figures": [ { "label": "Google entries on the C2PA conforming products list", "value": 47, "unit": "products", "as_of": "2026-09-15", "source": 2 } ], "facets": [ { "key": "embed", "value": "SynthID watermarks across Google generative products, and C2PA manifests from Pixel Camera and Google Photos.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "The SynthID Detector portal, and a SynthID check inside Gemini.", "verdict": "verified", "source": 1 }, { "key": "require", "value": "Nothing is required of a user or a publisher. These are product behaviours Google describes on its own pages.", "verdict": "absent", "source": 0 } ], "what_it_changes": "Treat these as two different questions. A SynthID check answers \"did Google AI make this\", and only for Google's own models; a C2PA check answers \"what does this file's manifest declare, and who signed it\". A newsroom that conflates them will over read a negative result. Note also that Pixel Camera signing is a capture claim, not an AI claim, which is exactly the distinction a reader will not make unless your interface makes it for them.", "sources": [ { "name": "SynthID, Google DeepMind", "url": "https://deepmind.google/science/synthid/", "type": "primary", "date": "2026-09-15" }, { "name": "SynthID Detector, Google", "url": "https://blog.google/innovation-and-ai/products/google-synthid-ai-content-detector/", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0009", "CPS-2026-0003", "CPS-2026-0026" ], "tags": [ "google", "synthid", "watermark", "pixel", "c2pa" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15" }, { "id": "CPS-2026-0011", "slug": "adobe-content-authenticity-initiative", "title": "Adobe and the Content Authenticity Initiative", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "Adobe leads the Content Authenticity Initiative, the adoption programme that sits beside the C2PA standards body. Its published position is that its work is compliant with the C2PA specification, and it runs a validator, Adobe Content Authenticity Inspect, which appears on the C2PA conforming products list as a validator product.", "key_facts": [ "The initiative states that \"Our work is fully compliant with the technical specifications released in 2022 by the Coalition for Content Provenance and Authenticity (C2PA) or C2PA Content Credentials\".", "It describes Content Credentials as recording and displaying details about a piece of content \"at every step of its lifecycle\".", "Adobe Content Authenticity Inspect is listed as a conformant validator product against specification version 2.2.", "The same page is the published source for two camera facts: the Leica M11-P as the first camera with Content Credentials built in, and Nikon bringing Content Credentials to models starting with the Z6III.", "It also describes chip level capture, naming a Qualcomm Snapdragon platform working with Truepic, and the ProofMode app for capture with credentials embedded at the source." ], "facets": [ { "key": "embed", "value": "Content Credentials are written by Adobe's creative tools and by the capture partners the initiative names.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Adobe Content Authenticity Inspect reads and verifies manifests, and is a listed conformant validator product.", "verdict": "verified", "source": 1 }, { "key": "require", "value": "Nothing is required. Membership of the initiative is a commitment, not a legal duty.", "verdict": "absent", "source": 0 } ], "what_it_changes": "The initiative is the adoption side, the coalition is the standards side, and conflating them in a policy document is a small error with a real cost, because only one of them publishes the specification you are citing. For a publisher choosing a validator, note that Adobe's is on the conforming products list as a validator, which is a stronger statement than a vendor claiming to support the format.", "sources": [ { "name": "How it works, Content Authenticity Initiative", "url": "https://contentauthenticity.org/how-it-works", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0003", "CPS-2026-0016", "CPS-2026-0001" ], "tags": [ "adobe", "content authenticity initiative", "validator", "content credentials" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0012", "slug": "meta-ai-labels-and-metadata", "title": "Meta: AI labels built on C2PA and IPTC metadata", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "Meta's published position is that it reads the AI generated signals in the C2PA and IPTC standards to label images on Facebook, Instagram and Threads, and that images made with Meta AI carry visible markers, invisible watermarks and embedded metadata. The statement verified here is the February 2024 announcement.", "key_facts": [ "Meta states it is building tools to identify \"the 'AI generated' information in the C2PA and IPTC technical standards\" so it can label images from other companies' tools.", "For its own output: \"When photorealistic images are created using our Meta AI feature, we do several things ... including putting visible markers that you can see on the images, and both invisible watermarks and metadata embedded within image files.\"", "Meta describes its invisible markers for Meta AI images as \"IPTC metadata and invisible watermarks\", aligned to Partnership on AI best practices.", "Meta named Google, OpenAI, Microsoft, Adobe, Midjourney and Shutterstock as the sources whose metadata it would label as those companies implement it.", "Meta said it was \"looking for ways to make it more difficult to remove or alter invisible watermarks\", and referenced its own Stable Signature research.", "No Meta entry appears on the C2PA conforming products list read on 2026-09-15." ], "facets": [ { "key": "embed", "value": "IPTC metadata and an invisible watermark on images made with Meta AI, alongside a visible marker.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "An AI label applied when Meta reads the AI generated signal in C2PA or IPTC metadata on an upload.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Meta requires users to disclose realistic AI generated video or audio, and states it may apply penalties for failing to do so.