What is C2PA? Content Credentials explained for brand and marketing teams

Content Credentials, built on the C2PA standard, offer one potential solution for understanding content provenance and supporting AI transparency obligations. But only when credentials stay with their assets and are visible to the people using them.

If you’re responsible for brand, marketing, or DAM in your organization, here’s what you need to know about C2PA, Article 50 of the EU AI Act, and its implications for digital asset management.

What you need to know

• Brand and marketing teams have to manage AI content that may have been generated outside typical brand workflows.
• Without known provenance, it’s hard for teams to know which AI content they’re handling and whether disclosure applies under Article 50. This poses a risk to the brand, not only in terms of regulatory requirements but also public perception.
• C2PA can provide valuable content provenance data, but only if it stays with the file and your team can see it.

AI content disclosure: A growing challenge for brand and marketing

Generative AI is making content easier to create but harder to manage. Between DALL-E and Adobe Firefly, your internal teams and agencies, it’s easy to lose track of how assets have been created. Assets can arrive second-, third-, or fourth-hand — designed, edited, and reformatted via a range of tools. And provenance is sketchy at best.  

• Your regional team feels empowered to create their own localized campaign visuals but doesn’t realize they need to tell the central brand team that AI was used.
• A supplier speeds up time to market but forgets to disclose AI use in copy production.
• A team member flags that they’ve used AI, but their manager gets pulled into a dozen other things and fails to pass it on. 

And you, unwittingly, add unidentified AI content to governed platforms like your DAM, for others to use and reuse. Once the assets are out there, your control slips even more.

This is a growing headache for brand, marketing, and DAM teams. 

Since August 2, 2026, Art. 50 (4) of the EU AI Act has required deployers of AI systems — which includes most brands — to disclose deepfakes and certain AI-generated or manipulated text published on matters of public interest (e.g., political campaigns, public policy, news) unless an applicable exception applies.

But lawmakers aren’t the only ones who want AI labeling. The public wants it too, and it’s more demanding than the regulators.

• 86% of the 10,000 global consumers surveyed by YouGov said AI-generated content should be disclosed, and 59% said failure to disclose reduces trust.
• In a further study by Cint and Advertising Week, 44% of consumers reported diminished brand trust when AI use is undisclosed. 
• 70% of consumers surveyed by Canva believe it will eventually be impossible to tell whether an ad was AI-generated without disclosure. 

Your team should know that an asset is AI-generated or manipulated before the public does. But that’s not always the case. It’s no wonder we hear so many brand professionals despairing of the “Wild West” of AI content creation in their organizations.
‍

“Brand marketers and content teams should pay attention right now because questions about the intersection of brand governance and AI are coming from your audience, your legal team, and increasingly from regulators. The EU AI Act's transparency rules for AI-generated content have taken effect, and more is likely to follow. You're making more imagery, faster, from more tools. When someone asks ‘Is this AI?’, then ‘I think so’ isn't a good enough answer. Teams that can check in seconds keep using AI with confidence.”

– Anton Moritz, Principal Product Manager DAM at Frontify

‍

Let’s learn more about Article 50 of the EU AI Act before looking at one approach to embedding content provenance into the files themselves and supporting your disclosure decisions — C2PA.

What is Article 50 of the EU AI Act?

Article 50 of the EU AI Act sets out transparency requirements around AI-generated and manipulated content. For brand and marketing teams, two requirements are particularly relevant:

Art 50 (4) aims to strengthen public protection against potentially misleading or harmful AI content. For example, deepfakes that feign authenticity, or public-interest content that is AI-generated and hasn’t undergone human review or editorial control by someone responsible for it.

Art 50 (2) requires that providers of generative AI systems mark AI-generated content in a machine-readable format so that it can be detected as artificially generated.

These requirements have implications for how brands approach content transparency and authenticity. In this context, understanding where content comes from, how it was created and modified becomes increasingly important.

What do marketers need to know about Article 50 of the EU AI Act? 

These are the key things that brand and marketing teams need to know about Article 50 of the EU AI Act:

• Two types of actors have obligations under Article 50: providers and deployers. Most brand teams using third-party AI tools to create or edit content will qualify as deployers.
• Deployers have an obligation to disclose when certain types of content have been AI-generated (produced with AI) or AI-manipulated (edited with AI) (Art 50 (4)). This includes deepfakes and AI-generated or manipulated text published on matters of public interest, such as political campaigns, public policy, or news, unless an applicable exception applies.
• Broadly speaking, most marketing content doesn’t need an AI label under the EU AI Act. The disclosure depends on the nature, purpose, and context of the content.

What is C2PA?

C2PA is an open standard to make the origin of content clearer. It’s well supported, too: it’s developed by the Coalition for Content Provenance and Authenticity (C2PA), a group that includes Adobe, Google, Meta, and Microsoft.

By attaching Content Credentials to files, C2PA uses metadata to show how a piece of content was created, what edits have been made, and whether AI has been used. Content Credentials are like a passport: a verifiable record of where content has come from, and where it has been, on its journey to you and your audience.

How does C2PA help marketers meet their Article 50 transparency obligations?

C2PA supports marketers in meeting their transparency obligations under Article 50 by making it easier to understand the origins of content, including the use of AI in its creation or modification. With visibility into where content came from, you can better determine if you need to disclose AI use; whether that’s to meet Article 50 obligations or to satisfy wider public sentiment.

The good news is that most marketing content is unlikely to require disclosure under EU AI Act Article 50, so most assets won’t need any action. But visible content provenance helps you identify the assets that may warrant further investigation for brand risk or legal review before use.  

This could be especially important in campaigns where AI could be a faux pas, such as campaigns focusing on authenticity, real customer stories, human craft, or sustainability.

