Detectors guess. Provenance carries a signature.
Every organisation has now had the meeting. A document arrives, someone says it looks AI-generated, and the conversation turns to whether a detector could settle it. That conversation has no good ending, because the question is unanswerable in the general case. A classifier looking at finished text or a finished image is inferring a cause from an artefact, and the better the generation gets, the weaker the inference.
There is a different question that can be answered, and the infrastructure for answering it shipped while everyone was arguing about detectors. Not "was this made by AI", but "what does this file carry about where it came from, and who signed for that".
What a Content Credential actually is
The Coalition for Content Provenance and Authenticity publishes an open technical specification for exactly this. In its own description, it defines "a model for storing and accessing cryptographically verifiable information whose trustworthiness can be assessed based on a defined trust model".
The mechanics are worth holding in your head, because they explain both the strength and the limits.
Statements about an asset are called assertions: what device or model created it, what edits were applied, what it was derived from. The specification is careful about their status, describing assertions as "a series of trust signals that can be used by a human to improve their view of trustworthiness concerning the asset". Assertions are gathered into a claim, the claim is digitally signed, and the whole package is bound into a manifest that travels with the file.
Binding comes in two forms. A hard binding is one or more cryptographic hashes that uniquely identify the asset or part of it, so any alteration breaks the match. A soft binding is a content identifier that is not statistically unique, such as a fingerprint, or an invisible watermark embedded in the content itself. Soft bindings exist because of a failure the specification names directly: "An asset can become separated from its C2PA Manifest due to removal or corruption of asset metadata." A fingerprint lets you go and find the manifest again in a repository.
That is the whole idea. Signed statements, bound to content, checkable by anyone, with a fallback for when the metadata does not survive the journey.
What changed in 2026
Two things, and the second is the one most people have missed.
The specification reached version 2.4 in April 2026. Its own version history describes it as introducing "new asset format support, new assertions, and a new JSON-based serialization for Content Credentials, alongside clarifications and improvements to actions, ingredients, live video, and cryptography".
Inside that release is a new AI Disclosure assertion, labelled c2pa.ai-disclosure, added "for machine-readable AI transparency info". This is the difference between a disclaimer a human wrote and a field a system can read. The specification also defines a digital source type value for trainedAlgorithmicData, covering output that is data rather than media.
The second change is scope. Version 2.4 "added support for embedding C2PA Manifests into HTML documents" and "into structured text formats (source code, YAML, Markdown, AsciiDoc, etc.)". Provenance was a photography and video story for its first four years. It is now a document story, and documents are what regulated work actually runs on.
Separately, the standard is moving through the ISO process as ISO 22144 on authenticity of information and content credentials, listed in the ISO catalogue as a committee draft approved for registration as a draft international standard. Treat that as in progress rather than settled, and do not describe it in a paper as a published ISO standard yet.
Why text is the hard case
Extending the standard to documents is the right move, and it will be the least effective part of it for a while. Be clear-eyed about why.
An image travels as a file. A paragraph travels as a selection. The moment someone copies three sentences out of a signed Markdown file and pastes them into an email, every binding is gone: the hash no longer matches anything, there is no watermark in plain text to fall back on, and the manifest is sitting in a file the recipient never saw. The specification's own answer for unstructured text involves hashing the asset and embedding through Unicode variation selectors, which survives less handling than a photograph does.
So the realistic near-term value of text provenance is inside systems you control, where files move as files: a document management system, a case file, an evidence repository, a code repository. That is not a small scope. It is most of the material that matters in regulated work, and it is exactly where a signed record of who generated what, and when, is worth having.
Who is actually emitting this
Enough of the industry that you will start seeing credentials whether or not you asked for them.
OpenAI states that images generated with ChatGPT, Codex and its API "include both C2PA metadata and SynthID watermarks", and that it has become a C2PA Conforming Generator Product, joining the coalition's steering committee. Its reasoning is the interesting part: "provenance only works if it survives beyond the first platform where content is created, and conformance makes that possible."