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Two operational consequences. First, Meta labels on what it reads, so a stripped manifest on an upload means a real AI image can travel unlabelled through Facebook or Instagram, and your monitoring should expect that. Second, the verified statement is from February 2024, so a policy that quotes Meta's current behaviour should re verify at Meta's own transparency pages before publication rather than relying on this record.", "sources": [ { "name": "Labeling AI-Generated Images on Facebook, Instagram and Threads, Meta", "url": "https://about.fb.com/news/2024/02/labeling-ai-generated-images-on-facebook-instagram-and-threads/", "type": "primary", "date": "2024-02-06" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0006", "CPS-2026-0013", "CPS-2026-0025" ], "tags": [ "meta", "facebook", "instagram", "labelling", "iptc" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0013", "slug": "tiktok-reads-content-credentials", "title": "TikTok: reading Content Credentials to label uploads", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "TikTok announced in May 2024 that it reads Content Credentials on upload and applies an AI generated label automatically, the first video sharing platform to do so. It also said it would begin attaching Content Credentials to TikTok content so the credentials stay on downloaded files.", "key_facts": [ "TikTok states it launched \"the ability to read Content Credentials, a technology from the Coalition for Content Provenance and Authenticity (C2PA)\" to auto label content from other platforms.", "The reading capability started with images and videos, with audio only content described as coming after.", "TikTok said it would start attaching Content Credentials to TikTok content, \"which will remain on content when downloaded\", so others could read them.", "TikTok joined the Adobe led Content Authenticity Initiative in the same announcement.", "TikTok cautioned that auto labelling \"may be gradual at first, since it needs to have the Content Credentials metadata for us to identify and label it\".", "No TikTok entry appears on the C2PA conforming products list read on 2026-09-15." ], "facets": [ { "key": "embed", "value": "TikTok stated an intention to attach Content Credentials to TikTok content that survive download.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "It reads Content Credentials on upload and applies an AI generated label automatically.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "TikTok has required creators to label realistic AI generated content since before this announcement, and supplies a tool for doing so.", "verdict": "verified", "source": 0 } ], "what_it_changes": "The candid line in TikTok's own announcement is the one to carry into a newsroom brief: auto labelling only works on files that still hold the metadata, so coverage is a function of what survives the upload pipeline, not of how good the detector is. If you publish to TikTok and care that your provenance travels, check a downloaded copy of your own post and see what is actually still in the file.", "sources": [ { "name": "Partnering with our industry to advance AI transparency and literacy, TikTok Newsroom", "url": "https://newsroom.tiktok.com/en-us/partnering-with-our-industry-to-advance-ai-transparency-and-literacy", "type": "primary", "date": "2024-05-09" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0012", "CPS-2026-0014", "CPS-2026-0011" ], "tags": [ "tiktok", "content credentials", "auto labelling", "platform" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0014", "slug": "youtube-c2pa-labels", "title": "YouTube: a C2PA manifest can trigger the AI label by itself", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "YouTube asks creators to disclose realistic synthetic content, and it also applies the label on its own. Its help page names C2PA metadata as one of the conditions under which YouTube may automatically apply an AI label on the player or in the expanded description, and a label applied that way cannot be adjusted by the creator.", "key_facts": [ "YouTube states it \"may automatically apply an AI label on the video player or in the expanded description for: Content that contains C2PA metadata\".", "Creators are notified in YouTube Studio when an AI label has been applied automatically.", "Content made with YouTube's AI tools, content containing C2PA metadata, or content labelled after manual review \"can not be adjusted\" by the creator.", "A label in the player is used for photorealistic AI content; a label in the expanded description is used for non photorealistic or animated content.", "YouTube warns that creators who consistently fail to disclose may face manual labelling, content removal or suspension from the YouTube Partner Program." ], "facets": [ { "key": "embed", "value": "The help page describes reading, not writing. It does not state that YouTube embeds a manifest in delivered video.", "verdict": "absent", "source": 0 }, { "key": "display", "value": "An AI label on the player or in the expanded description, applied automatically when C2PA metadata is present.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Creators must disclose realistic altered or synthetic content, with penalties named for consistent failure to do so.", "verdict": "verified", "source": 0 } ], "what_it_changes": "This is the clearest case in the dataset of metadata carrying a consequence. If your production pipeline signs manifests, understand that a manifest recording a generative edit can put an immovable AI label on your upload, whatever your own disclosure choice was. Decide this before publication, not after: check what your editing tools wrote into the file, because on YouTube the file's own claim can outrank the one the creator makes in the form.", "sources": [ { "name": "Disclosing use of altered or synthetic content, YouTube Help", "url": "https://support.google.com/youtube/answer/14328491", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0013", "CPS-2026-0010", "CPS-2026-0025" ], "tags": [ "youtube", "labelling", "c2pa", "disclosure" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0015", "slug": "microsoft-azure-openai-content-credentials", "title": "Microsoft: Content Credentials on Azure OpenAI images", "kind": "platform", "verdict": "verified", "jurisdiction": "US", "answer": "Microsoft applies Content Credentials automatically to every image generated by Azure OpenAI image models, with no setup by the customer. The manifest is cryptographically signed by a certificate that traces back to Azure OpenAI, which means the signer a validator shows is Microsoft's service, not the customer who made the image.", "key_facts": [ "Microsoft states that \"All AI-generated images from Azure OpenAI in Microsoft Foundry Models include Content Credentials, a tamper-evident way to disclose the origin and history of content\".", "\"Content Credentials are automatically applied to all generated images from DALL-E and GPT-image-1 series models in Azure OpenAI\", with no additional setup.", "\"The manifest is cryptographically signed by a certificate that traces back to Azure OpenAI\", and the manifest carries the timestamp of when the credentials were created.", "Microsoft names the C2PA open technical specification as the basis, describing C2PA as a Joint Development Foundation project." ], "facets": [ { "key": "embed", "value": "A signed C2PA manifest on every generated image, applied automatically.