Standard
C2PA Content Credentials
C2PA Content Credentials are cryptographically bound provenance data; they are a separate technical mechanism, not an EU certificate.
- Who may need this?
- Optional when a supported signing workflow and trustworthy signing identity are available.
- When it does not apply
- Not required merely because another disclosure rule applies.
- Technical requirement
- Create and sign a valid C2PA manifest using protected signing credentials.
- What this workspace does
- Detects common manifest container signals only; signing and cryptographic validation are not available in this release.
- Limitations
- Manifest presence alone does not establish truth, legal compliance, or signature validity.
- How to verify
- Use a maintained C2PA validator to validate the active manifest and trust chain.
Common questions
Does C2PA guarantee EU AI Act compliance?
No. C2PA can carry signed provenance, but Article 50 applicability and disclosure obligations depend on the actor, content, context, and applicable exceptions.
Does manifest detection mean the signature is valid?
No. This release reports common container signals only; cryptographic signature and trust-chain validation are unavailable.
Change history
Version 1ReferenceC2PA 2.4 reference and product capability boundary.