C2PA can bind claims about how a file was created or edited. It was not designed to prove that a depicted event happened.

A 2026 IACR analysis (ePrint 2026/804) argues current specifications fail claimed and essential security goals. That paper is one research programme, not an ISO ruling.

Valid credentials ≠ the scene is real. Missing credentials ≠ the file is fake.