A photograph arrives in a newsroom or communications department. It shows a crowd outside a factory, with a caption describing a protest against its closure. An indicator provides access to its Content Credentials: an identified device, a declared date, a pass through image-editing software. That is a useful lead. But is it the right factory? Is the crowd actually protesting? Provenance documents a file’s history; it does not guarantee the story told with it. Looking ahead to September 2026, this distinction must guide the adoption of these tools, lest a technical advance become an illusion of certainty.
A signature to trace the production process
The Coalition for Content Provenance and Authenticity, or C2PA, develops an open standard for attaching information about origin and transformations to content. Launched in 2021, it brings together players from the software, device and media industries, among others. Adobe, Microsoft and the BBC were among the organizations involved from the outset. The aim is to make part of a file’s journey verifiable in an environment where producing a convincing image is becoming ever easier.
In practice, a manifest brings together assertions: the tool used, the operations performed, any source content used and the signatory’s identity. A cryptographic signature binds this information to the content through the mechanisms defined by the standard. If protected elements are changed outside the expected process, validation may fail. Content Credentials provide a way to present this information to the public, often through an icon or a panel users can open.
The distinction is crucial: cryptography can verify the integrity of signed information and its association with a signatory. It does not investigate the scene depicted. Even trust in the signatory depends on a framework: recognized certificates, key protection and a validation policy. A valid signature is therefore neither a journalistic finding nor a universal guarantee of authenticity.
Real-world uses, but coverage remains incomplete
These systems are more than demonstrations. In October 2023, Leica introduced the M11-P, which incorporates Content Credentials at the point of capture. Adobe has deployed them in some of its tools, notably those involving Firefly. In February 2024, OpenAI announced the addition of C2PA metadata to images produced by DALL·E 3 in ChatGPT and its API. These milestones show that provenance can begin in a camera just as readily as in an image generator.
Above all, they reveal why the information needs to be read rather than its mere presence celebrated. Entirely synthetic content can have valid provenance credentials. That is desirable, in fact, if they explain how it was made. Conversely, an old documentary photograph or one taken with a phone that lacks this feature may have no verifiable history. Presence does not mean truth; absence does not mean falsification.
Wider adoption by September 2026 is a plausible prospect, given the investments already made. It remains a projection, not evidence of universal adoption. The decisive question will be less about the number of announcements than about genuine continuity throughout the chain: capture, editing, transmission, publication and public access.
Three blind spots a signature cannot eliminate
A real scene can be staged
A company photographs smiling employees in a spotless workshop. The file is signed at capture, then cropped in compatible software. Everything may be perfectly documented. Yet the visit may have been prepared, the people selected and the problems left out of frame. The system attests to certain aspects of the image’s production, not how representative the moment is. This problem predates artificial intelligence; AI simply makes it more pressing.
A caption can change the entire meaning
An authentic image of flooding, correctly attributed to its photographer, can be misused to illustrate a disaster elsewhere. Nor should a declared date or location automatically be treated as an independent, indisputable measurement. How it was generated needs to be examined. Verification remains contextual: finding the original publication, comparing visible locations, contacting the creator and seeking other accounts.
A signed history can still be incomplete
The chain may begin after manipulation has occurred. If misleading content is imported into a tool that then signs its export, that signature does not magically certify the earlier steps. Similarly, a camera can photograph a screen displaying a fabricated scene. The capture is real; the subject photographed remains misleading. A rigorous analysis therefore distinguishes between what is documented, what is declared and what remains unknown.
The weak link: how files circulate
On the web, images are compressed, converted, copied and captured in screenshots. Some operations or platforms may strip embedded provenance information. A screenshot generally does not, on its own, preserve the original file’s entire chain. The absence of an information panel at the receiving end therefore does not prove an intent to conceal.
Complementary approaches seek to recover provenance references through watermarks or perceptual fingerprints. They can help reconnect content with a history stored elsewhere. But their robustness depends on the transformations applied, the implementations and the availability of services. These recovery mechanisms must be distinguished from the cryptographic signature itself, without promising indestructible traceability.
For communications professionals, explanation matters as much as implementation
The first task is editorial. A green badge accompanied by the word “authentic” risks suggesting that the facts have been verified. A more honest interface states what it knows: provenance available, signature validated under a given policy, AI generation declared, partial history. It also makes the limitations visible, without requiring every reader to understand cryptography.
The second task concerns internal practices. A brand or agency can adopt a few immediately useful rules:
- Keep the originals and documents establishing the circumstances of production.
- Check the publication chain to identify which transformations preserve the information.
- Verify the context separately, along with captions and claims associated with the visuals.
- Limit the data disclosed to protect photographers, witnesses and sensitive locations.
This last requirement is particularly important in crisis communications or high-risk environments. Publishing more provenance information does not justify disclosing an identity or location that could put someone at risk. Transparency must be proportionate. Incidents must also be anticipated: a compromised key, an unexpected signature, an attribution error or an inaccessible history.
What next? The desirable scenario for the coming years is not a digital stamp that automatically separates truth from falsehood. It is one in which provenance becomes a solid clue among others, easy to consult and difficult to overinterpret. C2PA can strengthen content producers’ accountability and facilitate certain checks. Provided that communications professionals accept a less spectacular but more honest promise: to explain where an image comes from, without claiming to make it tell the whole truth.