C2PA, Decoded.
And Where It Cracks.
On August 2, 2026, the EU starts enforcing AI-content transparency. Every major AI image tool already ships C2PA Content Credentials. We pulled the actual manifests out of files from each one, looked at what they say, and at where the chain has already broken in the real world.
C2PA stands for the Coalition for Content Provenance and Authenticity. The standard it publishes, branded for end users as Content Credentials, is a cryptographically signed manifest that travels inside an image, video, or audio file. The manifest names the tool that produced the file, the actions performed on it, and the certificate chain that signed the whole package. Adobe, Microsoft, OpenAI, Google, Sony, Nikon, Leica, and the BBC have all shipped some implementation of it.
The reason the standard suddenly matters in mid-2026 is regulatory. Article 50 of the EU AI Act (Regulation 2024/1689, in force since 1 August 2024) becomes fully enforceable on 2 August 2026. Article 50(2) requires that "providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." The penalty for getting it wrong, set in Article 99(4)(g), is the higher of 15 million euros or 3 percent of worldwide annual turnover. The text never names C2PA; it is technology-neutral. But C2PA is the only mature, interoperable, signed-metadata option, which is why every major AI tool has spent the run-up to August putting Content Credentials on its outputs.
The interesting question, then, is not whether AI tools embed C2PA. They do. It is what each one actually writes, what survives when their output reaches a viewer, and what happens when the chain fails. We pulled real manifests out of real files, ran the bytes through File X-Ray, and put the findings here. A few low-level details below - the COSE signature algorithm in particular - come from the reference c2patool rather than from File X-Ray, which reads the signer, the issuer and the assertions but does not report the algorithm; those are labelled where they appear.
The longest-running production C2PA pipeline
Firefly was the first public generative-AI image service to ship C2PA on every output, and the manifest it writes today still looks like the cleanest of the lot. The sample image hosted in the Content Authenticity Initiative's public asset repository (a Firefly-generated tabby cat) carries this:
The c2pa.actions.v2 assertion records exactly one action, c2pa.created, with the IPTC digital source type set to a generative-AI value. The hard binding is a SHA-256 of the entire image data block. There is no soft-binding (perceptual fingerprint) assertion, which means screen-recording or recompressing the image strips the provenance signal entirely. There is also no training-mining assertion; Firefly does not declare its training-data position inside the manifest.
Validation against the public Content Credentials verifier returns "Valid" with one informational note about timestamp-cert trust. The Adobe Inc. cert that signs the claim is conformant to the C2PA Trust List. As of early 2026, only DigiCert and SSL.com (which joined in September 2025) are publicly confirmed conformant Certificate Authorities, so the trust chain is still small.
Two manifests, an unlisted CA, and an AP photo of a turtle that fails validation
OpenAI announced C2PA Content Credentials for DALL-E 3 in February 2024 and joined the C2PA Steering Committee on 7 May 2024. ChatGPT-generated images today carry two stacked manifests inside the same file: an inner one for the model API path, and an outer one declaring the ChatGPT product wrapper.
The OpenAI cert is the operative detail. It is self-issued and is not on the C2PA Trust List as of early 2026, which means a strict verifier reports the manifest as "valid signature, untrusted issuer." The image is technically signed; whether you trust the signature depends on whether you trust OpenAI's word that the cert is theirs. There is no third-party CA in the chain doing the work that, say, Let's Encrypt does for HTTPS.
The chained-manifest pattern is also worth noting. The inner manifest's c2pa.actions assertion records c2pa.created with the GPT-4o softwareAgent and digitalSourceType set to trainedAlgorithmicMedia. The outer manifest records c2pa.opened with an ingredient pointing back to the inner manifest. The chain says: a model generated this asset, a product wrapped it. Both layers are signed.
In September 2025, the engineer Tim Bray (XML 1.0 co-author, ex-AWS) ran the entire C2PA stack end-to-end and reported two specific failures with ChatGPT. First, Adobe's own Content Credentials Inspector was non-functional during his testing. He had to switch to drag-and-drop verification because the inspector page would not load data. Second, a turtle image he generated in ChatGPT failed c2patool validation entirely. The signature was present; the trust check failed. Bray's conclusion was that "there are very few Content Credentials out there on the internet" because publishing platforms strip metadata on upload, and even when the manifest survives, validation tools were buggy enough in late 2025 to give people wrong answers.
A watermark that lasts four minutes
Sora 2 launched on 30 September 2025 with two provenance signals on every output: an embedded C2PA manifest in the file metadata, and a visible, animated "cloud + Sora" watermark composited into the moving video. The C2PA manifest sits inside a uuid box in the MP4 container, alongside the actual video data.