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "The page describes generation, not a Microsoft validator surface for end users.", "verdict": "absent", "source": 0 }, { "key": "require", "value": "Nothing is required of the customer, which is the point: the behaviour is on by default and not configurable from the page.", "verdict": "absent", "source": 0 } ], "what_it_changes": "For an enterprise, this is a disclosure decision that has already been made for you. Any image your application generates through Azure OpenAI leaves your service carrying a signed statement that it was machine generated, and your customer's platform may act on that. That is usually what you want, but it is worth writing into the product's own documentation, because a customer who discovers it from a third party validator will read it as a surprise.", "sources": [ { "name": "Content Credentials in Azure OpenAI, Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-credentials", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0009", "CPS-2026-0003" ], "tags": [ "microsoft", "azure openai", "content credentials", "signing" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0016", "slug": "cameras-that-sign-at-capture", "title": "Cameras that sign at capture", "kind": "platform", "verdict": "verified", "jurisdiction": "GLOBAL", "answer": "Provenance at capture is a real product, not a plan. Leica publishes a list of models with Content Credentials, beginning with the M11-P, which its own page and the Content Authenticity Initiative both describe as the first production camera to carry them. Google's Pixel Camera is on the C2PA conforming products list as a generator.", "key_facts": [ "Leica's Content Credentials page lists the SL3-P, Q3 Monochrom, M EV1, SL3-S, M11-D and M11-P as cameras with Content Credentials.", "The Content Authenticity Initiative describes the M11-P as \"the world's first camera with Content Credentials built in\".", "The same initiative page states that \"Nikon is bringing Content Credentials to future camera models, starting with Z6III\".", "Google's Pixel Camera appears on the C2PA conforming products list as a conformant generator product against specification version 2.2, generating image/jpeg.", "Pixel Camera and Google Photos entries list Android key attestation as the attestation method, which is how the signing key is bound to the device." ], "facets": [ { "key": "embed", "value": "A C2PA manifest written into the JPEG at the moment of capture, signed by a key held on the device.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Leica points readers to a public analyse page for a sample image rather than showing verification in the camera.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing requires a camera maker to do this today, though California will require an option for a latent disclosure on devices first sold from 2028.", "verdict": "verified", "source": 2 } ], "what_it_changes": "A signed capture answers a narrower question than most readers assume. It says this device produced these pixels at this time, and it says nothing about whether the scene was staged or the caption is true. For a newsroom, the usable value is in the chain: a camera original with a manifest, edited in a tool that also signs, gives an editor a verifiable edit history rather than a claim of truth, and that is the promise to make to readers.", "sources": [ { "name": "Leica Content Credentials", "url": "https://leica-camera.com/en-int/photography/content-credentials", "type": "primary", "date": "2026-09-15" }, { "name": "How it works, Content Authenticity Initiative", "url": "https://contentauthenticity.org/how-it-works", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0011", "CPS-2026-0010", "CPS-2026-0020" ], "tags": [ "cameras", "leica", "nikon", "capture", "content credentials" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0017", "slug": "anthropic-publishes-no-provenance-mark", "title": "Anthropic: no published provenance mark", "kind": "platform", "verdict": "absent", "jurisdiction": "US", "answer": "Anthropic is a signatory to the European code of practice on marking and labelling, but no Anthropic page found in this search states that Claude embeds a C2PA manifest, an IPTC field or a watermark in any media it produces. The ledger records the search rather than inferring a behaviour from silence.", "key_facts": [ "Anthropic's transparency page was fetched in full and contains no occurrence of C2PA, Content Credentials, provenance or watermark.", "No applicant matching Anthropic appears among the entries on the C2PA conforming products list.", "Anthropic is named in the European Commission's material as an example of a signatory to section 1 of the code of practice on transparency of AI generated content.", "Absence of a published statement is not absence of a behaviour; it means nobody has been told, which is itself the finding." ], "facets": [ { "key": "embed", "value": "No published statement that any Anthropic product embeds a manifest or a watermark.", "verdict": "absent" }, { "key": "display", "value": "No published Anthropic verification or detection surface for provenance marks.", "verdict": "absent" }, { "key": "require", "value": "Anthropic appears as a signatory to the European code of practice, which is a commitment to its measures rather than a described product behaviour.", "verdict": "verified", "source": 2 } ], "what_it_changes": "If you are procuring a model and provenance matters, ask for it in writing rather than assuming. This is the general lesson of the platform half of this ledger: the companies that mark their output say so on their own pages, in detail, because saying so is the point of doing it. A vendor that has published nothing