An AI-generated image can reach a Drupal site with a digital signature attached, and leave it with another one. Three modules sit in between, and each does one job. Here I follow them one by one on a real image, the cover of this article made with ChatGPT, and I say what held up on my test site and where it broke. What an AI image carries and how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, labels it is covered in the article on metadata and labels for AI images.

Content Credentials reads: it opens the signature of the files an editor uploads and, if it says the file was made with AI, proposes the grade in AI Disclosure. AI Disclosure declares: it keeps the grade the editor confirms, shows the label to readers where the law asks for it and writes the metadata into the copies. C2PA Sign signs: it gives the published copies a new signature, with the site's certificate, and includes the AI Disclosure declaration in it.

A person always decides the grade: the other two modules build on that decision, one to suggest it and one to seal it.

The C2PA signature, known to the public as Content Credentials, is a digital ID card attached to the file. It says who produced it, with which tool and what happened to it afterwards, and it is signed with a certificate, so anyone can check that nobody tampered with it. ChatGPT adds one to every image: the one at the top of this article carries an OpenAI signature that says “created by a trained model”.

The signature covers only that file, byte for byte. Resizing the image, as Drupal does for every page, is enough to break the original signature: for the copy to carry a valid one, someone has to sign it again. That is what C2PA Sign does.

The video follows the image through eight stages. It is born in ChatGPT, the editor uploads it, Content Credentials reads the signature, the editor confirms the grade, Drupal makes the copy for the page, AI Disclosure declares it and C2PA Sign signs it. At the last stage a reader downloads it, or takes a screenshot.

The video shows the recommended setup, with C2PA Sign signing only the copies. With signing on upload turned on and c2patool 0.9, the chain breaks at the first step: C2PA Sign re-signs the file and wipes the OpenAI signature, and Content Credentials has nothing left to read.

Since 13 October I am a co-maintainer of C2PA Sign, alongside @jrglasgow (opens in a new tab), who created it. The fixes described below shipped on 20 October 2026 in release 1.5.0 (opens in a new tab), which needs the c2patool program 0.27 or later and the jrglasgow/c2patool PHP library 0.6.0: on Debian 12 images, build it with cargo. The latest release of the module is 1.5.1 (Drupal.org, as of 22 Oct 2026).

I ran the chain on a Drupal 11 test site and read every file with c2patool. The latest test is from 20 October 2026, on Drupal 11.4.8 with PHP 8.3, C2PA Sign 1.5.0 with the jrglasgow/c2patool PHP library 0.6.0, the c2patool program 0.28.2, Content Credentials 1.0.0-alpha1 with the pure-PHP verifier and AI Disclosure 1.0.0-beta1: the table above holds for these versions.

The outgoing side works. C2PA Sign signs the copies the site serves, and inside them is what AI Disclosure declared: the source type of the confirmed grade, for example "generated by a model", and on a deep fake with the icon burned in, a "modified" action (c2pa.edited) that describes the burned-in icon. The copy a reader downloads is identical byte for byte, and the signature stays valid. Reading works too: uploaded to another site that recognises my site's certificate, that signed copy produces a grade proposal in AI Disclosure, waiting for the editor to confirm it.

In the releases before 1.5.0 four things failed, and today all are solved: three by fixes in the modules, the fourth by the editor's confirmation. 1.4.11 requires c2patool 0.9, while in October 2026 c2patool is at 0.28.2, and 0.9 cannot read signatures in the C2PA 2.x format, like OpenAI's. With 0.9, when it signs the file that was just uploaded, it replaces the OpenAI signature with its own, which no longer says “this is AI”, and the original provenance disappears. That is issue #3596032 (opens in a new tab) of C2PA Sign. With the jrglasgow/c2patool PHP library, which includes my pull request #1 (opens in a new tab) for the icon, 1.5.0 keeps the OpenAI signature in the file as an ingredient, along with the action's title and creator (issue #3596036 (opens in a new tab)). Since 1.0.0-alpha1 Content Credentials also reads the origin in the ingredient: in my test it proposed the grade on the re-signed file with the site's certificate among the trusted ones, and flagged the file as untrusted without it.

In 1.4.11 the copies signed by C2PA Sign are created with permissions the web server cannot read: the first request goes through, from the second one the copy answers 403 and also disappears from the site's pages. On a deep fake with the icon burned in, anyone arriving after the first visit sees neither the image nor the label. The fix for issue #3596031 (opens in a new tab) is in 1.5.0, which serves the copy on every visit.

