DiagnosticsProvenance conformance readiness
Strategic Acceleration Bridge
Is your product ready for content provenance conformance?
An independent readiness assessment and advisory program for makers of generator and validator products: where you stand against what the industry’s conformance program evaluates today, what blocks you, and the shortest path to a submission-ready package.
Why it matters now
Supporting provenance is not the same as conforming.
Buyers and regulators increasingly look for products on the public list of conforming products, and production trust now runs through the program’s official trust list. Three questions decide how far you are from it.
- 01Do your manifests say the right things?Are manifests created at the right moment, with the required assertions, the program’s additional fields and honest AI disclosure, and readable by every other product?
- 02Can others trust your signature, and your verdict?Do you sign through the program’s official trust list with protected keys, and does your validator judge trust and report results the way the specification defines?
- 03Can you prove it, release after release?Is there an owner, a documented security architecture, an evidence package and testing that keeps you conformant as the product and the specification change?
Where do you stand today?
Six statements, two minutes. Mark the ones that are true for your product. It is useful whether or not you ever speak with us, and nothing you tick leaves this page.
0 / 6 Early
Most teams start here. The fastest win is fixing the scope: which product you would submit, as a generator, a validator or both, and at which assurance level.
Send this result to yourself or a colleague
Sign in or request an invitation
The Readiness Console is free and by invitation. Register the products you would submit, answer 28 to 46 questions written for what the program evaluates, each with the evidence that would show it, and see your readiness gates, your recommended track and your entry point into the Bridge, with AI-written playbooks and a full report.
The Strategic Acceleration Bridge
Four focus areas, built around your product
The Bridge turns readiness goals into targeted workstreams, whether you adopt the specification in whole, in part or as a reference framework. Each focus area reduces a specific risk to your product’s readiness and interoperability.
Manifest parsing and verification
Move from generic metadata to full interpretation of provenance: the manifest store, the claim, actions and signature, and signature and time-stamp validation.
The Bridge: Hands-on integration of maintained open-source libraries for the specification.
Validator experience and disclosure
Turn the interface into a clear provenance viewer, from a simple summary to the asset’s history, technical assertions and a forensic view, honest about what the signature protects.
The Bridge: User-experience advice grounded in the specification’s guidance on neutral, clear disclosure.
Resilience and soft binding
Make provenance survive real-world distribution: detect missing or stripped manifests and use watermark or fingerprint signals to recover them.
The Bridge: Evaluation and integration of soft-binding options.
Interoperability and ecosystem readiness
Make the product behave consistently with the open-source reference tool, other conforming products, the program’s test assets and standard error states.
The Bridge: Interoperability testing and remediation.
Five steps. You start where the assessment places you.
Most teams do not need every step. The Readiness Console recommends a track and the step to begin with, and the report shows why.
- 01Scoping and onboardingAgree the product scope, your chosen level of adoption, target assurance level, success criteria and a prioritized roadmap.
- 02Technical deep diveA gap analysis and validated architecture for manifests, signing, security objectives, verification and display.
- 03Implementation sprintsTargeted engineering, security and experience work to close the gaps the deep dive found.
- 04Interoperability testingTesting against the reference tool, the program’s test assets and other conforming products, with a remediation plan.
- 05Program readiness reviewIf you choose to apply: the security architecture document, sample evidence, required behaviors, disclosure layers and trust-chain checks reviewed against the published requirements.
| Readiness tier | Score | Recommended track | Where you enter the Bridge |
|---|---|---|---|
| Foundational | 0 to 39 | Foundational build | Step 1: Scoping and onboarding |
| Emerging | 40 to 59 | Discovery and roadmap | Step 2: Technical deep dive |
| Aligned | 60 to 74 | Acceleration | Step 3: Implementation sprints |
| Submission-ready | 75 to 89 | Submission readiness | Steps 4 and 5: Interoperability testing and program readiness review |
| Exemplary | 90 to 100 | Reference implementation | Reference implementation |
Readiness gates hold regardless of the score: signing with a self-signed or interim-list certificate, unprotected signing keys, a validator that trusts any signature, or public claims of conformance before listing keep you below Submission-ready until they are fixed.
Why Hkdolts
The Bridge draws on expertise at the point where content provenance, security and product strategy meet, so your plan reflects where the rules are going, not only where they are.
- Hands-on expertise in how provenance manifests, AI disclosure and trust lists work in practice, not only how they are described.
- A seat where the open rules for content provenance and digital trust are being written, so your roadmap reflects where those rules are heading.
- More than 15 years of tier-1 consulting, translating technical standards into product decisions, operating controls and accountable owners.
- Independence: vendor-neutral advice with no library, signing service or platform to resell.
Who it is for, and how to bring your team along
Who it is for
- Camera, device and chip makers adding signed provenance at capture
- Creative, editing and design software that signs what users export
- AI model and generation services that must mark AI-generated content
- News, media and content platforms that both sign and verify
- Trust, identity and security providers building validators, SDKs or signing services
Four questions for your team
Conformance touches engineering, security, product, legal and communications. Talk these through first; it makes any conversation with us shorter.
- Which of our products would we submit first, as a generator, a validator or both?
- Where do our signing keys live today, and who could use them?
- What does our product tell people when a signature is valid but not trusted, or covers only part of the file?
- What have we said publicly about our provenance support, and is it accurate?
Start with a conversation
Tell us about your product, your adoption path and your timeline. We will come back with a short note on where you would enter the Bridge, and what it would cover. We take a limited number of engagements each month; if this month is full, we will hold a place for the next.
Not sure it is the right time? Keep your self-check result. We would rather you start when it is useful than when we would like you to.
- 1You writeA few lines on your product and your timeline.
- 2We replyA short note: where you would enter the Bridge, and what it would cover.
- 3You decideGo ahead, wait for a later slot, or take the self-check result and run with it.
Common questions
Does this make our product conformant?
No. Only the body that runs the conformance program decides conformance, through its own evaluation. The Strategic Acceleration Bridge is an independent advisory program: it helps you prepare, and does not require or imply formal conformance.
Do we have to adopt the whole specification?
No. You can adopt the specification in whole, in part or as a reference framework. The Bridge is tailored to the adoption path you choose, and the readiness review applies only if you decide to apply.
Which version of the specification should we build to?
The program currently accepts products built to versions 2.2 and 2.4. Version 2.5, released in October 2026, adds formats and signing options; plan for it, and confirm which versions the program accepts before you apply.
What does the program itself cost?
The program charges no application fee and no fee for listing. Signing certificates are priced by the certification authorities that issue them; the work to get ready is yours, or your advisers’.
Is Hkdolts affiliated with the conformance program?
No. Hkdolts is independent. The Bridge is not run, endorsed or certified by the body behind the program, and nothing in it speaks for that body.
Will you try to sell us a bigger engagement?
The assessment report stands on its own. It sets out options, including doing nothing for now, and you decide whether you want help with any of them.
We build both a generator and a validator. Is that one assessment?
Yes. The combined track covers both roles, so you see one picture and one plan.
Sources
- Public list of conforming products, November 11, 2026
- European Commission, June 10, 2026
- Conformance program documents, version 0.2, July 31, 2026
The specification and the conformance program referred to on this page are maintained by an independent industry standards body. Hkdolts is independent and does not speak for it.