has given you nothing to rely on, and a contract clause is the remedy, not an inference.", "search": "Searched on 2026-09-15: anthropic.com/transparency fetched in full and scanned for C2PA, Content Credentials, provenance and watermark, zero hits; anthropic.com/search?q=C2PA returns HTTP 404; and the C2PA conforming products list was scanned for an Anthropic applicant, none found. No published Anthropic statement about embedding a manifest or a watermark was located.", "sources": [ { "name": "Transparency, Anthropic", "url": "https://www.anthropic.com/transparency", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA conforming products list", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "type": "primary", "date": "2026-09-15" }, { "name": "Code of Practice on Transparency of AI-generated Content, European Commission", "url": "https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content", "type": "secondary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0019", "CPS-2026-0003" ], "tags": [ "anthropic", "absent", "model providers", "disclosure" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0018", "slug": "eu-ai-act-article-50-2-machine-readable-marking", "title": "EU AI Act Article 50(2): machine readable marking", "kind": "law", "verdict": "verified", "jurisdiction": "EU", "answer": "This is the clause that turns provenance from a good practice into a duty. Providers of AI systems generating synthetic audio, image, video or text must mark the outputs in a machine readable format and make them detectable as artificially generated or manipulated. The obligation is qualified by technical feasibility and by the state of the art.", "key_facts": [ "The text reads that providers \"shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated\".", "The duty falls on providers, including providers of general purpose AI systems, and covers audio, image, video and text alike.", "Technical solutions must be \"effective, interoperable, robust and reliable as far as this is technically feasible\", taking account of content type, cost and the acknowledged state of the art \"as may be reflected in relevant technical standards\".", "The obligation does not apply where the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.", "A further carve out covers systems authorised by law to detect, prevent, investigate or prosecute criminal offences.", "The transparency obligations in Article 50 apply from 2 August 2026, as the Commission states alongside its code of practice." ], "facets": [ { "key": "embed", "value": "It requires a mark in a machine readable format, without naming a format.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Article 50 also covers deployer side disclosure of deepfakes and of AI generated text on matters of public interest.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Marking and detectability, effective and interoperable as far as technically feasible, applying from 2 August 2026.", "verdict": "verified", "source": 1 } ], "what_it_changes": "Read the qualifiers as closely as the duty. The clause does not name C2PA, or watermarking, or any technology; it names properties, and it points at technical standards as evidence of the state of the art. That is why the conformance list and the published specification version matter commercially: they are how a provider shows that what it chose was effective and interoperable. The editing carve out is the one that most publishers will rely on, and it is narrow.", "sources": [ { "name": "Regulation (EU) 2024/1689, Artificial Intelligence Act, Article 50", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689", "type": "primary", "date": "2024-07-12" }, { "name": "Commission publishes Code of Practice on marking and labelling AI-generated content", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-publishes-code-practice-marking-and-labelling-ai-generated-content", "type": "primary", "date": "2026-06-10" } ], "related_ids": [ "CPS-2026-0019", "CPS-2026-0020", "CPS-2026-0021" ], "tags": [ "eu ai act", "article 50", "marking", "transparency", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0019", "slug": "eu-code-of-practice-marking-and-labelling", "title": "The EU code of practice on marking and labelling of AI generated content", "kind": "law", "verdict": "verified", "jurisdiction": "EU", "answer": "The Commission published the final code of practice on 10 June 2026. It is voluntary, it maps the Article 50 duties into practical measures, and a signatory can rely on it to demonstrate compliance. Anyone complying by other means must show their measures are adequate to a market surveillance authority, case by case.", "key_facts": [ "The Commission describes the code as voluntary, setting out practical steps for providers and deployers of generative AI systems to meet the Article 50 transparency obligations that apply from 2 August 2026.", "Signatories \"can rely on its measures to demonstrate compliance\"; those complying by other means \"will have to demonstrate that those measures are adequate\", assessed individually by market surveillance authorities.", "Working group 1 covered providers, on machine readable marking and detectability; working group 2 covered deployers, on labelling deepfakes and AI generated text on matters of public interest.", "The code is complemented by Commission guidelines on the scope of the Article 50 transparency obligations, published in draft on 8 May 2026.", "Signatories also join signatory taskforces to share practice on implementation.", "The drafting ran from a kick off plenary on 5 November 2025 through first and second drafts on 17 December 2025 and 3 March 2026 to the closing plenary on 10 June 2026." ], "figures": [ { "label": "signatories by the close of July 2026", "value": 190, "unit": "organisations", "as_of": "2026-07-31", "source": 1 } ], "facets": [ { "key": "embed", "value": "The provider section covers marking outputs in a machine readable format and making them detectable.", "verdict": "verified", "source": 1 }, { "key": "display", "value": "The deployer section covers labelling deepfakes and certain AI generated text, and a set of EU icons is offered for the disclosure.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Nothing, in itself. It is voluntary; its force is evidential, as the recognised way to show compliance with Article 50.