Within a week of launch, third-party tools that strip the visible watermark were public. NewsGuard reproduced the removal in roughly four minutes during their stress test. The C2PA manifest fares no better in practice: any social platform that re-encodes uploaded video on ingest (most of them do, including TikTok, Telegram, X, and Facebook) drops the uuid box, and any user who screen-records the playing clip on their phone produces a fresh H.264 file with no manifest at all. Both provenance signals are correct at the moment of generation. Both fail at the moment of redistribution.
The most concrete demonstration ran on TikTok and YouTube Shorts in early November 2025. Pro-Kremlin accounts amplified Sora-generated videos that purported to show Ukrainian soldiers apologizing, weeping, and refusing to fight. France 24 traced several of the clips' faces back to specific Russian livestreamers. NBC News, the Kyiv Independent, NewsGuard, and the Ukrainian Center for Countering Disinformation independently identified the campaign. None of the clips reaching viewers carried a working C2PA manifest.
NewsGuard's broader test the previous month asked Sora 2 to generate videos for 20 known false claims, several of which were tied to Russian disinformation operations. The tool produced believable false-claim videos in 16 of 20 cases. On the first attempt, without re-prompting, it succeeded 11 times. Sora declined 4 of the 20 requests outright. The provenance signals exist on every video it did generate. None of them survive a screen capture.
The institutional implementations
Microsoft's Bing Image Creator and the Azure OpenAI image-generation models (DALL-E series and GPT-image-1 series) embed C2PA automatically. The manifest sets description to "AI Generated Image" and softwareAgent to either "Azure OpenAI DALL-E" or "Azure OpenAI ImageGen" depending on which underlying model produced the file. The signing certificate's subject organization is Microsoft Corporation. Microsoft was a C2PA founding member and has shipped this since the standard's early days.
Google's Imagen and Gemini app outputs add a different twist. They ship both a conventional C2PA manifest and a SynthID invisible watermark. SynthID is Google's proprietary perceptual marker; it survives screenshots and recompression in a way C2PA does not. Google publicly rolled C2PA across Nano Banana Pro (the Gemini 3 Pro Image generator) in November 2025 across the Gemini app, Vertex AI, and Google Ads. The softwareAgent field reads "Google Media Processing Services."
Both implementations are functionally clean. They sign correctly, they declare AI origin, they list a real organization in the cert. The same caveat applies to all of them: the manifest is only as durable as the platform it is uploaded to. The Truescreen technical write-up on C2PA published in April 2026 reports that LinkedIn and TikTok preserve Content Credentials on upload while Instagram, X, and WhatsApp strip them. The practical implication is that C2PA round-trip survival is a per-platform question with a per-platform answer, not a property of the file itself.
The major AI tool that writes nothing
Midjourney does not embed C2PA Content Credentials. Images downloaded from Discord or the Midjourney web interface carry no JUMBF box, no IPTC AI-source tag, no signed manifest. Researchers at C2PA Viewer confirmed this directly in February 2026, and aiphotocheck published a similar finding the same quarter. Midjourney is also not a C2PA Steering Committee member; the publicly listed members include Adobe, Microsoft, OpenAI, Google, Sony, BBC, Intel, and Truepic.
Midjourney's position is the most interesting C2PA test case for August 2. Article 50 obligates "providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content" to mark their outputs in a machine-readable, detectable format. The standard the EU points at, in the voluntary Code of Practice the AI Office released on 17 December 2025, is C2PA in practice if not in law. Whether Midjourney complies by adding C2PA, by adding some other marking, or by accepting fines and shipping nothing is going to play out over the second half of 2026.
The first real-world camera C2PA bypass
Nikon began shipping C2PA Content Credentials to the Z6 III on 27 August 2025 with firmware version 2.00. Two weeks later, the program was suspended. Two months after that, every certificate Nikon had issued during the program was revoked. The break ran on a feature most Nikon owners never use: Multiple Exposure mode.
A user posting on the DPReview Nikon Z forum under the handle Horshack noticed that the camera's Multiple Exposure mode lets the photographer pick an existing NEF (Nikon raw) file already on the SD card as the first exposure, then capture a second exposure on the camera and have the body blend the two in-camera. The body signs the resulting JPEG. The cryptographic signing happens at the moment of JPEG-write, after the blend, with no check that the pixel data on the chosen NEF came from this body's sensor.
Horshack's proof of concept was direct. He shot a graphic that read "Hacked by Horshack" on a non-C2PA Z6 III body, moved the SD card to the C2PA-enabled body, set Multiple Exposure to overlay with the lens cap on, captured a black frame, and got back a signed C2PA-credentialed JPEG showing the original graphic. He then wrote his own NEF encoder that wraps any TIFF (including AI-generated images) in a Z6 III NEF skeleton, and ran the same trick to sign a fake AI-generated photo of a pug flying a jet as a verified Nikon capture.
