Metadata is a file's statement about itself. A statement is worth reading and is not proof. It is easy to remove and easy to rewrite, so what it means when present and what it means when absent have to be thought about separately.
Device, lens, exposure, time, sometimes location. When those values agree with each other and with the quantisation table and thumbnail structure that model actually produces, they argue for a human capture. They only mean something once that internal agreement has been checked.
Almost nothing. Messengers and social networks strip metadata on upload. Measured across 75 real camera photographs, 40 raised a missing-metadata signal. Treating absence as evidence of AI puts half of all ordinary photographs under suspicion.
Anyone can edit EXIF. So what matters is not the values but the contradictions between them: a capture time that does not fit the file structure, a thumbnail no such model would write, or an editor's traces sitting alongside capture information.
A signature. A C2PA manifest fails verification when the content changes, which makes it stronger than a bare statement. But a signature still needs its signer checked separately, and without that check it is no more than a statement either.
This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.