C2PA is an open technical standard for attaching tamper-evident provenance data, called Content Credentials, to images, video, audio and documents, while AI watermarking hides a machine-detectable signal inside generated media. Together they help brands show what is authentic and what was generated. Neither is proof on its own, so governance rules must define how you create, keep and explain these signals.
What are C2PA and AI watermarks, exactly?
The Coalition for Content Provenance and Authenticity (C2PA) was formed by companies including Adobe, Microsoft, Intel, the BBC and others, and its specification defines a signed manifest attached to a file. The manifest records who created or edited the asset, with which tool, and whether AI was involved. Adobe’s Content Authenticity Initiative promotes the consumer-facing name, Content Credentials.
Watermarking is different. Tools such as Google DeepMind’s SynthID embed a signal into the pixels, audio or text itself. The signal survives some edits, but it is not readable by people and usually only by the company’s own detector.
Why should a PR or marketing team care?
Provenance has become a reputation issue. When a fake image of an executive or a product failure spreads, the first question journalists ask is whether the company can prove what is real. A newsroom that sees valid Content Credentials on your official photos has one more reason to trust them.
The other side matters too. Brands now publish generated imagery, and audiences, platforms and some regulators expect disclosure. The EU AI Act includes transparency obligations for certain AI-generated content, and platforms such as Meta, TikTok and YouTube label media they detect as AI-made, partly by reading C2PA data.
What are the main limits?
Overselling these tools is a real risk. Before relying on them, accept these limits:
- Metadata can be stripped. Many social platforms and messaging apps remove or rewrite file metadata on upload, so credentials may not survive.
- A missing manifest proves nothing. Most authentic photos online have no credentials at all.
- A valid manifest proves the chain of signing, not that the scene depicted is true.
- Watermark detectors are vendor-specific; one company’s tool will not find another’s watermark.
- Watermarks can be weakened by heavy cropping, re-encoding or deliberate attack.
- Support across cameras, editing tools and platforms is still uneven at the time of writing.
Which risks should governance address first?
Focus on the situations where a gap would embarrass you publicly.
Inconsistent disclosure
If one campaign carries credentials and the next does not, critics will ask what the second one hides. Decide which asset types always carry credentials and stick to it.
Overclaiming
A press release that says an image is “verified authentic” because of C2PA invites a correction. Use precise language: the file carries Content Credentials showing it was captured on a given device and edited in a given tool.
Breaking the chain by accident
Exporting through a tool that does not support C2PA can drop the manifest. Teams often lose credentials in the last step before publishing without noticing.
What rules belong in the policy?
A one-page provenance policy usually covers the following:
- Which assets get Content Credentials: official executive photos, product launch imagery, press kit media and all generated visuals.
- Which tools are approved because they preserve or write manifests, for example Adobe Photoshop, Lightroom and Firefly with Content Credentials enabled.
- Disclosure wording for generated or AI-edited assets, matched to each platform’s labelling rules.
- Storage of original signed files in an archive you control, so you can produce them on request.
- A response procedure for suspected fakes: who checks, which verification tools, who speaks.
- Review dates, because the standard and platform behaviour change.
How do you verify a file during a crisis?
Speed matters in a fake media incident. A practical sequence:
- Check the file with the public Content Credentials verify tool to read any manifest.
- Compare it against your archive of signed originals.
- Run available watermark detectors if a generator is suspected and the vendor offers access.
- Document findings with screenshots before the post is deleted.
- Publish your original, with credentials intact, through your own newsroom page where metadata is not stripped.
Hosting originals on your own site is the overlooked step. Social platforms may strip metadata, but your newsroom will not.
How Alien Road applies C2PA in PR work
In a typical engagement, discovery maps where a client’s official media is created and how it travels: photographers, agencies, design tools, the press kit and social channels. The aim is to find the point where credentials are lost, which is usually an export step or an upload.
Setup means enabling Content Credentials in the approved tools, creating a signed archive for executive and product images, and writing the disclosure wording for generated assets. The team also prepares a short verification runbook for the client’s communications lead.
Measurement is practical rather than vanity-based. For example, the team spot-checks published assets each month to see whether credentials survived on the newsroom, the website and each social channel, and reports the share of official assets carrying valid manifests along with any gaps found.
How do you train the people involved?
Provenance fails at the human level more often than the technical one. A photographer exports with metadata removed to save file size, or a social manager re-saves an image in a tool that drops the manifest. Short, role-specific training prevents most of this.
Give each role one page. Photographers and designers learn which export settings keep Content Credentials. Social and web editors learn which upload paths strip metadata and where the original should live instead. Spokespeople learn the precise wording for describing credentials and what not to claim. Repeat the training whenever a new agency or freelancer joins, because they bring their own export habits with them.
Where to start this week
Take five recent official images: a CEO portrait, two product shots and two campaign visuals. Upload each to the Content Credentials verify tool and note which carry a manifest. Then trace each one back through the tools that touched it. The step where credentials disappear is where your policy starts, and fixing that one export setting often covers most of the gap.
Keep reading: PR Services · Digital PR