JUMBF, ISO/IEC 19566-5:2023, the box format under every manifest
Every C2PA manifest is a JUMBF structure, so the box format is the real floor of this layer. ISO/IEC 19566-5:2023, JPEG universal metadata box format, is published, and an Amendment 1 published in 2025 adds box compression and standalone JUMBF files. The text itself is sold by ISO and cannot be read without purchase.
The verdict
Verified
The document exists. The ledger fetched it at its publisher and quotes it.
Key facts
What the sources say
- Record ID
- CPS-2026-0007
- Kind
- Standard
- Jurisdiction
- Global
- Last verified
- Added
- The catalogue entry reads "ISO/IEC 19566-5:2023, Information technologies, JPEG systems, Part 5: JPEG universal metadata box format (JUMBF)", status Published.
- Amendment 1:2025 is also published and is titled "JUMBF box compression and standalone JUMBF files", which is what C2PA compressed manifests rest on.
- The C2PA specification cites this document normatively for labels, toggles, content types, URI references and the multi segment JPEG construction.
- A C2PA manifest store is a JUMBF superbox labelled c2pa with type UUID 63327061-0011-0010-8000-00AA00389B71.
- A further edition, ISO/IEC CD 19566-5, is under development, and a reference software part, ISO/IEC 19566-10:2026, is published.
Dimension by dimension
3 dimensions, each one stated, silent or open
Embeds a mark or manifest, Displays or verifies, What it requires. Stated means the document you can open below says it; silent means the ledger read the document and it does not.
- Embeds a mark or manifestStated
- It defines the boxes: description box, content boxes, labels, toggles and the URI scheme that C2PA addresses assertions with.ISO/IEC 19566-5:2023, JPEG universal metadata box format (JUMBF), primary source, 15 September 2026.
- Displays or verifiesSilent
- It is a container format and displays nothing.ISO/IEC 19566-5:2023, JPEG universal metadata box format (JUMBF), primary source, 15 September 2026.
- What it requiresSilent
- Nothing is required of a publisher. It is required of anyone writing a parser, as the document that defines the bytes.ISO/IEC 19566-5:2023, JPEG universal metadata box format (JUMBF), primary source, 15 September 2026.
What it changes
For a publisher, a platform or a newsroom
Budget for it. A team building its own reader will need the ISO text, because the C2PA specification delegates the segment level detail to Annex D of this document and prints none of it. That is also why an open source parser is usually the cheaper path: the library authors have already bought the standard. Whoever writes your inspector should be able to say which of the two documents each rule came from.
Sources
What this record was verified against
- ISO/IEC 19566-5:2023, JPEG universal metadata box format (JUMBF)Primary · 15 September 2026
- ISO/IEC 19566-5:2023/Amd 1:2025Primary · 15 September 2026
Related
Records that sit beside this one
The C2PA technical specification, version 2.4
Global · verified 15 September 2026
The specification index at spec.c2pa.org redirects to the 2.4 specification, and requests for versions 2.5, 2.6 and 3.0 return HTTP 404.
Where a C2PA manifest actually sits in each file format
Global · verified 15 September 2026
PNG: "a chunk type of 'caBX' (as per PNG, 4.7.2)", recommended before the IDAT chunks.
May the absence of Content Credentials be treated as suspicion?
Global · verified 15 September 2026
OpenAI states that if no metadata or watermark is detected "the tool will not make a definitive conclusion about whether the image was generated with OpenAI tools since provenance signals can in some cases be stripped".
Who answers for a manifest that is signed and false?
Global · verified 15 September 2026
The C2PA trust model is expressed as validation states: well formed, valid and trusted, each about signatures, certificates and lists rather than about the truth of an assertion.
Does a watermark survive re encoding?
Global · verified 15 September 2026
Google states that the image and video watermark is "designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression".
Is a stripped manifest evidence of tampering?
Global · verified 15 September 2026
OpenAI states that C2PA metadata "can be stripped, lost through uploads and downloads, or broken by transformations like file format changes, resizing, or screenshots".
Cite this record
Free to reuse under CC BY 4.0, with attribution. The record ID CPS-2026-0007 is permanent and is never reused.
- In a sentence
- According to the GAGE Content Provenance Checker (as of 15 September 2026), jumbf, iso/iec 19566-5:2023, the box format under every manifest.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). JUMBF, ISO/IEC 19566-5:2023, the box format under every manifest. Content Provenance Checker. Retrieved 15 September 2026, from https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0007-jumbf-iso-iec-19566-5
- MLA
- "JUMBF, ISO/IEC 19566-5:2023, the box format under every manifest." Content Provenance Checker, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0007-jumbf-iso-iec-19566-5.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "JUMBF, ISO/IEC 19566-5:2023, the box format under every manifest." Content Provenance Checker. Last modified 15 September 2026. https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0007-jumbf-iso-iec-19566-5.
- Permalink
- https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0007-jumbf-iso-iec-19566-5
Last updated . Every record re verified . The ledger is checked monthly, first Monday, and the same day for any C2PA specification release.
Back to the full ledger, or every record for Global and every standard record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.