AI Images Need a Chain of Custody, Not Just a Disclosure Label

By Greg Nowak. Last updated 2026-08-04.

A disclosure label tells people that AI played a part in an image. It does not tell them where the image came from, what happened to it along the way, or whether any supporting evidence survived publication.

That is the job of a chain of custody. For a business, the practical question is not simply whether an approved image had provenance data when it entered the workflow. It is whether the organisation can still connect that source file to the version a customer, regulator, partner or journalist actually receives.

The tools are becoming easier to access. Google is expanding provenance inspection across consumer products and has introduced an AI Content Detection API for organisational workflows. OpenAI combines Content Credentials with SynthID watermarking and verification tools. Adobe supports Content Credentials in major creative applications, while the C2PA specification defines how signed provenance manifests are attached to assets and validated.

None of this makes a publishing pipeline trustworthy by default. Credentials can disappear during resizing, format conversion, uploads, downloads or screenshots. Adding a disclosure label at the end may satisfy one communication need, but it cannot show where the underlying evidence was lost.

What a Content Credential can tell you

C2PA Content Credentials use signed manifests containing claims and assertions about an asset. The specification defines how a manifest is bound to the content it describes and how a verifier checks the manifest, its signature and its relationship to the asset.

This is more useful than a simple AI-or-not flag. Assertions can describe actions, ingredients and relationships between files. If one image is derived from another, an ingredient assertion can link the rendition to its parent. Adobe describes the practical effect as a version history that can gain new credentials as the content is edited.

That history remains useful only if the organisations handling the image preserve it or deliberately extend it. OpenAI notes that uploads, downloads, resizing, screenshots and format changes can strip C2PA metadata or break its connection to the file. Its verification approach therefore also uses SynthID, an imperceptible watermark designed to provide a more durable, complementary signal.

There is an important limit here. If a verifier finds no credential or watermark, that does not prove the image was created without AI. OpenAI’s verifier does not make that leap because provenance signals may have been removed. An operational process needs an honest “unknown” result rather than treating missing evidence as proof of human authorship.

Test the file people actually receive

Checking the original file is necessary, but it is not enough. The public rarely sees that file. They see a derivative produced by an editing suite, digital asset manager, CMS, optimisation plugin, image proxy or CDN.

Each transformation is a custody checkpoint. The useful control question is: can we account for the relationship between the approved source and every rendition we distribute?

Checkpoint	What can go wrong	Control to put in place	Evidence worth keeping
Generation or capture	The image enters production without a verified baseline	Inspect the original before editing and preserve an unchanged copy	Original file, asset ID and validation result
Creative editing	An export preset removes the manifest or breaks its binding	Test every approved application and export preset used in production	Input-output relationship and verification status
Agency handoff	Renaming or recompression separates files from their records	Transfer originals, approved derivatives and a handoff register together	Sender, recipient, version and validation timestamp
CMS upload	Thumbnailing or conversion creates untracked renditions	Verify the stored master and representative generated sizes	CMS asset ID, rendition URLs and test results
Optimisation and CDN	Format negotiation or edge processing changes the delivered bytes	Test actual public responses in each supported delivery format	Requested variant, delivered format and verification outcome
Replacement or withdrawal	The team cannot locate every published derivative	Map each controlled source to its publication locations	Current inventory of pages, campaigns and asset status

The chain has to reach from the preserved original to the public response, not stop at the CMS upload.

Put controls around transformations

Start by preserving the credential-bearing original as a controlled asset. It should have an internal identifier, a recorded origin, an approval status and an initial verification result. Editing and delivery should use copies or derivatives whose relationship to that original is documented.

Then list every operation that can change the file. Creative edits are the obvious ones, but routine infrastructure often causes the break: crop presets, quality reduction, metadata stripping, thumbnail generation, format negotiation and image proxying. Run representative images through each path. JPEG, PNG and newer delivery formats may behave differently, so one successful test cannot stand in for every rendition.

Verification belongs at several points: when the asset arrives, after the approved creative export, in the CMS and at the public URL. This makes failures traceable. If a credential validates after export but not after upload, the CMS boundary becomes the first place to investigate.

The recorded result should say what the test actually found. Useful states include “credential validated,” “credential present with validation failure,” “no credential found” and “additional watermark signal detected.” Reducing those findings to a single AI field hides meaningful differences between the available signals. The underlying sources are clear that the methods complement one another and that none is foolproof.

You also need a decision for the failure case. Depending on the image’s purpose and risk, the team might preserve the controlled original while publishing a labelled derivative, change the transformation settings, create a new signed rendition with a capable tool, or pause publication for review. What matters is that the response is agreed in advance and applied consistently.

Make agency handoffs testable

Provenance often crosses several organisations. A brand commissions an agency, the agency works in multiple creative tools, and a separate supplier manages the CMS or delivery layer. Each party can complete its own step correctly while the overall evidence trail still breaks between them.

A delivery requirement should identify the controlled original, list the approved derivatives, state whether credentials are expected, include the verification result at handoff and name who may create further renditions. It should also make one point explicit: the absence of detectable credentials is not evidence that a person created the image without AI.

This does not need to become a paperwork exercise. The goal is to connect records the teams already use. A creative asset ID should map to the corresponding CMS entry and public placements. That same mapping becomes valuable when an image must be corrected, replaced or withdrawn.

Turn the audit into working controls

A first audit does not have to cover the entire historical library. A more useful starting point is a representative set of images from the main generation tools, editing applications, agencies, CMS routes and CDN variants. Preserve the inputs, send them through the real workflow and compare the verification result at each checkpoint.

Once the weak points are known, the tests can become release controls. Python scripts or CI checks can flag missing credentials, validation failures and unexpected file changes before publication. Those checks should report the available evidence, not make unsupported claims about authenticity. Higher-risk exceptions should remain available for human review.

Greg can map the image-generation and publishing path, inspect existing C2PA manifests, test representative files through the transformations the business actually uses, and define a custody record that fits the current toolset. The deliverable is practical: a workflow that can show what it received, what changed, what reached the public and which provenance signals still validate.