Google, in a post on 19 May 2026 from its VP of Trust and Safety and the Chief Scientist of Google Cloud, said it had watermarked "over 100 billion images and videos" with SynthID, that "Pixel 10 was the first smartphone to provide Content Credentials for images in its native camera app" with video support extending to Pixel 8, 9 and 10, that SynthID verification in the Gemini app had already "been used 50 million times globally", and that it was expanding verification "to Search today and Chrome over the coming weeks".
The pattern in both is a two-layer approach: metadata that carries detail, plus a watermark that survives when metadata does not. OpenAI describes the division of labour precisely. C2PA "helps content carry detailed context", while SynthID "helps preserve a signal when metadata does not survive", because watermarking "can be more durable through transformations like screenshots, while metadata can provide more information than a watermark alone".
Three limits, and they matter more than the capability
It proves origin claims, not truth. OpenAI's own guidance on its verification tool says it "only confirms whether the image was generated by OpenAI. It does not confirm that the image is accurate, unedited, legally owned, or presented in the correct context." A perfectly valid credential can sit on a perfectly misleading document. Provenance tells you the chain of custody. Whether the content is right is still a judgement someone has to make and own.
Absence proves nothing. This is where organisations will do real damage to themselves. OpenAI lists the reasons a genuine AI-generated image may show no signal: metadata was stripped, the watermark was degraded, the source is unsupported, or the file predates the signals. Ordinary business processing strips metadata constantly. A file with no credential has told you nothing at all, and a policy that treats missing credentials as suspicious will flag your own scanned documents first.
Trust depends on the signer. A manifest is only as meaningful as the certificate that signed it and the trust list that certificate sits on. A cryptographically valid credential signed by an entity you have never heard of establishes that someone made a consistent set of statements. It does not establish that they are reliable. This is the same discipline we applied to model telemetry in trace the decision, not just the tokens: the record is only evidence if you can say who produced it and under what controls.
How to use it without overreaching
Five moves, in the order they pay off.
- Stop stripping. Audit your own pipeline first. Document management systems, image resizers, email gateways and content platforms routinely discard metadata. If your organisation destroys credentials on ingest, no amount of verification downstream will help. This is a configuration change, not a project.
- Emit on what you publish. If you produce customer-facing images, reports or evidence, sign them. It costs little, it is increasingly the default in the tools you already licence, and it puts you on the right side of every disclosure regime being drafted. It also sits neatly with the substantiation duty we covered in AI wrote the ad, ASIC still holds you to it.
- Verify at intake, but only where it changes something. Pick the document classes where origin genuinely alters the decision: evidence attached to a claim, an identity or qualification document, a media asset in a public statement, a report from an external expert. Verification everywhere is theatre.
- Write the two-line rule now. One line saying a valid credential is a supporting signal and never a sufficient one. One line saying a missing credential is not adverse. Put both in the procedure before the first argument, because the first argument will happen under time pressure.
- Add it to procurement. Ask any vendor supplying generation, editing or storage whether they emit credentials, whether they preserve them, and whether they claim conformance. Preservation is the question most suppliers have not been asked and most cannot answer.
Where a tribunal or regulator already requires disclosure of generative AI in a document, provenance metadata supports that statement rather than replacing it. The disclosure obligation runs to the person, exactly as the Fair Work Commission's approach to AI in proceedings does, which we covered in the Commission's three rules for AI in a case.
Bottom line
Detection asks a question that cannot be answered reliably and gets less reliable every quarter. Provenance asks a narrower question that can be answered cryptographically, and as of version 2.4 in April 2026 it reaches HTML and structured text, not just photographs, with a machine-readable AI disclosure assertion attached. Use it for what it is: a signed record of origin and handling, a strong supporting signal, and no substitute for judgement. Then make sure your own systems are not quietly deleting the evidence on the way in.
Do this Monday:
- Test whether your document and image pipelines preserve or strip metadata on ingest
- Name the three document classes where origin actually changes a decision
- Write the two-line rule: a credential supports, its absence proves nothing
- Check whether the tools you already licence emit Content Credentials by default
- Add preservation of provenance metadata to your next vendor questionnaire
TheAICommand. Intelligence, At Your Command.
