How can a PDF reveal it was generated with AI?

Through its metadata. AI assistants and their export pipelines write identifiable traces into document properties: an Author field naming the AI tool, Creator/Producer strings from generation libraries (ReportLab, WeasyPrint, Pandoc and similar), creation timestamps seconds apart from modification, and no human editing history. Individually each field is mundane; together they are a recognizable fingerprint.

Do ChatGPT and Claude really put their names in exported files?

Often, yes. Files exported from AI assistants or generated through their code tools frequently carry the assistant's name in the Author field, or the generation library's name in Creator/Producer. We have seen PDFs with Author set to the AI tool and Producer identifying the exact library that rendered the file.

Can documents contain C2PA content credentials like images do?

The C2PA standard is most established in images today, but AI-generated images embedded inside PDFs, decks, and Word files keep their content credentials. A 'human-written' report whose hero image carries a DALL-E manifest still reveals AI involvement. PrivyClean detects C2PA and AI markers in the document and its embedded media.

Is it wrong to remove AI traces from my documents?

Context decides. Your internal drafting workflow is legitimately private — like editing history and author names, which professionals have scrubbed for decades. But where AI disclosure is required by your client agreement, employer policy, or regulation such as the EU AI Act, removing markers does not remove the obligation. Inspect first, know what the file says, and act within your obligations.

How do I check a document for AI metadata?

Open it in PrivyClean. The inspection view groups AI and provenance markers separately — an 'AI Fingerprint Detected' flag with the exact fields that triggered it: author strings, generator libraries, timestamps, and any C2PA data in embedded images. You see precisely what a recipient could find before deciding what to do.

Does this work for Word and Excel files too, or only PDFs?

PDF, DOCX, and XLSX. Office files generated by AI pipelines carry equivalent traces in their document properties and application fields, and PrivyClean inspects and cleans all three — entirely offline.

AI Metadata in Documents — What Your PDF Reveals About How It Was Made

AI metadata in documents: what your PDF reveals about how it was made

Everyone knows AI images carry hidden labels. Almost nobody checks their documents. A report drafted with an AI assistant and exported to PDF can name the AI tool in its Author field, identify the generation library in its Producer string, and carry C2PA credentials inside its embedded images. Your deliverable may be quietly documenting your entire workflow — here is how to see it and control it.

Last updated: July 2026 · By Wiktor Tendera

The fingerprint, field by field

We routinely inspect AI-exported PDFs whose metadata reads like a signed confession — for example an Author field set to "Claude" and a Producer of "ReportLab PDF Library". The typical traces:

Author / Creator fields naming the AI assistant or left conspicuously unset where a human author's name would normally be.
Producer strings from generation toolchains — ReportLab, WeasyPrint, wkhtmltopdf, Pandoc, python-docx — libraries humans rarely use directly, but AI code pipelines use constantly.
Timestamps with no history — created and modified within the same minute, revision count of one. Human documents accumulate editing sessions; generated ones appear fully formed.
C2PA credentials in embedded images — the chart or hero image made with DALL-E or Firefly keeps its content credentials inside your PDF or deck.

PrivyClean for Mac flagging a PDF with 'AI Detected — AI Fingerprint Detected': the Author field reads Claude and the Producer identifies the ReportLab PDF generation library

Who should be checking

Consultants and agencies — a client-facing report whose metadata names an AI tool tells a story about your process and your hours that you did not choose to tell.
Product managers and engineers — specs, memos, and analyses drafted with AI assistants and exported straight to PDF carry the pipeline's fingerprints by default.
Anyone under disclosure rules — the flip side: if your context requires AI disclosure (client contract, journal, employer policy, or the EU AI Act), you need to know what your files claim before someone else inspects them.

Check your documents for AI fingerprints

PrivyClean detects AI markers in PDF, Word, and Excel files — author traces, generator libraries, C2PA in embedded images — and cleans what you choose. 100% offline.

3 free cleans to try · iPhone $7.99 · Mac $14.99 one-time

Inspect first: the honest workflow

Drop the file into PrivyClean. Documents with AI traces get an AI Fingerprint Detected flag, with the exact fields listed — which author string, which producer library, which embedded image carries credentials.
Decide with the facts. Sometimes the right move is removal (a false impression of pure automation on heavily human-edited work, or workflow privacy for internal tooling). Sometimes it is disclosure. Either way, you decide — not your export pipeline.
Export a cleaned copy when removal is the call. Author traces, generator strings, timestamps, and embedded-image credentials are stripped; items that cannot be safely removed are flagged, not hidden. The original stays untouched.

PrivyClean for Mac after cleaning a batch of files, showing the metadata removed from each document

Where this is heading

Provenance metadata is expanding from images into everything else. The EU AI Act's transparency rules (August 2026) push machine-readable AI disclosure across content types, and the C2PA coalition — Adobe, Microsoft, Google, OpenAI — is extending credentials beyond photos. Documents are next. The professionals who do well in that world are the ones who know what their files say before sending them — which has been the point of document metadata hygiene all along.

Related guides

Important: where AI disclosure is required by contract, policy, or regulation, removing metadata does not remove the obligation. PrivyClean exists to show you what your files reveal so you can act deliberately and within your obligations.