Finally, a deep fake reaches the other site as "generated autonomously", because the two grades share the same IPTC source type and the reader picks the first one: there the grade does not exist yet, and the editor corrects the proposal. Since AI Disclosure 1.0.0-beta1 a proposal no longer lowers a grade already chosen, so a deep fake already declared stays one (issue #106 (opens in a new tab)).

On my own site I also found a more mundane case. Among the covers made with ChatGPT, the OpenAI signature is still there only on those uploaded as they came out, in PNG: the ones converted to JPG before upload had already lost it. A signature can also get lost in the way a newsroom handles files, before they even reach Drupal.

For a publisher, the AI Act obligation is the visible label on deep fakes, under Article 50(4), and AI Disclosure adds it. The Commission's guidelines, in paragraph 117, say that on a deep fake a publisher cannot rely on the provider's marking: an intact signature does not replace the label. The AI Act does not ask publishers to keep the signature, although the Code asks providers to forbid its intentional removal in their terms of use.

Machine-readable marking is an obligation for providers of the systems that generate the images, under Article 50(2), and the C2PA signature is one of the techniques for it. The Code of Practice asks for signed metadata plus a watermark. A site that puts into service, under its own name, a system that generates images, for example one built with the Drupal AI module, can also be a provider: there C2PA Sign covers the signed metadata, and the Code also asks for a watermark.

For everyone else, Content Credentials saves the editor time and C2PA Sign adds evidence: it shows what the site declared and when, if a label is ever challenged.

A signature is trusted when the certificate that produced it comes from an authority on the C2PA trust list. The OpenAI signature on the cover is. My test site's one, made with a test certificate, is valid, but outside the test bench nobody recognises it. A real site needs a recognised certificate: the authorities on the list issue it to products that passed the C2PA conformance programme, and no source yet explains how an editorial site gets there.

The same goes for reading: Content Credentials proposes the grade only from a trusted signature, and treats as trusted the certificates on the list it is given: in the module, if it reads with the PHP extension or the pure-PHP verifier, or in the reading service. Set up with the official list, it reads the OpenAI signature as trusted. On a site that also uses C2PA Sign, the site's certificate has to be added to that list, otherwise every upload is flagged as untrusted. It must be a certificate whose private key only the site holds, never c2patool's sample one.

With the versions I tested, this is the combination that works:

1. In C2PA Sign turn on signing for image style copies: the copies served to readers get the site's signature with the AI Disclosure data. Since 1.5.0, signing on upload and on publication also keeps the OpenAI signature as an ingredient: if you turn them on, add the site's certificate to the trusted ones in Content Credentials.
2. In Content Credentials choose the content types to read, or the media types if the site uses Media, leave the maximum resolution of the image fields it reads empty, and use the official C2PA trust list, not the test one. That way the OpenAI signature produces the proposal on the first cron run after the upload: Content Credentials reads queued files.
3. In AI Disclosure the editor confirms or corrects the proposed grade: whether the image is a deep fake is for the editor to say, because the signature knows nothing about it.

c2patool is all you need, a free program from the Content Authenticity Initiative. It works like a passport scanner: it tells you who made the file, with which program, what changes it went through and whether the signature is still intact. With a certificate, the same program signs a new file, and that is what C2PA Sign uses behind the scenes.

c2patool copertina.png

For this cover it answers, in short, that the file is signed by OpenAI, created with ChatGPT by a trained model, converted, with a watermark declared in the pixels, and that the signature is valid.

Sources checked on 20 October 2026.

1. AI Disclosure (opens in a new tab), project on drupal.org, and its documentation: Labels on images, With C2PA Sign (opens in a new tab). Primary source.
2. AI Disclosure, documentation: Suggestions, Reading C2PA content credentials (opens in a new tab). Primary source.
3. C2PA Sign (opens in a new tab), project on drupal.org. Primary source.
4. Content Credentials (opens in a new tab), project on drupal.org. Primary source.
5. C2PA Explainer 2.3 (opens in a new tab), Coalition for Content Provenance and Authenticity. Signing, validation, trust. Primary source.
6. c2patool (opens in a new tab), Content Authenticity Initiative, and the Content Credentials README (opens in a new tab) on re-signing and c2patool 0.9. Primary source.
7. C2PA Conformance Program (opens in a new tab), trust list and certificates. Primary source.
8. Code of Practice on Transparency of AI-Generated Content (opens in a new tab), European Commission. Marking for providers. Primary source.
9. Guidelines on the transparency obligations of Article 50 (opens in a new tab), European Commission, C(2026) 5054. Paragraph 117. Primary source.
10. My test on a Drupal 11 test site, with C2PA Sign, Content Credentials and AI Disclosure, read with c2patool. First-hand measurement.