Image authentication for enterprises: the four levels that secure your visual assets
In 2024 alone, AI tools generated more than 15 billion images, more than every photograph produced by cameras in the first fifty years of photography. For anyone who manages enterprise visual assets, claims adjusters, brand managers, news desks, quality leads, this is no longer an aesthetic problem. It is a structural one: every image entering a document workflow may not match the reality it claims to represent.
The market’s first reaction was to invest in AI detection: software that tries to recognise whether an image is generated or manipulated. The University of Edinburgh study published in late 2025 shows that even the most recent detection tools still record false positive rates around 15 percent, and every new generative model widens the gap again. It is an unequal race: whoever generates an image always has a structural advantage over whoever tries to recognise it.
The alternative is to change the plane of the problem. Instead of asking whether an image is fake, enterprise image authentication establishes in a verifiable way when, where, from which device and with what characteristics the image was captured, fixing those facts at the source. This article describes the four operational levels of image authentication, when each level is required, and how TrueScreen covers all four by integrating them into the capture flow itself.
What image authentication is, and why detection alone is not enough
Image authentication is the process that establishes the authenticity of an image independently of the subject it depicts. It does not answer the question “is this photo real?” but four operational questions: who captured it, with which device, at what moment, and whether it has been altered after capture. The probative value of a visual asset depends on the answer to these four questions, not on the eye of the observer.
AI detectors work on the opposite plane: they analyse pixels to identify artefacts typical of generative networks. This is a reactive approach with three structural limits. The first is the false positive rate: the Edinburgh benchmark records around 15 percent errors even on recent models. The second is lag: every time a new generative model is released, detectors must be retrained. The third is defensibility: in a dispute, the probabilistic evaluation of a detector is more contestable than the objective proof of a tracked acquisition.
For an enterprise managing document workflows with probative value, insurance claims, regulated communications, expert reports, brand assets, the difference is economic. Source-side authentication turns the cost of verification from variable, post-hoc audits, disputes, litigation, into fixed, configuration of the capture flow. For organisations processing tens of thousands of images per month, the break-even point is reached within a few months.
How this differs from AI detection
Detection tries to discover a fake after the fact; authentication fixes the truth at the moment of capture. The practical consequence is that, in a structured organisation, the two technologies are not alternatives but complementary: detection can be an internal triage tool for images coming from third parties without an authenticated channel, while source-side authentication remains the tool for every image generated in-house or by approved vendors.
The four levels of image authentication
Image authentication is not a single check: it is a scale of progressive guarantees, each with its own field of application. The four levels below are ordered by increasing robustness. Each one requires more technical effort than the previous one, and each one answers a stricter probative question.
| Level | What it guarantees | When it is enough | When it is not |
|---|---|---|---|
| 1. EXIF metadata check | Coherence between declared capture data and file | Internal triage, low-risk archives | Disputes, policies, court evidence |
| 2. Integrity hash | Immutability of the binary over time | Internal retention, audit trails | When a certified date is required |
| 3. Qualified timestamp | Existence of the file at a moment with legal value | Regulated communications, compliant retention | When location and device must also be proven |
| 4. Forensic chain of custody | Capture, device identity, geolocation, digital seal | Claims, expert reports, brand assets, disputes | This is the complete level |
Level 1: EXIF metadata verification
EXIF metadata are the information the camera writes automatically into the file: date, time, device model, capture parameters, in some cases GPS coordinates. Verifying EXIF coherence is the baseline level of image authentication: it is free, immediate and supported by any photo management tool. It returns a first filter for obvious anomalies, such as an image declared “taken today” with EXIF showing a date three years old, or a device that does not exist.
The limit is just as obvious. EXIF metadata can be modified in seconds with consumer tools: anyone can change date, device or GPS. Furthermore, every pass through a messaging platform or social network strips or rewrites the metadata. For an enterprise, level 1 is useful as internal triage or for archives of low probative risk (internal product photos, marketing repositories). It is not enough when the image must support a legal or insurance claim.
Level 2: integrity hash
A cryptographic hash (SHA-256, SHA-3) is a fixed-length string that uniquely identifies a binary file. Modifying even a single bit produces a completely different hash. Generating the hash at the moment of capture and storing it separately allows, at any later point, verification that the file has not been altered.
Level 2 answers the question “is this file today identical to what it was when it was captured?”. It does not answer “when was it captured?”. The hash on its own does not date anything: it certifies only the identity of the binary. That is why it is the indispensable technical foundation for levels 3 and 4, but not self-sufficient for evidentiary use. Enterprises typically use it for internal audit trails and document retention, where the date declared by the internal system is already accepted by the counterparty.
Level 3: qualified timestamp
A qualified timestamp, under Regulation (EU) 910/2014 (eIDAS), associates the hash of the file with a moment certified by a Qualified Trust Service Provider. The time reference has legal value across the European Union and is enforceable against third parties: nobody can claim the file was created at a different moment without rebutting the QTSP attestation.
Level 3 is the first that produces an asset enforceable in court or before a supervisory authority. It is the level required for compliant document retention, for regulated communications (MiFID II in financial services, equivalents in healthcare and pharma), and in general every time the “certified date” of the file is part of the object of proof. Yet when the probative value also depends on who captured the image and where, the timestamp on its own is not enough: those facts must also be fixed at the source.
Level 4: forensic chain of custody
Level 4 is the combination of tracked capture, device identity, certified geolocation, hash, qualified timestamp and qualified digital seal. The international reference standard is ISO/IEC 27037, which defines good practice for identification, collection, acquisition and preservation of digital evidence admissible in court.
