A blue magnifying glass over rows of abstract ink marks on a white page reveals a bell curve and a vertical capped error bar, with blue and amber dotted waves along the page edges.

Invisible text watermarking has spent ten strange weeks becoming normal. The EU AI Act's Article 50 transparency obligations became enforceable on 2 August 2026. On 14 August, Anthropic announced that every Claude model released on or after 2 August 2026 embeds a SynthID-Text-style watermark in all generated text — default-on, applied worldwide because the company says it lacks durable region scoping. On 5 October, OpenAI announced "textGrain": a worldwide opt-in API switch, live that day, off by default on select models, plus an invisible watermark coming to eligible ChatGPT and Codex EU output "over the coming weeks." The Commission's own FAQ gives systems already on the market before 2 August until 2 December 2026 to meet the marking duty.

So the marks are shipping — and what they can prove is far narrower than the arguments about to use them.

What an AI text watermark actually is

It is not a visible label, a stamp, or file metadata. In the SynthID-Text method Google DeepMind published in Nature in 2024 — the approach Anthropic says it uses, descending from a 2022 proposal by Scott Aaronson — the model biases its own low-risk token choices: the places where the next word barely changes meaning, where "the" versus "a" is nearly free. That bias is invisible to readers and statistically detectable by a tool built to look for it. Because the mark lives inside word choice itself, Anthropic describes its code output as minimally watermarked by design: code has fewer free slots.

What the vendors themselves say it does not prove

OpenAI's announcement is unusually blunt about the limits. In the company's own description, the watermark does not measure human contribution, establish ownership or responsibility, identify the user, account, or prompt, or verify accuracy. And the item that belongs in every argument starting this semester: the absence of a watermark does not prove human authorship.

The vendors' own error bars are the story

OpenAI also published its detection numbers, under stated conditions: roughly a 1 percent false-positive rate, English text, evaluations derived from ELI5-style passages. At those conditions, detection reaches about 80 percent on 200-token passages and about 95 percent on 400-token ones, and the company says it falls substantially for mathematical text. Then the editing numbers: replacing 10 percent of words with synonyms drops 400-token detection from around 92 percent to 66 percent; replacing 25 percent drops it to 17 percent. These are vendor self-reports, not independently verified accuracy claims. They show that performance changes across the company’s specified passage lengths, mathematical-text caveat, and synonym-edit tests; they do not establish a categorical rule for every short, technical, or edited draft. A positive result is a statistical likelihood under one vendor's test conditions. A negative result is not proof of human authorship.

The tools to check are deliberately scarce

The asymmetry nobody can pretend away: no open public tool verifies any of these marks. OpenAI says detector access is limited to approved researchers and expert organizations, by application. Anthropic's detection API is reportedly in private preview. Google has run SynthID in Gemini consumer products since 2024; public verification pages from the vendors still cover images and files, including C2PA content credentials. If a classroom, newsroom, HR department, or comment section receives a detector-based accusation, one risk is that the tool presented as decisive may be a third-party detector rather than the intended verifier of the mark. That is a scenario to test, not a claim about how often it happens.

The labeling half, for people who publish

The other half of Article 50 is not about watermarks. The Commission's FAQ describes duties for deployers to label deepfakes and AI-generated text published for the public interest — with an exception where the content underwent human review or editorial control. Whether any particular blog outside the EU is in scope is a legal question, and this is not legal advice — the honest posture is "here is how the Commission describes the rule." The stakes, as law-firm analyses of the Act's penalty provisions read them, run to the greater of €15 million or 3 percent of worldwide annual turnover. A Code of Practice on Transparency of AI-Generated Content, published 10 June 2026 and assessed adequate by the Commission and the AI Board, counted roughly 190 signatories by end of July 2026 — Anthropic, Google, Meta, Microsoft, Mistral, and OpenAI among them.

The argument already on the table

Not everyone accepts statistical watermarking as the right transparency mechanism. A September 2026 arXiv preprint, "Watermarks Without Verification" — explicitly not a systematic survey — argues that claims about deployed systems need independently verifiable access and institutional governance. Its experiments concern open-weight reference systems, not independently tested deployed Claude or Gemini systems. The paper distinguishes watermark persistence under light editing from removal under paraphrase or more substantial rewriting. Its governance argument is an attributed, non-peer-reviewed contribution to the debate, not an established measurement of production tools. The broader trust question is editorial interpretation, not a result the paper itself measures.

The AI Text Provenance Triage Card

Keep this for the day the question lands on you.

Column 1 — Someone says a detector flagged your text. Ask four things: Which detector — the model vendor's own, or a third party? How long was the text? What false-positive rate does it report? Was the text edited at all? A positive result is a statistical likelihood under one vendor's published conditions, not proof. A negative result does not prove human authorship — in the vendor’s own description. Ask for the conditions: OpenAI reports about 80 percent detection on 200-token English passages derived from ELI5-style evaluations, and 66 percent after 10 percent synonym replacement on 400-token passages. Those figures make categorical claims about all short, technical, or edited text unwarranted. Nobody gets to end the conversation with a detector verdict.

Column 2 — You publish AI-assisted text. Start with readers, not regulators: visible disclosure is an editorial-trust decision everywhere today. Then, if you publish text of public interest toward EU audiences, walk the path the Commission describes for deployers: label it, or rely on the human-review-or-editorial-control exception. Either substantive human review by qualified people, or editorial control by a responsible entity able to approve, alter, or reject substance, removes duty; spell-check-only passes do not count. If that starts to feel like a legal question, it is: this is what the Commission describes, not advice. Old drafts are not retroactively affected, and systems placed on the market before 2 August 2026 have until 2 December 2026 for machine-readable marking.

Column 3 — You build with model APIs. Current marking defaults, per each vendor's own announcements: OpenAI — API watermarking is opt-in, off by default, on select models; EU ChatGPT and Codex output gets watermarked over the weeks after 5 October. Anthropic — default-on for models released on or after 2 August 2026, applied globally for lack of durable region scoping, code minimally marked by design, detection API in private preview. Google — SynthID-Text in consumer Gemini products since 2024, with an open-source reference implementation. For files rather than chat text, C2PA content credentials are the metadata-based alternative: they travel with the file and describe the pipeline; they do not touch word choice.

The narrow version

The double negative in the title is the finding. A watermark signal may indicate model generation or processing/involvement under the vendor’s limited, stated conditions; it does not establish that a particular model family wrote a passage. What it cannot say — what no announced system claims it can say — is who is responsible, how much a human shaped, or whether any human did. The fights ahead will happen entirely inside that gap. The side that reads the error bars first wins more of them.

Sources