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Signing is a compliance strategy, not a formality. The code converts an open ended legal standard into a named set of measures, and the alternative is arguing adequacy to a regulator with no safe harbour. For a publisher rather than a model provider, the second section is the one to read, because it governs labelling deepfakes and AI generated text on matters of public interest, with an exception where the publication had human review and editorial responsibility.", "sources": [ { "name": "Commission publishes Code of Practice on marking and labelling AI-generated content", "url": "https://digital-strategy.ec.europa.eu/en/news/commission-publishes-code-practice-marking-and-labelling-ai-generated-content", "type": "primary", "date": "2026-06-10" }, { "name": "Code of Practice on Transparency of AI-generated Content, European Commission", "url": "https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0018", "CPS-2026-0017" ], "tags": [ "eu", "code of practice", "labelling", "article 50", "signatories" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15" }, { "id": "CPS-2026-0020", "slug": "california-ai-transparency-act", "title": "The California AI Transparency Act, SB 942 as amended by AB 853", "kind": "law", "verdict": "verified", "jurisdiction": "US", "answer": "California put duties on three different parties. Large generative AI providers must embed a latent disclosure and offer a free detection tool. From 1 January 2027 large online platforms must detect provenance data and must not strip it. From 1 January 2028 capture device makers must offer a latent disclosure on new devices.", "key_facts": [ "SB 942 requires a covered provider to include a latent disclosure conveying the provider's name, the system name and version, the time and date of creation or alteration, and a unique identifier.", "That latent disclosure must be detectable by the provider's own AI detection tool, \"consistent with widely accepted industry standards\", and \"permanent or extraordinarily difficult to remove, to the extent it is technically feasible\".", "A covered provider is one whose generative AI system has over 1,000,000 monthly visitors or users and is publicly accessible in California.", "AB 853 adds a duty on a large online platform to detect provenance data compliant with widely adopted specifications and to provide an interface disclosing it, operative on 1 January 2027.", "The same section states a platform \"shall not, to the extent technically feasible, knowingly strip any system provenance data or digital signature\" from content it distributes.", "From 1 January 2028 a capture device manufacturer must offer a latent disclosure option and embed latent disclosures by default on devices first produced for sale in California from that date.", "AB 853 moved the operative date of the chapter to 2 August 2026 and was chaptered as Chapter 674, Statutes of 2025." ], "figures": [ { "label": "civil penalty per violation", "value": 5000, "unit": "US dollars", "as_of": "2026-09-15", "source": 0 }, { "label": "unique monthly user floor for a large online platform", "value": 2000000, "unit": "users", "as_of": "2026-09-15", "source": 1 } ], "facets": [ { "key": "embed", "value": "A latent disclosure by the provider, and from 2028 a latent disclosure by default on new capture devices.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "From 2027 a large online platform must surface provenance data in a user interface and let a user inspect or download it.", "verdict": "verified", "source": 1 }, { "key": "require", "value": "Marking, detection, non stripping, and a free detection tool, each on a different party with its own operative date.", "verdict": "verified", "source": 1 } ], "what_it_changes": "This is the first law that makes stripping provenance a violation rather than a nuisance, and it reaches any platform with more than 2,000,000 unique monthly users in the preceding twelve months. If you run a publishing pipeline, audit it now for where metadata is discarded, because re encoding, resizing and CDN transforms are all places a manifest quietly dies, and after 1 January 2027 that is a compliance question with a daily penalty behind it.", "sources": [ { "name": "SB 942, California AI Transparency Act, bill text", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB942", "type": "primary", "date": "2026-09-15" }, { "name": "AB 853, California AI Transparency Act, bill text", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853", "type": "primary", "date": "2026-09-15" }, { "name": "AB 853 bill status", "url": "https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB853", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0016", "CPS-2026-0018", "CPS-2026-0025" ], "tags": [ "california", "sb 942", "ab 853", "latent disclosure", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15" }, { "id": "CPS-2026-0021", "slug": "china-ai-content-labelling-measures", "title": "China's Measures for Labelling AI Generated Synthetic Content", "kind": "law", "verdict": "verified", "jurisdiction": "CN", "answer": "China's labelling Measures took effect on 1 September 2025 and are the only regime in this ledger that already requires a mark in file metadata. Service providers must add an implicit label to the metadata of generated content, and distribution platforms must check that metadata and label what they find, or flag what they suspect.", "key_facts": [ "Article 5 requires service providers to add an implicit label in the file metadata of generated synthetic content, carrying attribute information, the provider's name or code and a content number.", "The same article defines file metadata as descriptive information embedded in the file header recording source, attributes and purpose, and encourages digital watermarks as a further implicit label.", "Article 4 sets out explicit labels: visible or audible prompts at the start, end or an appropriate point of text, audio, image, video and virtual scenes.", "Article 6 requires a distribution platform to verify whether the metadata carries an implicit label, and to add a prominent notice where it does, where the user declares it, or where it detects traces of generation.", "Article 10 forbids any organisation or individual from maliciously deleting, altering, forging or concealing a label, or supplying tools to do so.", "Article 11 requires labelling activity to also comply with mandatory national standards, and Article 14 sets entry into force on 1 September 2025." ], "facets": [ { "key": "embed", "value": "An implicit label in the file metadata, naming the provider and a content number, with watermarks encouraged.