A Big One

Adobe’s May 15 revision to its Generative AI User Guidelines makes three changes, and the one worth dwelling on is good news.

Adobe rewrote how it treats Content Credentials, the provenance metadata that records what was made or modified by AI, and stopped treating it as an optional label. Under the new Guidelines, credentials are meant to stay attached to the work. For creators who have watched their attribution and their proof of authorship vanish the moment a file leaves their hands, that is a meaningful upgrade. The same revision quietly deletes two clauses creators had relied on, the training restriction and the commercial-use grant, which cut the other way and are covered below.

In human terms: A documentary editor uses Adobe Firefly for a handful of illustrative graphics. Under the new Guidelines, the Content Credentials on those graphics are part of the deliverable rather than a detachable afterthought: they record what was AI-generated, what she modified, and that the work originated with her. When the piece is questioned later, or when a still circulates out of context, the provenance travels with the file and answers for itself. The remaining frontier is the platforms that still strip credentials on upload. Adobe alone cannot force them to stop, but by making preservation the default expectation for everyone using its tools, it turns credential-stripping from an invisible technicality into a conspicuous gap that platforms will increasingly be asked to close.

Why this matters: The headline change is a win for creators. Content Credentials are becoming a durable, tamper-resistant claim to authorship, and Adobe has moved them from a label it offers to a standard it expects everyone in its ecosystem to keep intact. The real prize is downstream: a provenance norm strong enough that the platforms stripping credentials on upload become the outliers under pressure, rather than the silent default. The deleted training and commercial-use clauses are a real cost and worth raising with clients. But the structural story this week bends toward creators, provided the rest of the pipeline follows Adobe’s lead on keeping provenance attached.

Details: Content Credentials are, in effect, a creator’s receipt. They ride inside the file and record origin, authorship, and which generative steps were involved. For a working creator that is worth a great deal: durable attribution that survives a repost, a defense against AI work being passed off as someone else’s or someone else’s being passed off as theirs, and a verifiable answer to the question every client and newsroom is starting to ask, which is simply where did this come from.

The prior Guidelines said only that Adobe “may attach or publish Content Credentials for content created with generative AI features to let people know it was generated with AI.” That was provenance as a courtesy. Adobe might label the work; you were free to do as you liked with the label. The new Guidelines widen the scope to content “created or modified” with AI features and add a sentence with teeth: “You must not remove, alter, or disable any Content Credentials.” Provenance is no longer something Adobe offers and then forgets. It is part of the work, and it is meant to stay.

That Adobe is the one making this move is what gives it reach. Adobe sits at the intersection of creative tooling, enterprise publishing, journalism, and ad production, and it helped write the underlying standard through the Content Authenticity Initiative. When the company at that intersection treats credential preservation as non-negotiable, it sets the expectation the rest of the pipeline gets measured against. The direction of travel is what matters for where the burden lands. Today the stripping happens silently at the distribution layer and creators absorb the loss. As preservation becomes the norm in tools and contracts, and as labeling and transparency rules increasingly attach to whoever distributes content, the obligation to keep credentials intact moves toward the platforms doing the stripping. That is the version of this story creators should want: not one more thing the creator has to police, but a standard strong enough that the platforms have to honor it.

One honest caveat keeps this from being a clean victory lap: As written, the duty not to remove or disable credentials binds the people using Adobe’s features, which means a creator could be the party technically in breach if credentials disappear downstream through no act of their own. The protection becomes airtight only when the preservation obligation reaches the platforms themselves. Adobe’s move is the wedge, not the finish line, and it is the strongest signal yet that the finish line is where the industry is heading.

The two deletions are the genuinely mixed news, and the first is on us. Adobe removed Section 1 in full, the clause requiring that AI features be used “only for your creative and productivity work product and not to train artificial intelligence or machine learning models,” along with the broader bar on using outputs to “create, train, test, or otherwise improve” any AI system. Three weeks ago we reported that this rule had not changed and told readers to move along. That line aged poorly. Section 8 is also gone, the sentence that said “you may use outputs from generative AI features in commercial projects”; the new Guidelines neither grant nor deny commercial use, and the pointer to the Product Specific Terms, where the $10,000 Firefly indemnification cap lives, has been removed as well. Those are losses of clarity, and they sit oddly beside a provenance change that pulls in the creator’s favor.

The revision also adds a new Section 3 for features users build on top of Adobe’s tools, such as customized assistants, barring configurations that “Simulate a human-like emotional relationship with a user,” “Cause or exacerbate a physical or psychological condition,” or “Make decisions related to employment, education, access to essential benefits or services (such as housing), or the administration of justice.” That is the EU AI Act’s prohibited-practices register, exported worldwide, and on balance it reads as guardrails rather than a grab.