In short: Content Credentials are signed records of where a picture, video or audio file came from and what was done to it, including any AI use. They travel with the file when the tools support them. They do not prove the content is true, and a file without credentials is not automatically untrustworthy. Ask your producer or agency which tools made the work, and keep the project files.
Content Credentials are the part of AI labelling that a machine can check. A picture or a video can carry a signed record of its origin, its edits and any AI use. That record is useful for a business commissioning content, because it gives a trail to follow. It is not a verdict on whether the content is honest, and it does not replace a person checking the work.
What a Content Credential is
The C2PA explainer describes a Content Credential as the preferred non-technical term for a C2PA manifest. A manifest is a set of information about where an asset came from, made up of one or more assertions, and it is digitally signed.
An assertion is a statement about the asset. Assertions cover things like origin, edits and AI use. The manifest is signed by the software or hardware that produced it, so the signature can be checked against the signer's public key.
How it stays with the file
The explainer describes two kinds of binding:
- Hard binding: cryptographic hashes tie the record to the content. Any change to the file breaks the match, so tampering shows.
- Soft binding: an invisible watermark or a fingerprint lookup helps a platform find the record when the file has lost it.
Provenance metadata can be stripped from a file. Durable Content Credentials pair a hard binding with a soft binding, so the record can still be found after the metadata has been removed.
What the credential cannot tell you
- Whether the content is true. Provenance cannot show that content is true, accurate or factual.
- Edits made in tools that do not support credentials may go unrecorded.
- A file with no credentials is not thereby untrustworthy.
- The core specification does not confirm who a person or organisation is. Extensions can add that, with privacy questions of their own.
What to do before you publish
- Ask your producer or agency which tools made each part of the work, including any AI picture, video or voice.
- Keep the project files and the export records for each version.
- Say so on the work where a viewer would expect to know. Follow any platform setting for AI-made content.
- Check the current requirements for each market and platform you publish in. They differ by place and change often.
- Ask for a written note of what was generated, and by whom.
Granary's own Academy course, The Phoenix Formula, is partly voiced with a consented cloned voice, and the course labels that voice as synthetic. That is the practice this guide recommends: say what was made by a machine, and keep the record.
For the wider decision of when AI is the right tool, read when to use AI and when to shoot it. The voice and likeness consent checklist covers the permissions you need before a generated voice or face is used.
Sources
- C2PA, Content Credentials explainer (specification 2.3), read 5 November 2026
Related guides
- AI video for small businesses: what's real, what's risky
- When to use AI and when to shoot it for real
- AI in the production workflow, stage by stage
- Who is responsible for an AI-made ad?
- Voice and likeness: a consent and contract checklist
- All guides and tools
The picture at the top of this page is an illustration, not a photograph of a client or a real job.
Questions we get asked
What are Content Credentials?
A signed record, defined by the C2PA specification, of where a file came from and what was done to it. Assertions can note AI use and edits, and the record travels with the file when the tools support it.
Do Content Credentials prove that an AI video is true?
No. The C2PA explainer says provenance alone cannot tell you whether content is true, accurate or factual. It shows the recorded history and who signed it, and readers judge trust from that.
Do I have to label AI content?
It depends on the market and the platform, and the requirements change. Check the current requirements for each place you publish, and ask your producer for a written record of what was generated.
granary.digital · 01243 884993 · studio@granary.digital · The Old Grainstore, Adsdean, Chichester, West Sussex, PO18 9DN · Prices exclude VAT unless marked inc VAT