When a global marketing team receives a final MP4 from a production partner, the picture may look finished while its history remains invisible. Which shots came from a camera? Which backgrounds were generated? Was a voice synthesized? Who approved the change? Did the exported file retain any machine-readable provenance after it passed through another editor, a DAM, or an ad platform?
That used to be an internal production question. In 2026, it is becoming part of the delivery itself. The useful procurement shift is not “add an AI label to everything.” It is to make origin, material AI involvement, rights, disclosure decisions and verification portable across the supply chain.
Provenance has moved into real production and media workflows
The C2PA 2.4 specification, released in April 2026, added capabilities including a machine-readable AI disclosure assertion. C2PA's July implementation guidance then described ways to distinguish captured, generated and AI-edited media, record creation and editing actions, and localize AI modifications within an asset. These are open provenance mechanisms, not a feature owned by one advertising platform.
The production layer is catching up. Adobe's September 9 documentation for Content Credentials in Premiere and Media Encoder explains that editors can scan supported source media, review credential status and apply credentials during export. Adobe also warns that publishing destinations may not preserve or support those credentials.
Distribution is changing too. Google Ads now provides AI content label settings for advertiser-supplied assets, and says images and videos generated within Google Ads tools include SynthID and C2PA machine-readable marking. Meta's June 1 update to AI transparency for ads says “About this ad” will collect AI information and that Meta is beginning to detect third-party AI creation or editing through industry-standard signals.
Those announcements prove product-specific deployment, not universal interoperability. They do not guarantee that every destination will preserve a credential after transcoding, cropping or repackaging.
A Content Credential is not a truth certificate
C2PA can help establish whether a signed provenance record is bound to an asset, what the record asserts, who signed it, and whether the record has been altered. The specification is explicit that provenance does not assign a value judgment about whether content is “good,” “bad,” “real” or compliant.
It also cannot decide whether a product claim is substantiated, a talent release covers a new territory, a model licence permits a particular commercial use, or a disclosure satisfies local law. Those decisions still belong to the brand and its advisers.
Think of three connected layers:
- Machine-readable provenance: C2PA, watermarks or other platform-readable signals.
- Consumer-facing disclosure: an in-platform panel, a visible label or a statement inside the ad.
- Internal accountability: origin, rights, approver, permitted markets and retention terms.
The first layer can support the other two, but it cannot replace them. A legacy asset without C2PA is not automatically unsafe; a signed asset is not automatically cleared for every use.
The ONCE Asset Passport: six fields to hand off with the file
For campaigns that cross markets, vendors or long reuse windows, ask the production partner to provide a human-readable Asset Passport tied to each master asset. It complements machine credentials and stays useful even when a destination strips metadata.
1. Origin
List captured footage, stock, client-supplied material, generated media and third-party components. Give every master and major derivative a stable identifier. “AI-assisted” is not an origin record; it tells the next team almost nothing about the composition of the asset.
2. Material AI involvement
State where AI was used and what changed: generated environment, colour replacement, canvas expansion, synthetic voice, created person or performance alteration. Routine denoising and a photorealistic synthetic spokesperson should not be collapsed into the same risk category.
3. Rights
Map people, voices, music, fonts, stock, model terms and client-owned inputs to territory, channel, duration and modification rights. When a recognizable person is involved, the passport should point to a separate digital-replica rights record covering creation, new performance, training reuse, storage and deletion. Our earlier guide to the digital-replica rights chain addresses that contract layer in more detail.
4. Disclosure responsibility
Name who decides whether an AI label is required, who sets the flag in the ad account, which markets need a visible disclosure, and who reviews labels added automatically by a platform. The IAB AI Transparency & Disclosure Framework V2, published August 18, uses a risk- and materiality-led approach rather than treating every assistive AI operation as equivalent.
5. Export and destination verification
Check the master, media-ready export and material crops after export. Confirm that the asset identifier, AI involvement description and credential status still match. A credential that existed in the edit suite but disappeared during another handoff is not a verified delivery.
6. Archive and retention
Keep the final asset, credential check, rights documents, disclosure decision and version relationships together. A regional team reopening the campaign next year should be able to understand why the asset was approved without reconstructing its history from chat messages.
When the full passport is worth the work
A full Asset Passport is usually justified when two or more of these conditions apply:
- a recognizable person, digital replica or synthetic voice is used;
- AI materially changes the product, performance claim or apparent real-world setting;
- the asset will run in multiple markets;
- several agencies or suppliers will touch the file;
- the campaign has a long reuse window;
- claims are sensitive or highly regulated;
- the master will feed many crops, edits or automated variations.
A single-market, short-lived graphic adaptation with no people and no sensitive claim may need only a lightweight record: master ID, origin list, material AI involvement, rights expiry and one export check. The goal is not to build a bureaucracy around every cleanup operation. It is to make high-consequence assets explainable when they are reused, challenged or transferred.
Older media should not be rejected simply because it predates Content Credentials. A brand can rebuild traceability with source records, rights files, hashes or version IDs, then add available machine credentials at the next controlled export.
Compare the full cost of a provenance-complete delivery
A low generation or editing price can hide the labour of origin logging, rights review, disclosure classification, credentialed export, destination QA and archiving. Compare suppliers using a fuller unit:
Cost per provenance-complete deployment = (creation and production + rights review + origin and AI-use logging + credentialed export + destination QA + archive handoff) ÷ approved asset-market-channel combinations.
This is a procurement model, not an industry benchmark. It makes an important difference visible: two quotes can deliver the same number of files while only one leaves the brand able to explain where those files came from, who may use them and how they should be disclosed.
For brands working with production partners in China and media teams elsewhere, the most useful first question is not “Do you support C2PA?” Ask whether the partner can identify each source, describe material AI involvement, connect the rights, verify the export and hand off disclosure and archive responsibilities. When those answers travel with the asset, provenance becomes operational infrastructure rather than metadata nobody checks.