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "Distribution platforms must add a prominent visible notice around the published content, in three graded forms.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "Explicit and implicit labels from providers, verification and notice from platforms, and a prohibition on removing or forging labels.", "verdict": "verified", "source": 0 } ], "what_it_changes": "If you distribute into China, the duty is not only to label your own output but to inspect what others upload. Article 6 sets three tiers, a confirmed label, a user declaration and a suspicion, each with its own notice, which is the most detailed answer any regulator has given to the question of what a platform should do with a file it cannot fully verify. It is worth reading even if you never operate there.", "sources": [ { "name": "Measures for Labelling AI Generated Synthetic Content, Cyberspace Administration of China", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "type": "primary", "date": "2025-03-14" } ], "related_ids": [ "CPS-2026-0018", "CPS-2026-0020", "CPS-2026-0022" ], "tags": [ "china", "cac", "labelling", "metadata", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0022", "slug": "south-korea-ai-framework-act-labelling", "title": "South Korea's AI Basic Act and its labelling duty", "kind": "law", "verdict": "reported", "jurisdiction": "KR", "answer": "South Korea's AI Basic Act and its Enforcement Decree took effect on 22 January 2026, with transparency duties on generative and high impact AI. The primary text could not be read in English at the national law portal, so this record rests on a secondary account and is not printed as verified.", "key_facts": [ "The United States Department of Commerce reports that the Act and its Enforcement Decree \"took effect on January 22, 2026\", combining industrial promotion with baseline obligations for trust, safety, transparency and user protection.", "The same account states that providers using high impact AI or generative AI must notify users in advance that AI is being used.", "It reports that in service uses such as chatbots, games or metaverse environments may allow flexible disclosure through interface notices, while exported synthetic content is expected to carry clearer labelling or identification.", "It notes that the ministry operates a help desk through the Korea Software Industry Association and has issued guidelines including one on generative AI transparency.", "The Korean national law information centre returned no English text of the Act on the date of this check, which is why the verdict is reported and not verified." ], "facets": [ { "key": "embed", "value": "Reported to require identification on exported synthetic content; the mechanism is not verified here.", "verdict": "reported", "source": 0 }, { "key": "display", "value": "Reported to allow interface level notices for in service interactive uses such as chatbots.", "verdict": "reported", "source": 0 }, { "key": "require", "value": "Reported: advance notification that AI is in use, and labelling where output is hard to tell from non AI content.", "verdict": "reported", "source": 0 } ], "what_it_changes": "Treat this as a flag to get local advice, not as a rule to code against. The distinction the secondary account draws, between an interface notice for an interactive service and a mark carried by exported content, is the one that will decide whether your product needs a watermark or only a banner, and that is exactly the kind of line that a translation can blur. Ask Korean counsel for the operative article before you build.", "sources": [ { "name": "South Korea AI Basic Act, International Trade Administration", "url": "https://www.trade.gov/market-intelligence/south-korea-ai-basic-act", "type": "secondary", "date": "2026-09-15" }, { "name": "AI Basic Act Update: Enforcement and Key Implications, Shin and Kim", "url": "https://www.shinkim.com/eng/media/newsletter/3117", "type": "secondary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0021", "CPS-2026-0018" ], "tags": [ "south korea", "labelling", "watermark", "reported", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0023", "slug": "take-it-down-act-no-provenance-duty", "title": "The TAKE IT DOWN Act requires no provenance mark", "kind": "law", "verdict": "absent", "jurisdiction": "US", "answer": "The TAKE IT DOWN Act is often cited in provenance discussions, and it does not belong there. The enacted text, Public Law 119-12 of 19 May 2025, creates a criminal prohibition on publishing nonconsensual intimate images and a notice and removal duty on covered platforms. It says nothing about marking, watermarking or metadata.", "key_facts": [ "The Act is Public Law 119-12, enacted 19 May 2025, from S. 146, titled the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act.", "Section 2 amends section 223 of the Communications Act of 1934 to add a criminal prohibition on intentional disclosure of nonconsensual intimate visual depictions.", "A full text scan of the enacted law returns zero occurrences of provenance, watermark, metadata or C2PA.", "Its remedy is takedown after the fact, which is a different mechanism from marking at the point of creation and does not substitute for one." ], "facets": [ { "key": "embed", "value": "The Act requires no mark of any kind to be embedded in any file.", "verdict": "absent", "source": 0 }, { "key": "display", "value": "It requires no display of provenance and no verification surface.", "verdict": "absent", "source": 0 }, { "key": "require", "value": "It requires covered platforms to remove nonconsensual intimate visual depictions on notice, which is a takedown duty, not a marking duty.", "verdict": "verified", "source": 0 } ], "what_it_changes": "Correct the citation if it appears in your policy. A compliance programme built on TAKE IT DOWN is a notice and removal programme, with the response clock that implies, and it will not satisfy any marking duty in the European Union, California or China. The two obligations need separate owners inside an organisation, because one is a content operations problem and the other is an engineering problem in the encoding pipeline.", "search": "Searched on 2026-09-15: the enacted text of Public Law 119-12 was fetched from govinfo.gov and scanned in full for provenance, watermark, metadata and C2PA. Zero