C2PA 2.4 — Content Provenance and AI Disclosure

Direct answer

C2PA is an open technical standard for recording the origin and edit history of digital assets in cryptographically signed manifests. Version 2.4 adds c2pa.ai-disclosure for structured model provenance and human-oversight information. C2PA can show what a signer says happened to a file and whether that record remains intact; it does not establish that the content is true or that the signer owns it.

Applies when

Use this evidence when you need to verify whether the signed provenance data validates against the asset.
Use this evidence when you need to verify which assertions, actions, ingredients and signer information are present in the manifest.

Doesn't apply when

Do not treat this evidence as proof that the depicted event or marketing claim is true.
Do not treat this evidence as proof that the named creator owns every right or that disclosure duties have been satisfied.

Worked decision

Example

A campaign image contains a valid manifest recording a photographed source, a generative-fill action and human validation.

Interpretation

The manifest supports the stated production history and reviewer state. It does not prove that the resulting product claim is accurate. Retain the credential, verify the exported file, run the disclosure decision and store both results in the evidence record.

Next steps

Required action

Choose a generator that attaches a conformant manifest and identify whether it is a C2PA generator, validator or both.
Record AI involvement with the applicable digitalSourceType, action, ingredients and, where supported, c2pa.ai-disclosure fields.
Verify the final exported asset, not only the state shown inside the creation tool, and preserve the result through delivery.

Publishing layer

Platform differences

Original asset

A C2PA-aware verifier can inspect the signed assertions associated with the exact file it receives.

Transformed derivative

Screenshots, resizing, transcoding, metadata stripping or unsupported export can remove readable provenance or invalidate its binding.

Publishing platform

Native labels and legal disclosure remain separate layers; their thresholds can be broader than the technical provenance signal.

Evidence

Source

C2PA Technical Specification (2.4 series)Coalition for Content Provenance and Authenticity · last checked 2026-09-12
A New Implementation Guide for Content CredentialsC2PA · last checked 2026-09-12
Use of Content Credentials to Identify Synthetic and Non-Synthetic ContentC2PA Technical Working Group · last checked 2026-09-12

Freshness and accountability

Last verified

Last reviewed 2026-09-12 · Current

Run this exact scenario

A representative asset scenario is prefilled. Confirm how provenance was created, whether it survived the final export and where the asset will be published.

Open prefilled checker

How to read the signal

Key facts

Manifest	A signed set of claims and assertions bound to an asset or referenced through a supported external mechanism.
Actions	Lifecycle operations such as creation, opening and editing can be recorded, with AI usage identified at the individual-action level.
Ingredients	Source assets, prompts, reference images and other inputs can be related to a result, including with the `inputTo` relationship.
AI disclosure assertion	`c2pa.ai-disclosure` complements actions and `digitalSourceType` with model type, optional model identity, scientific domain and human-oversight level.

Quality gate

Common failure modes

Treating any C2PA icon as proof that every step in the asset history was recorded.
Reading human_validated as a legal approval rather than an attested workflow state.
Assuming a valid signature establishes truth, authorship, copyright ownership or regulatory compliance.

Disclara treats technical provenance as evidence about process, not as proof of truth, authorship or legal compliance. This page is source-backed information, not legal advice. Review the sources and methodology.