From Preserving Documents to Preserving Evidence

Peter Wyatt is worth planning a conference day around. Having missed him once before, I made sure to attend his PDF/A tutorial at iPRES 2025 in Wellington. He began by describing PDF as a container, then returned throughout the session to a simple point: you cannot preserve what you do not understand. I wrote about the session for MetaArchivist that week. A year later, I’m still thinking about it.

The Digital Preservation Coalition has chosen “Save Our Stories: Our Digital Heritage in Danger” as this year’s theme for World Digital Preservation Day, and the PDF community has earned its share of the celebration. PDF/A has been an ISO standard since 2005; in that time, it has turned long-term rendering from a hope into something close to an engineering discipline, backed by validators, test suites, and a great deal of unglamorous committee work.

PDF/A promises that a file will render. It makes no promise that the file will serve as a good record, and a file that renders perfectly can still make a poor one.

ISO 15489-1:2016 defines a record as information “created, received and maintained as evidence and as an asset by an organization or person, in pursuit of legal obligations or in the transaction of business” (3.14). Archivists fixate on the word evidence. Content and appearance can survive intact while the context that made a document trustworthy (who issued it, under what authority, in what relation to the files around it) falls away.

PDF/A comes in several parts, and parts 1 through 3 each define conformance levels. Level b (“basic”) guarantees only that the page can be reproduced reliably. Level a (“accessible”) adds logical structure and tagging. Level u, in parts 2 and 3, requires text to map to Unicode. So level b promises exactly what it sounds like: the page, and nothing more.

Take a decision memo from some federal agency, saved as PDF/A-2b, and hand it to a researcher in 2076. The glyphs will all be there. Who approved it, though? Was it the final version? What analysis was it built on? She may have no way to find out. The file came through fine; a good chunk of the record didn’t.

It’s late on Friday, and the document is finally done. A large language model drafted it, a second AI tool condensed it, and a staff member made a few edits before heading home. It’s saved as PDF/A, passes validation, and moves along. The job is finished.

Then somebody pulls it out twenty years later. It opens fine, but what did the AI tools leave out? What did the staffer actually check? There’s no telling from the page. PDF/A held up its end of the bargain. Whether we kept enough to answer those questions depends on us.

Who supplied the source material? What did the AI tools change, and what got left out? Did anyone check the memo before it went out, and did the approver have the authority to do so? If someone needs to rely on that memo as evidence years from now, we owe them enough of its history to answer those questions. Keeping the page gets us part of the way. We also have to keep what they’ll need to make sense of it and decide whether to trust it.

That is where the Coalition for Content Provenance and Authenticity (C2PA) becomes interesting to people in my line of work. Its specification lets a creator attach signed, tamper-evident assertions about an object's origin and how it was edited, presented to the public under the name Content Credentials. PDF has been among the supported formats from early on, with the manifest stored as an embedded file, and ISO/TC 171/SC 2/WG 13 is now developing ISO/TS 32008 to define extensions specific to PDF.

So there are three layers. PDF/A keeps the thing renderable. C2PA documents claims about where it came from. Records management, the focus of SC 11, where I serve as a U.S. delegate, determines whether all of that counts as evidence. A valid signature proves an assertion hasn’t been tampered with since someone signed it. It does not establish whether the assertion was true, whether the signer had authority to sign, or whether relevant information was omitted.

C2PA’s own explainer makes the same point: it checks whether provenance information has been altered and whether it belongs to the file. It does not establish whether the content is true.

Those checks also have to work over time. Signing certificates expire, trust lists change, and today’s validation software may not run in 2046. An archive needs to preserve both the credential and the information and tools needed to check it. Otherwise, it may retain a claim about the file’s history without being able to verify it.

Which AI model was used, what was it asked to do, and what did a person check or change? Researchers call this paradata: information about how a document was made and revised. It may be kept outside the PDF or its manifest, but it needs to stay linked to the document so future readers can follow how it was produced.

The PDF and records communities already have a history of working together. PDF/A has long been developed through a joint ISO working group bringing together TC 171/SC 2, TC 46/SC 11, TC 42, and TC 130. Similar cooperation is taking shape around content provenance outside ISO. The Library of Congress has convened a community of practice to examine C2PA for government, libraries, archives, and museums, while the news industry, through IPTC, is already helping shape technical specifications and implementation practices. The archival community is not arriving late to this conversation. It has been asking questions about provenance and authenticity for generations. The opportunity now is to bring that experience more directly into the conventions governing Content Credentials, particularly where a technically verifiable file must also serve as a trustworthy record.

So by all means raise a glass to PDF/A on November 5; it remains one of the real success stories in digital preservation. Then ask what else has to travel with the file, so that someone fifty years from now can open it and also have reason to believe it.