occurrences of any of them. The Act's operative provisions are a criminal prohibition and a notice and removal duty, so no provenance marking obligation exists in it.", "sources": [ { "name": "Public Law 119-12, TAKE IT DOWN Act, enacted text", "url": "https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm", "type": "primary", "date": "2025-05-19" } ], "related_ids": [ "CPS-2026-0024", "CPS-2026-0020" ], "tags": [ "united states", "take it down act", "absent", "takedown", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0024", "slug": "copied-act-s-1396", "title": "The COPIED Act, S. 1396 in the 119th Congress", "kind": "law", "verdict": "verified", "jurisdiction": "US", "answer": "The nearest thing to a federal provenance bill is the Content Origin Protection and Integrity from Edited and Deepfaked Media Act, introduced in the Senate on 9 April 2025 as S. 1396. It would direct standards work, require tools to offer provenance information and prohibit its removal. The text read here is the introduced version.", "key_facts": [ "The bill's long title is \"To require transparency with respect to content and content provenance information, to protect artistic content, and for other purposes\".", "It was introduced on 9 April 2025 by Senator Cantwell with Senators Blackburn and Heinrich, and referred to the Committee on Commerce, Science, and Transportation.", "Section 4 would have the National Institute of Standards and Technology facilitate development of standards for content provenance information, with section 5 directing research.", "Section 6 is titled Requirements for Content Provenance Information; Prohibited Acts, and includes a subsection on removal of content provenance information.", "Its duty on tool makers would begin two years after enactment, and applies to anyone who for a commercial purpose makes available a tool whose primary purpose is creating synthetic or synthetically modified content.", "That duty is framed as giving users the ability to include provenance information, taking the section 4 standards into consideration, rather than mandating a mark on every output." ], "facets": [ { "key": "embed", "value": "It would require tools to offer users the ability to attach content provenance information, not to attach it always.", "verdict": "verified", "source": 0 }, { "key": "display", "value": "It carries no display duty of its own; its enforcement section sits with the Federal Trade Commission and state attorneys general.", "verdict": "verified", "source": 0 }, { "key": "require", "value": "The status of the bill beyond its introduced text could not be confirmed here, because congress.gov refused every request made during this build.", "verdict": "absent" } ], "what_it_changes": "Plan around state law, not this. The federal bill read here would give users an option rather than mark by default, which is weaker than what California already enacted and far weaker than Article 50. A publisher building one pipeline for several jurisdictions should build to the strictest rule it faces, which today is the combination of a machine readable mark in the European Union and a non stripping duty in California.", "sources": [ { "name": "S. 1396, COPIED Act, introduced in Senate, 119th Congress", "url": "https://www.govinfo.gov/content/pkg/BILLS-119s1396is/html/BILLS-119s1396is.htm", "type": "primary", "date": "2025-04-09" } ], "related_ids": [ "CPS-2026-0023", "CPS-2026-0020" ], "tags": [ "united states", "copied act", "congress", "provenance", "law" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [] }, { "id": "CPS-2026-0025", "slug": "is-a-stripped-manifest-evidence-of-tampering", "title": "Is a stripped manifest evidence of tampering?", "kind": "question", "verdict": "open", "jurisdiction": "GLOBAL", "answer": "No standard answers this, and the honest position is that a missing manifest is usually a pipeline, not a person. OpenAI states plainly that metadata can be stripped or broken by uploads, format changes, resizing and screenshots. The same absence follows from an ordinary resize and from a deliberate scrub, and nothing in the file distinguishes them.", "key_facts": [ "OpenAI states that C2PA metadata \"can be stripped, lost through uploads and downloads, or broken by transformations like file format changes, resizing, or screenshots\".", "California will require large online platforms not to knowingly strip provenance data from 1 January 2027, which is a duty on the platform, not a rule of evidence about a file.", "China's Measures forbid maliciously deleting, altering, forging or concealing a label, which makes intent the test, and intent is not readable from the file.", "The C2PA specification offers external manifests and soft bindings precisely because embedded manifests do not always survive, so their absence is anticipated by the design." ], "what_it_changes": "Write the rule into your verification desk before you need it. A file with no manifest should route to ordinary sourcing work, not to a tampering finding, and your published methodology should say so, because the first time you imply that a missing manifest means something sinister you will be wrong about a file that simply went through a resize. Where you can, ask the source for the original rather than judging the copy.", "sources": [ { "name": "Advancing content provenance, OpenAI", "url": "https://openai.com/index/advancing-content-provenance/", "type": "primary", "date": "2026-05-19" }, { "name": "AB 853, California AI Transparency Act", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0028", "CPS-2026-0020", "CPS-2026-0009" ], "tags": [ "open question", "stripping", "evidence", "verification" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [], "facets": [] }, { "id": "CPS-2026-0026", "slug": "does-a-watermark-survive-re-encoding", "title": "Does a watermark survive re encoding?", "kind": "question", "verdict": "open", "jurisdiction": "GLOBAL", "answer": "Vendors describe robustness in prose and no published standard sets a survival threshold. Google says SynthID is designed to withstand cropping, filters, frame rate changes and lossy compression, and for audio noise, MP3 compression and speed changes. Designed to withstand is not measured to survive, and no public benchmark settles the gap.", "key_facts": [ "Google states that the image and video watermark is \"designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression\".", "For audio Google states the watermark \"can't be