AI Content Provenance: What It Proves, and What It Doesn't

The Coalition for Content Provenance and Authenticity (C2PA) defines provenance as verifiable facts about the history of a piece of digital content: where it came from, what tools touched it, and what those tools did.

In the C2PA model that history lives in a "Content Credential": a manifest of assertions, cryptographically bound to the asset, and signed by whatever software or hardware produced or edited it.

Watermarking is a mechanism. Provenance is the goal, and a watermark is one way to carry or protect part of it.

A statistical text watermark like SynthID Text, or an embedded image signal, answers a narrow question: is a specific detectable pattern present? A full provenance record can answer richer ones.

• Which tool generated this asset.
• What edits followed, and in what order.
• Which earlier assets ("ingredients") were used along the way.

OpenAI describes its own combination of C2PA metadata and an embedded SynthID watermark as deliberately layered. Metadata carries more context but can be stripped; an embedded signal survives more transformations but says less about what actually happened.

Provenance is a record attached at creation or edit time, describing what a signer claims happened. Detection is something done afterward, checking whether an expected signal is still present.

A watermark checker or an AI detector performs detection. A signed C2PA manifest is provenance.

The useful part is that they fail independently. Losing a provenance record doesn't make detection impossible, and a positive detection result doesn't reconstruct a provenance history.

A C2PA manifest is built from typed assertions, not a single flag. Three do most of the work:

• c2pa.actions: a structured log of what was done to the asset (created, edited, converted) and by what tool.
• c2pa.ingredient: references to other assets used as inputs, letting a manifest track lineage across multiple editing steps.
• c2pa.hash.data: a cryptographic hash of the asset's content, used to detect tampering.

The whole manifest is then signed using an X.509 certificate, the same public-key infrastructure underlying HTTPS. A verifier checks both that the signature is valid and that the signer's certificate is accredited on the C2PA Trust List.

The signer doesn't have to be an AI model. Leica's M11-P shipped on October 26, 2023 as the first camera to sign its own photos at the moment of capture, a chain-of-custody answer for photojournalism that writes camera model and timestamp into a Content Credential anyone can check at contentcredentials.org/verify.

That's a hard binding: the signature is tied to the exact bytes of the file, so any change after signing invalidates the hash. Because ordinary transformations like re-encoding, cropping, and screenshotting break it legitimately, some implementations pair it with a soft binding, a watermark or fingerprint still recoverable from the transformed asset.

AWS's Titan image model and OpenAI's image provenance both pair signed C2PA metadata with an invisible watermark for exactly that reason. OpenAI's audio provenance, added later, currently ships as a SynthID watermark only, with no C2PA layer yet.

Provenance features tend to ship on legal calendars, and mid-2026 made that unusually visible.

1. July 24, 2026: Google signs the EU Code of Practice on Transparency of AI-Generated Content, committing to adopt and accelerate C2PA and to work on interoperable SynthID adoption with Apple, ElevenLabs, Kakao, NVIDIA, and OpenAI.
2. July 31, 2026: OpenAI extends SynthID watermarking to supported audio and adds a Content Provenance API so third parties can check for its provenance signals programmatically.
3. August 2, 2026: EU AI Act Article 50 transparency rules take effect.
4. August 2, 2026: the same date Anthropic uses as its line, with models launched on or after it supporting machine-readable marking at launch and earlier models left in a transition period.

OpenAI, Google, and the C2PA specification are all explicit about the limits, and it's worth quoting rather than paraphrasing away. OpenAI says its provenance signals are "not a guarantee that content is accurate, unedited, legally owned, or presented in the correct context," and that "no detection method is foolproof."

A verified signature confirms who signed a manifest and that it hasn't been altered since. It doesn't confirm the claims inside are true, that nothing happened before the first signing step, or that the content is being shown in the context its creator intended.

The absence of a provenance record is just as easy to misread. Metadata is routinely stripped by re-uploads, screenshots, and ordinary platform processing, so a missing Content Credential is not evidence that something is unedited or human-made.

Treat a provenance record the way you'd treat a signed statement. It tells you what the signer claims and that the claim hasn't been tampered with since, not that the claim is complete or that no earlier, unsigned step existed.