Does my marketing content need AI disclosure?

Whether your marketing content needs EU AI Act disclosure depends on what it is. Deployers only need to disclose AI-generated or manipulated content in specific scenarios, particularly where it could falsely appear authentic. Think:

• Deepfakes, where AI is used to create or manipulate audio, image, or video content that resembles real people, objects, places, entities, or events and would falsely appear authentic. Like creating a celebrity endorsement that never happened.
• AI-generated or manipulated text published on matters of public interest (e.g., political campaigns, public policy, or news), unless it has undergone human review or editorial control. For example, an AI-generated report about election results that hasn’t been subject to any human editorial checks or validation.

However, much other AI content doesn’t require disclosure under the EU AI Act, such as using AI to create product listings or campaign imagery — provided the content doesn’t depict real people, places, or events in a way that would falsely appear authentic.

How does C2PA work?

C2PA uses an open standard to automatically add machine-readable content provenance to digital assets. 

1. Content is created: For example, someone takes a photograph using a C2PA-compatible camera or generates an image, video, or audio file using a C2PA-compatible AI tool.
2. Content credentials are added automatically: The device or software records how the content was created or edited, including AI use. When someone edits the file in another C2PA-compatible tool, that edit is added to the record.
3. The credentials are digitally signed: This shows who signed the credentials and lets software detect whether the file’s credentials have been altered since signing.
4. The credentials can be checked: Compatible software, such as publishing platforms, can check and verify the credentials. Other software, like a DAM system, can make the credentials visible to users.
5. Content can be automatically labeled: Some publishing platforms may add AI labeling based on C2PA and other signals/detection methods.

Is C2PA the only way to mark AI content?

No. The EU AI Act doesn’t name a specific method, and some providers use invisible watermarks or other techniques. That’s another reason a missing credential doesn’t prove an asset is human-made.

What are the limitations of C2PA and Content Credentials?

While C2PA is a great first step toward content provenance visibility, it isn’t a full solution for Article 50 obligations. C2PA is clear that it’s a way for people to assess provenance, not a legal compliance tool in itself. Here are some things to note:

1. C2PA can’t tell you whether to disclose AI use: C2PA can help teams understand an asset’s recorded origin and edits, but it can’t tell you whether public disclosure is legally required under the EU AI Act. That’s still a matter of judgment for you and your team. 

2. Content Credentials can be missing or incomplete: There are various reasons why content might not have Content Credentials attached. For example, an image may have been created in a platform that doesn’t support C2PA, or credentials may have been lost during download or conversion in some systems. Marketers can’t interpret that as evidence for or against AI involvement. 

3. Content Credentials are machine-readable: Content Credentials are machine-readable, but that doesn’t mean they’re immediately human-readable. Credentials aren’t stamped across a piece of content like a watermark; they may be embedded in the metadata or stored separately but linked to the file. This means that while software can read and verify the credentials — and label your content as AI automatically — people might need an extra step. As AI content production increases exponentially, making that extra step easy can be the difference between oversight and overwhelm. 

Fast AI content and a clear origin record shouldn't be at odds. Every asset should carry its record, show it to anyone who handles it, and give teams something solid to base their disclosure decisions on, without creating extra work for marketers.

Does the EU AI Act apply to organizations outside of the EU? 

Yes. A company doesn’t have to be in Europe for the EU AI Act to apply to it. What matters is how and where its AI systems are made available or used. The EU AI Act can also apply to companies outside the EU if they offer AI systems in the EU, make them available for use in the EU, or produce AI-generated outputs that are used in the EU. Like the GDPR, the EU AI Act can apply beyond EU borders. Being based outside the EU doesn't automatically put a company outside the scope of the law.

What does good content provenance look like?

To ensure C2PA actually works for marketers, content provenance needs to be three things:

• Visible: Anyone who handles the asset can see where it came from, which tool made it, whether AI was involved, and whether the record is verified.
• Actionable: Teams can act on the record, such as filtering the library by origin to find AI assets and decide which need review.
• Portable: The record stays with the file when it's downloaded, and a good system is clear about what happens when the file is edited, resized, or moved to another system.

Marketers using some digital asset management systems have a distinct advantage here: DAM systems have long protected brands by surfacing information about asset permissions, restrictions, version history, and expiry. Today, C2PA-aware DAMs can include Content Credentials in the asset record, making provenance an integral part of any asset's lifecycle.  

This matters most when files change. Some tools strip provenance during processing, and resized, cropped, or converted files can lose their credentials along the way. Keeping credentials intact through those steps is still evolving across the industry, and Frontify plans to support this in a future release.

How can Frontify help marketers use C2PA? 

Frontify helps marketers see and access AI provenance in their usual content workflows. By surfacing C2PA Content Credentials of digital assets, teams can inspect origin information and make informed decisions about disclosure. Frontify shows what the file declares. Your team decides what to do with it.

• Does Frontify read C2PA credentials when a file is uploaded? YES. We read credentials on upload and support 15 file formats, including images, video, and audio.
• Does Frontify show origin and verification status where your team works? YES. We show it in the asset sidebar in the library workspace, and in a simpler view on published library and guideline pages.
• Can you filter Frontify by origin, and reach the same data through an API? YES, in the library workspace and through the public API.
• Does the original file keep its credentials when it's downloaded? YES, for the original file you uploaded.

Frontify doesn’t add visible AI labels to your assets. The credential information is shown in the asset sidebar and on published library and guidelines pages. It doesn’t stamp labels onto the asset itself.

Learn more about Frontify’s C2PA support today

Request a demo to see Frontify in action, including how users upload, inspect, find, and retain Content Credentials.