Short answer
C2PA is an open technical standard from the Coalition for Content Provenance and Authenticity for attaching signed provenance information to media files. C2PA records creation and edit history, including AI involvement. A DAM supports C2PA only when it reads, preserves and displays those signed records through ingest, editing and every rendition it delivers.
How C2PA works in a DAM
C2PA works by attaching a signed manifest to a media file. The manifest holds assertions about the file, a claim that bundles them, and a digital signature from the tool or organisation that made the claim.
The standard defines four mechanisms a DAM buyer meets:
- Assertions: statements such as the capture device, edit actions, ingredients and the digital source type.
- Hard binding: a cryptographic hash that ties the manifest to the exact file contents.
- Soft binding: an invisible watermark or fingerprint that helps recover a manifest separated from its file.
- Ingredients: references to earlier files, so a composite or rendition keeps the history of its sources.
Fact: the C2PA Technical Specification 2.3, dated December 2025 in its version history, defines all four mechanisms. Content Credentials is the user-facing name for a C2PA manifest.
A DAM meets C2PA at three points. On ingest, the DAM reads and validates the manifest. On rendition, the resize breaks the hard binding, so the DAM must sign a new manifest that lists the master as an ingredient. On download, the DAM must keep the manifest attached.
Example of C2PA
Worked example: a news photographer's camera writes a C2PA manifest at capture. A photo carries a signed record of its camera, edits and export after retouching in an editing application.
The DAM shows the provenance details to editors. When the DAM creates a web rendition, it signs a new manifest with the master as ingredient. A reader who checks the published image with a public verification tool sees the full chain.
C2PA in a DAM selection
C2PA is defined at Checkpoint 2: Define, where the buyer decides whether provenance is a requirement. Brands publishing AI-assisted or press imagery should make it one. The provenance scenario is then proven at Checkpoint 5: Test.
Ask each vendor to show these points on your own files:
- Upload a file with a valid manifest and display its provenance details.
- Create a rendition and check it in an independent C2PA validator.
- State whether the DAM signs its own actions, and which certificate it uses.
- Map the IPTC Digital Source Type value to a metadata field for AI-generated assets.
The content credentials and C2PA guide covers the topic in depth. The EU AI Act guide explains the regulatory context, and the requirements builder adds provenance requirements.
Common C2PA mistakes
The most common C2PA mistake is a rendition pipeline that strips embedded metadata, which deletes the manifest. Other recurring errors:
- Reading C2PA as proof that content is true. The manifest proves who signed which claims and whether the file changed since.
- No owner for the signing certificate.
- Scoring vendors on product pages, where C2PA support is described in very different terms.
Related terms: Content credentials, Watermarking.
Frequently asked
What is the difference between C2PA and content credentials?
C2PA is the technical standard and the coalition that publishes it. Content credentials are the signed provenance records attached to a media file under that standard. Buyers can write one requirement that names both terms.
Does C2PA show whether an image was made with AI?
C2PA can record AI involvement through actions and a digital source type, which uses values from the IPTC digital source type vocabulary. The record exists only when the generating or editing tool writes it and every later tool preserves it. Test preservation in the DAM on your own files.