Etch vs C2PA
C2PA is a content-provenance manifest attached to media files. Etch is a signed decision chain for AI agents. Different artifacts, different questions. This page names the boundary.
Different artifacts, different questions
C2PA (Coalition for Content Provenance and Authenticity) answers "was this image, video, or document created or edited by AI, and by which tool." The answer travels with the media file as an embedded manifest.
Etch answers "who reviewed this AI-assisted output before it went out, on what basis, and what changes if the reviewer's assumption turns out to be wrong six months later." The answer lives on a per-project signed chain with framework mapping to SR 11-7, EU AI Act Article 12, ISO 42001, and NIST AI RMF.
Where they compose
C2PA travels with the file
Attached manifest, self-authenticating, survives copy across systems that respect the envelope. Ideal for media, documents, newsroom workflows.
Etch stays on the chain
Per-project append-only decision log. Signed events, hybrid post-quantum, epoch-anchored. Ideal for AI-assisted decisions that a regulator will audit by framework section.
Reference the manifest from the chain
An Etch event can reference a C2PA manifest hash as part of its signed context. The auditor gets both: the manifest for artifact provenance, the chain for decision accountability.
Frequently asked
Is Etch a competitor to C2PA?
No. Etch and C2PA answer different questions. C2PA answers 'was this media file created or edited by AI, and by which tool.' Etch answers 'who reviewed this AI output, applied what policy, took what exception route, and owns the outcome six months from now.' Different artifacts, different columns in a governance framework.
Can Etch embed a C2PA manifest?
Yes. An Etch event can reference a C2PA manifest as an attached entity, so an Etch chain of decisions can carry per-artifact provenance without reimplementing the C2PA envelope. Etch does not modify the C2PA manifest; it references its hash and signature as part of the signed event context.
Does watermarking replace either C2PA or Etch?
No. Watermarking evidences that a model touched an output. C2PA evidences that a specific tool created or edited a media artifact. Etch evidences that a named person reviewed the output, applied a specific policy version, and owns the outcome. All three are different columns in a mature governance framework and one does not substitute for another.
Which standard should I ship first?
If your primary risk is 'was this image edited by AI' (media / newsroom / legal-discovery contexts), ship C2PA. If your primary risk is 'who is accountable for this AI-assisted decision' (financial services / healthcare / regulated buyers), ship an Etch-shaped signed decision chain. Most enterprise programs end up needing both, layered.