Level 4 authentication occurs when the image is captured through an app or integrated system that, in the same act, records the event, computes the hash, obtains the qualified timestamp, fixes GPS coordinates and device identity, and applies a qualified digital seal. The result is a self-sufficient asset: proof of its authenticity does not depend on the storage context nor on later witness statements. It is the level required for insurance expert reports, claims, brand assets of reputational value, disputes and any flow where the image may be contested.
Choosing the right level: a decision framework for the enterprise
The choice of authentication level is not technological, it is evidentiary. It rests on a single question: in case of dispute, what must I be able to prove? The framework below crosses the type of visual asset with the probative risk to indicate the minimum defensible level.
- Internal product photos, marketing, creative archives: level 1 is sufficient for triage. Probative risk is marginal and internal approval flows handle anomalies.
- Internal documentation subject to audit, compliant archives: level 2 as the baseline, level 3 when certified date is part of the object of audit (for example: evidentiary records for quality certifications).
- Regulated communications, compliant retention, content for supervisory authorities: level 3 is mandatory. Sectoral regulations (financial services, healthcare, public administration) require qualified timestamps. A working example is certified MiFID II communications.
- Insurance claims, expert reports, brand assets, disputes: level 4 is mandatory. The presence of a counterparty interested in contesting the image imposes a forensic chain of custody. We have covered the brand angle in digital evidence for brand protection; the insurance angle in legal protection insurance.
The critical jump is between level 3 and level 4. Level 3 can be added to a file after the fact, applying a timestamp to a binary that already exists. Level 4 cannot: chain of custody, device identity and geolocation can only be fixed at the moment of capture. That is why every enterprise flow that may generate disputes must be designed for level 4 from the start.
What it means to authenticate images at the source with TrueScreen
Source-side authentication is the process that fixes origin, integrity, device, location and digital seal of an image at the exact moment it is captured, before the file leaves the device. TrueScreen is the platform that integrates the four levels of image authentication in a single flow, applying forensic methodology to every capture and producing an asset that is enforceable in court. The principle is structural: turn authenticity from a problem of later verification into a property of the file from its creation. It is the same principle of Digital Provenance applied to the image domain.
The TrueScreen flow includes four components that operate sequentially in the same act of capture: registration of the event with session metadata, computation of the cryptographic hash on the original binary, application of qualified timestamp and qualified digital seal through a Qualified Trust Service Provider, fixing of GPS coordinates and device identity. The result is a visual asset that satisfies level 4 of image authentication without any after-the-fact intervention.
Capture app on mobile devices
The TrueScreen app is the tool for operational teams that capture images in the field: claims adjusters, technicians, inspectors, sales agents, quality officers. The app replaces the device’s native camera: every shot is captured, sealed and geolocated in a single act, with no manual step required. An adjuster photographing a claim no longer has to remember to fill in a metadata form, save the file in a specific folder or sign a paper form: everything happens at the moment of capture.
SDK to embed authentication into enterprise applications
When image authentication has to be part of an existing enterprise application, a claims management app, an onboarding portal, a technical documentation system, the TrueScreen SDK embeds the certified capture flow directly into the product’s user experience. The result is a coherent experience for the end user, while the enterprise obtains level 4 visual assets without having to manage the integration with a Qualified Trust Service Provider or build internal cryptographic infrastructure.
Workflow for operational teams and document flows
For organisations that capture high volumes of images with structured processes, news desks, insurance carriers, brand departments, panels of expert appraisers, TrueScreen offers a complete workflow that handles assignment, execution, verification and archiving of captures. An insurance carrier processing 50,000 claim photos per month can replace post-hoc authenticity assessment with source-side certification through the app, lowering the unit cost of verification and shortening claim settlement time.
The regulatory frame for enterprise image authentication
For a European enterprise, image authentication is not only an operational choice, it is an obligation that crosses three main regulations, each with its own scope.
Regulation (EU) 910/2014 (eIDAS) defines the legal effects of qualified trust services, including timestamps and electronic seals. A qualified timestamp “shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound” (art. 41). It is the European cornerstone of evidentiary value for digital files.
The AI Act (Regulation (EU) 2024/1689), in article 50, sets labelling obligations for content generated or modified artificially: enterprises must ensure that AI-generated content is recognisable as such. Source-side image authentication, applied to authentic content, is the symmetric complement: it gives real content a verifiable distinctive trail that separates authentic assets from the flow of generated content.
Standard ISO/IEC 27037:2012 defines good practice for identification, collection, acquisition and preservation of digital evidence. It is the international reference for the forensic chain of custody and is cited in operational protocols of expert appraisers, courts and supervisory authorities. An image authentication flow that complies with ISO/IEC 27037 is defensible in any jurisdiction that recognises the standard. The NIST framework on digital evidence aligns on the same principles for the United States.
How to start implementing image authentication
The transition from analysis to deployment requires three operational decisions, in this order.
- Mapping of visual flows with probative exposure: identify enterprise processes where images may become objects of dispute. Claims, brand assets, regulated communications, expert reports, technical documentation with contractual value.
- Assignment of the minimum level for each flow: apply the decision framework (levels 1-4) to each identified flow. Concentrate investment on flows that require level 4, leave the lower levels for the others.
- Choice of integration: standalone app for independent operational teams, SDK to embed in an existing enterprise application, structured workflow for high volumes. The choice depends on the desired user experience and the scale of image volume.
Gradual rollout is a feature of the project: there is no need to cover every flow at once. Start from the flow with the highest probative exposure, measure the reduction of verification cost and processing time, then extend to the other flows. For a deeper application to legal and insurance use cases, see our dedicated insight on forensic image authentication for legal and insurance enterprise use.