altered by common modifications like adding noise, MP3 compression, or changing the speed of the track\".", "OpenAI's framing is comparative rather than absolute: watermarking \"can be more durable through transformations like screenshots\", while metadata carries more information.", "The C2PA specification treats invisible watermarks as soft bindings, a separate mechanism from the hard binding hash, and maintains a referenced list of soft binding algorithms rather than a survival guarantee.", "JPEG Trust Part 3, media asset watermarking, is still at draft International Standard stage, so the standardised account of watermark behaviour does not exist yet." ], "what_it_changes": "Do not build a workflow that treats a watermark check as a pass or fail gate. Robustness claims here are directional, made by the party with an interest, and untested against your specific pipeline. The defensible practice is to record which signal you found, which tool you used and when, and to keep the original file, so that a later finding about robustness does not invalidate everything you published.", "sources": [ { "name": "SynthID, Google DeepMind", "url": "https://deepmind.google/science/synthid/", "type": "primary", "date": "2026-09-15" }, { "name": "Advancing content provenance, OpenAI", "url": "https://openai.com/index/advancing-content-provenance/", "type": "primary", "date": "2026-05-19" }, { "name": "ISO/IEC DIS 21617-3, JPEG Trust, Part 3: Media asset watermarking", "url": "https://www.iso.org/standard/90209.html", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0010", "CPS-2026-0005", "CPS-2026-0025" ], "tags": [ "open question", "watermark", "robustness", "synthid" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [], "facets": [] }, { "id": "CPS-2026-0027", "slug": "who-answers-for-a-false-manifest", "title": "Who answers for a manifest that is signed and false?", "kind": "question", "verdict": "open", "jurisdiction": "GLOBAL", "answer": "A C2PA signature proves that a named key signed these bytes. It does not prove the statements inside are true. No standard or law in this ledger says who is liable when a validly signed manifest asserts something false, and the trust model decides only whether a signature verifies and whether its signer is on a list.", "key_facts": [ "The C2PA trust model is expressed as validation states: well formed, valid and trusted, each about signatures, certificates and lists rather than about the truth of an assertion.", "The conformance programme holds products to the Certificate Policy and the Security Requirements, and can act on a certificate, which is a remedy against a signer and not a remedy for a reader.", "China's Measures forbid forging a label and route consequences through existing administrative law, without creating a liability rule for a signed but false claim.", "California attaches a civil penalty to a covered provider that fails to include a compliant latent disclosure, which is a penalty for absence rather than for falsity.", "The European code of practice gives signatories an evidential benefit for following its measures; it does not allocate liability for a false marking." ], "what_it_changes": "Say the narrow thing in your interface. The sentence a reader can rely on is that this file carries a manifest signed by a named party, and that the named party asserted the history shown. Everything beyond that is a judgement about the signer, which is an editorial and contractual matter. If provenance forms part of a commercial promise you make, put the warranty in the contract, because the standard does not supply one.", "sources": [ { "name": "C2PA Technical Specification 2.4, Trust Model and Validation", "url": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html", "type": "primary", "date": "2026-09-15" }, { "name": "C2PA Conformance", "url": "https://c2pa.org/conformance/", "type": "primary", "date": "2026-09-15" } ], "related_ids": [ "CPS-2026-0003", "CPS-2026-0021", "CPS-2026-0020" ], "tags": [ "open question", "liability", "trust model", "signatures" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [], "facets": [] }, { "id": "CPS-2026-0028", "slug": "may-absence-of-credentials-be-treated-as-suspicion", "title": "May the absence of Content Credentials be treated as suspicion?", "kind": "question", "verdict": "open", "jurisdiction": "GLOBAL", "answer": "Nobody has settled it, and the two published answers point in opposite directions. OpenAI refuses to conclude anything from a negative result. China's Measures direct a platform that finds no implicit label but detects other traces to mark the content as suspected generated. One is a rule of restraint, the other a rule of flagging.", "key_facts": [ "OpenAI states that if no metadata or watermark is detected \"the tool will not make a definitive conclusion about whether the image was generated with OpenAI tools since provenance signals can in some cases be stripped\".", "China's Measures require a platform that finds no implicit label and no user declaration, but detects an explicit label or other traces of generation, to identify the content as suspected generated and add a prominent notice.", "The C2PA specification's disclosure levels govern how provenance is shown when it exists, and say nothing about how to present its absence.", "The overwhelming majority of images in circulation predate any of this, so absence is the normal state and will remain so for years." ], "what_it_changes": "Decide the default in advance and publish it. Two defensible positions exist, silence or a graded flag, and the damaging one is the third: an interface that says unverified in a tone a reader hears as fake. If you build a checker, the wording of the negative result is the most consequential design decision in it, and it should be written by an editor rather than by an engineer.", "sources": [ { "name": "Advancing content provenance, OpenAI", "url": "https://openai.com/index/advancing-content-provenance/", "type": "primary", "date": "2026-05-19" }, { "name": "Measures for Labelling AI Generated Synthetic Content, Cyberspace Administration of China", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "type": "primary", "date": "2025-03-14" } ], "related_ids": [ "CPS-2026-0025", "CPS-2026-0021", "CPS-2026-0009" ], "tags": [ "open question", "absence", "interface", "suspicion" ], "date_added": "2026-09-15", "last_verified": "2026-09-15", "last_modified": "2026-09-15", "figures": [], "facets": [] } ] }