The follow-on issue, which PetaPixel covered in its 22 September 2025 piece on Nikon, is that revocation does not actually fix images already in the wild. Most C2PA validators, including the open-source c2patool in its default configuration, do not check OCSP or CRL revocation status when verifying a manifest. A revoked Nikon certificate still appears valid to those tools unless an operator explicitly enables revocation checking. Horshack filed an issue against c2patool to change the default after the bypass; as of early 2026 the default has not changed. Any validator inheriting that default treats Nikon-signed forgeries as authentic.
The Nikon Authenticity Service has not been restored. The Z6 III is still the only Nikon body that supported C2PA at any point.
What survived when an XML 1.0 co-author tried to verify everything
Tim Bray, who co-authored the XML 1.0 specification and spent years on AWS's tag team for SDKs, ran a personal investigation of the C2PA stack end-to-end and published the results on his blog on 18 September 2025. He tested a Leica M11-P, a Google Pixel 10, a ChatGPT-generated image, Adobe's Content Credentials Inspector in Chrome, c2patool from the command line, and Lightroom and Photoshop.
His specific findings:
The Adobe Content Credentials Inspector, the Chrome extension Adobe ships as the default consumer verifier, was non-functional during his testing. The page would not load data, forcing him to drag-and-drop files instead of using the URL flow.
Neither Lightroom nor Photoshop could correctly handle Content Credentials generated by the Pixel 10 phone. Adobe acknowledged the issue privately as a spec-version mismatch.
A turtle image generated in ChatGPT failed c2patool validation entirely. The signature was present and structurally correct; the trust chain validation rejected it. This is the OpenAI-self-issued-cert problem from the ChatGPT section above, made concrete.
And the operational summary: "There are very few Content Credentials out there on the internet." Bray's diagnosis is that publishing platforms strip metadata on upload by default, and the small number of Content Credentials that survive round-tripping cannot be reliably read by the tools meant to verify them. He stayed optimistic about C2PA in principle. He wrote that the field deployment in late 2025 was "fixable beta-stage problems." Three months out from EU enforcement, those problems are still in the field.
Where the chain actually breaks
Looking across every implementation we examined, the failure modes cluster into four categories that the standard does not, by itself, fix.
The platform-strip gap. A signed manifest is only as durable as the upload pipeline it travels through. The Truescreen technical write-up published in April 2026 catalogs the per-platform pattern: LinkedIn and TikTok preserve Content Credentials on upload, Instagram, X, and WhatsApp strip them. Re-encoded video on TikTok is the path the Sora 2 deepfakes of Ukrainian soldiers took to viewers. The fix requires every consumer platform to opt in to preserving JUMBF boxes, and that is a business decision per-platform, not a property of the file format.
The trust-list gap. The C2PA Trust List, which the Conformance Program populates, is small. As of early 2026, only DigiCert and SSL.com (which joined in September 2025) are publicly confirmed conformant Certificate Authorities. Big AI platforms have responded to the gap by issuing their own certs and embedding them, which means a strict verifier reports the manifest as "valid signature, untrusted issuer." OpenAI's certificate falls in this category. The image is signed; whether you trust the issuer is a separate question.
The revocation gap. When Nikon revoked every certificate issued during the Z6 III program, the open-source verifier most tools depend on did not start failing the revoked signatures, because revocation checking is not enabled by default. A revoked Nikon-signed forgery still verifies until an operator turns OCSP or CRL checking on. The Nikon bypass produced revocations; revocations did not produce verification failures.
The verifier gap. Adobe's own consumer inspector failed in field testing in late 2025. Lightroom and Photoshop could not read Pixel 10 credentials. ChatGPT-signed images failed c2patool. The verification surface is software like every other piece of software, and like every other piece of software it has bugs.
None of these gaps mean C2PA is broken, exactly. They mean the standard works at the file-format level and is surrounded by a trust-and-distribution stack that has not finished assembling itself yet. The 2 August 2026 enforcement date is, in effect, the moment the EU asks every AI provider to ship into that unfinished stack regardless.
Reproduce the manifest reads above
Every per-tool finding above was extracted from a publicly hosted sample image or video. Drop any of them into filexray.orygn.tech/scan and the C2PA fields described in the post appear alongside the standard EXIF and XMP. For the canonical end-to-end verification, run c2patool image.jpg, the open-source Rust tool the C2PA standards body publishes.
Read C2PA out of any image, in your browser
File X-Ray reads C2PA Content Credentials directly out of JPEG, PNG, and MP4 files. It surfaces the claim generator (the tool that signed the image), the certificate issuer (the organization whose cert is on the signature), and a flag for whether the manifest claims AI generation. The whole pipeline runs in the browser and the image is never uploaded.
Useful for seeing which tool and which certificate an image claims to come from, and whether that claim survived the platform it travelled through. For a signature-and-trust-list verdict, run c2patool or Adobe’s Content Credentials Verify against the same file. Useful, too, for checking whether your own uploads survive a round-trip through a given platform. Useful, if you are an EU AI Act compliance reader, for spot-checking whether a vendor's claims about their provenance pipeline match the bytes their tool actually emits.