Bergen Provenance summit: Provenance is ready. Is anyone buying?

Bergen, one year later:

On September 22, the Media Provenance Summit organized by the International Press Telecommunications Council (IPTC) and Media Cluster Norway returned to Bergen, almost as reliably as a season. The yearly comparison gives some valuable insight into how the space evolves. In twelve months, almost everything needed to create, sign and verify a Content Credential has moved from demonstration to product. What has barely moved is the other end of the chain, the platforms and publishers where images are actually seen. Bergen was a meeting of an industry ready to deliver, still waiting for someone to take delivery.

Upstream, it works

The clearest sign is the cameras. Almost every major manufacturer now has working prototypes or production models that sign images at the moment of capture, and all of them, except Apple, are compatible with the Coalition for Content Provenance and Authenticity (C2PA) standard. Google has built C2PA into its Pixel 10 and is one of the most active members of the working groups and the steering committee. Apple remains the question mark. The IPTC’s Bruce MacCormack listed it among the ecosystem’s open issues, and for the company behind the most-used camera in the world, it is a major one. Still, the direction is set: provenance now starts in the device, before anyone else has touched the file.

The second sign is the C2PA Conformance Program, which is live and lively. Almost every day, a company announces its graduation with as much pride as the parent of a college student. The pride is justified, because conformance is what makes a credential count. As the IPTC’s Brendan Quinn explained, a verification tool checks two things: that the credential is intact, and that it was signed by a tool certified through the program. A credential can pass the first test and fail the second, in which case readers see a warning . Since June, the program also covers live and on-demand video. In practice, conformance gives buyers a list of tools they can rely on without having to audit each one themselves, which is exactly what a market needs to form.

The third sign is the vendors. They are real, active, and ready to implement, and they now cover every part of the chain. Photo and video are the most represented, but the lightning round also showed text (Encypher), live streaming (EBU, Unified Streaming, Vimond, CastLabs, Eyevinn), keys, certificates, and timestamps (SSL.com, Utimaco, Trufo, Noosphere), and editing workflow (Camera Bits). The vast majority are start-ups of two or three people, most of them self-funded and built on strong proofs of concept. Venture capital and professional investors have not entered this market. That says two things: the builders believe in provenance enough to pay for it themselves, and the people whose job is to bet on markets before they exist are not yet convinced this one does.

Interestingly enough, around this buzzing ecosystem sit well-established large multinationals, including Google, Adobe, Microsoft, SSL.com, the BBC, and AFP. The goodwill in the room is genuine. So is the careful suspicion beneath it, the awareness that today’s partner may become tomorrow’s most ferocious competitor. Everyone is cooperating on the standard while keeping an eye on who will profit from it.

The sleeping giant

Which brings us to what everyone would like to wake up: the marketplace. Who will implement, when, how, and for how much? Who pays, and for what?

No one knows. Everyone wants to be first to benefit, and everyone would love to know how big this giant is, if it is a giant at all. For now, the push comes from regulation more than from buyers, and the EU AI Act is the main reason customers bring up C2PA. But no one has a price list yet. AFP was candid about the resistance it met internally, which is symptomatic of what is happening elsewhere: its lawyers argued that Article 50 does not apply to a news agency; its sales team pointed out that provenance is not in its B2B contracts; its engineers found it complicated; and its editors asked what exactly should be shared. AFP is continuing to move ahead anyway, with a delivery pilot for selected clients once it is conformant and a video project with Dalet for early 2027.

Why it sleeps: the downstream

The reason is simple. Upstream, the environment is ready and very active. Downstream, it is still apathy. Social media platforms and large publishers, the ones who hold the keys to this initiative’s success, remain motionless. LinkedIn is the exception: the BBC’s Zak Datson presented the work done with LinkedIn to carry credentials through to its feed. The others are not even in the room.

Yet they hold the keys, and the doors. If they do not preserve and display Content Credentials, it does not matter what everyone does upstream. It will be useless. A signed photograph whose credential is stripped at upload, or never shown to the reader, is indistinguishable from any other photograph.

The few newsrooms that are moving show how much of the chain is still broken. Bruce MacCormack called them trailblazers, and they deserve the title. Paris Match is actively testing publishing with credentials. In Norway, VG, Adressa and Bergens Tidende plan to publish with C2PA by the end of 2026, in a pilot led by Nora Savosnick of Show Your Work Lab. They discovered that the DAM all three use, NTB Lens, invalidates the credentials, and so do their parent companies’ content management systems. For the pilot, images must be stored with a third party just to survive. Unified Streaming made the same observation for video: packaging is where credentials break, and when they are stripped downstream, no one answers for it, neither the AI provider, nor the deployer, nor the publisher. One can only hope these pioneers will pull others behind them.

Building around the gap

In the meantime, the upstream is not waiting. If metadata will be stripped, and it will, the answer is to bind the credential to the pixels themselves. Unified Streaming put it bluntly on a slide: soft binding is for when metadata breaks, not if.

This is where Imatag,  presented a full “glass-to-glass” implementation with CEO Mathieu Desoubeaux. A Sony camera creates the Content Credential at capture. The raw files go into Camera Bits’ wonderful Photo Mechanic for processing and IPTC captioning. At export, the credential is updated and signed, and an invisible Imatag watermark is embedded as a soft binding, so the image can be matched back to its credential even after the metadata is gone. AFP is testing a similar logic with a double watermark: a visible, public TrustMark alongside a secured Imatag mark, with Adobe’s beta plugin displaying the Content Credentials on a photo published on a website without any metadata.

Soft binding keeps the provenance recoverable wherever the image travels. It does not, on its own, make a platform show it to anyone. The keys are still downstream.

Will it happen?

The frustration in Bergen was palpable, but it was not enough to dampen the enthusiasm. The overwhelming feeling is that this will happen. Just not soon enough.

Meanwhile, the work continues on making all this information digestible for ordinary people, backed by user studies. Microsoft presented its UX research. Unified Streaming pointed out that a camera original and an AI-manipulated image can carry the same “CR” icon, with the difference visible only after a tap. MacCormack conceded that the CR logo works for industry awareness but has limited use as a consumer brand, and that C2PA and CAWG together need a new name. The Norwegian newsrooms will survey their readers on usability and trust. When the platforms finally wake up, they will at least find the explanation ready.