AI Watermarks: Text, images, and the push for provenance

AI watermarking is the practice of marking AI-generated content so that software can identify its artificial origin later.

Two technologies dominate. Invisible watermarks embed a signal directly into an image, audio file or the statistical choices behind generated text. Content Credentials attach cryptographically signed provenance information to a file. The distinction matters because neither approach is perfect on its own.

Since 2 August 2026, the subject has also become a compliance issue. Article 50 of the EU AI Act requires providers of certain generative AI systems to make AI-generated or manipulated output detectable in a machine-readable format.

For businesses that publish AI-assisted content, the practical question is no longer simply whether AI watermarks exist. It is whether the marks survive real publishing workflows, who can detect them and what the rules mean for content, marketing and SEO.

AI watermarking in short

• AI watermarking and Content Credentials are different technologies. A watermark is embedded in the content itself. Content Credentials are signed provenance metadata associated with the file.
• Article 50 of the EU AI Act applies from 2 August 2026. It introduces transparency requirements for providers and deployers of certain AI systems.
• Image watermarking is more mature than text watermarking. Images contain enough data to hide durable signals with little visible impact.
• Text watermarking is statistical. It works by influencing which words or tokens an AI model chooses.
• Rewriting remains a major weakness. A sufficiently extensive rewrite can destroy the statistical pattern used to detect a text watermark.
• Watermarks are not currently an SEO ranking signal. Google’s guidance for AI Search focuses on useful, unique and non-commodity content rather than provenance metadata.

What is content provenance?

Content provenance is the record of where a piece of digital content came from and what happened to it after creation.

A provenance system can answer questions such as:

• Which tool created this image?
• Was the file edited after generation?
• Which organization signed the provenance record?
• Is there evidence that the content originated from a particular AI system?

A watermark carries part of that evidence inside the content.
Signed metadata carries information alongside the content.

These approaches solve related problems, but they fail in different ways. That is why modern provenance systems increasingly combine them.

Why AI watermarking matters now: Article 50 of the EU AI Act

The legal urgency comes from Article 50 of the EU AI Act.

The transparency obligations under Article 50 apply from 2 August 2026. Providers of generative AI systems must take measures to ensure that AI-generated or manipulated output is marked in a machine-readable format and detectable as artificially generated or manipulated, subject to the conditions and technical limitations set out in the legislation and guidance.

Breaches of certain obligations under the AI Act can fall under Article 99, where penalties can reach EUR 15 million or 3% of worldwide annual turnover, depending on the infringement and the organization involved.

AI-generated text on matters of public interest

A separate obligation applies to organizations publishing certain AI-generated or manipulated text intended to inform the public on matters of public interest.

There is an important exception.

Disclosure is not required in the same way where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for publication.

That exception should not be interpreted as “someone clicked approve.”

The European Commission’s 2026 guidance makes clear that the nature of the review and editorial responsibility matter. For a broader implementation overview, see our EU AI Act August 2026 compliance checklist.

Alongside the legislation is the voluntary Code of Practice on Transparency of AI-generated Content, designed to help providers and deployers demonstrate compliance with Article 50.

How AI image watermarking works

Image provenance generally works through two layers:

1. a signal embedded in the image itself;
2. provenance metadata associated with the file.

They are frequently discussed as if they were the same thing, but they are not. Metadata can disappear during ordinary file handling. An embedded watermark may survive those transformations, but can be more vulnerable to deliberate attacks designed to remove or corrupt the signal.

Pixel-level invisible watermarks

Google’s SynthID is one of the best-known examples. SynthID adds an invisible signal to AI-generated media. Google says the technology is designed to remain detectable after common transformations such as cropping, filtering and lossy compression. By May 2026, Google reported that SynthID had been used to watermark more than 100 billion images and videos.

One detail is worth clarifying: an image watermark does not necessarily need to be inserted while an image is being generated. A watermarking system can also encode a signal into the completed output.

How durable are invisible image watermarks?

Invisible does not mean indestructible. Google has consistently acknowledged that SynthID is not designed to survive every possible extreme manipulation. Academic research has demonstrated the same limitation.

UnMarker, presented in the context of IEEE Symposium on Security and Privacy research, showed that targeted attacks can significantly reduce detection performance for semantic image watermarks.

MarkNull similarly demonstrates how adversarial processing can push watermark recovery towards near-random performance under certain test conditions.

The practical conclusion is not that watermarking is useless. It is that a watermark should be treated as one provenance signal, not as permanent forensic proof.

What are C2PA Content Credentials?

The Coalition for Content Provenance and Authenticity, or C2PA, was founded in 2021 by organizations including Adobe, Arm, BBC, Intel, Microsoft and Truepic. Its Content Credentials standard provides a way to associate cryptographically signed provenance information with digital media.

A Content Credential can contain information such as:

• which tool created a file;
• which organization signed the credential;
• whether edits were made;
• what other assets were used;
• which AI-related processes were involved.

This is much richer than a simple “AI generated: yes/no” label.

The weakness of metadata

The main weakness is straightforward: metadata can disappear. A social network, CMS, CDN, image optimisation service or export pipeline may remove metadata when a file is uploaded, resized or recompressed. Screenshots are another obvious example. A screenshot captures the visible pixels, not necessarily the original file’s provenance metadata.

This is why serious provenance systems increasingly combine Content Credentials with watermarking or content fingerprinting. OpenAI, for example, now uses both C2PA and SynthID for supported generated images, while supported generated audio can contain SynthID. Its public verification tooling can currently inspect supported image and audio provenance signals.

Why text watermarking is harder

Text has no pixels in which to hide a signal. An image can contain millions of values that can be adjusted slightly without a human noticing. A paragraph contains a relatively small number of visible word choices. Changing those words can directly change meaning, tone or accuracy.

That makes text watermarking fundamentally different from image watermarking.

How statistical text watermarking works

The main approach is based on the token choices made by a language model. In the influential ICML 2023 watermarking scheme described by Kirchenbauer and colleagues, a secret key is used to divide potential tokens into different groups.

The model is then subtly influenced towards particular token choices. Nothing is inserted between characters. There is no hidden Unicode string. There is no secret sentence stored in the document.

The detectable signal comes from the statistical pattern of words or tokens selected by the model.

Google DeepMind’s SynthID-Text uses a related idea. The approach was published in Nature in 2024 and evaluated at large scale on Gemini traffic.

Does Claude watermark AI-generated text?

Anthropic announced its text-watermarking approach on 14 August 2026.
The company says future Claude models will produce watermarked text and that it is also working to extend watermarking to models launched before 2 August 2026. Anthropic says the implementation is based on a version of the SynthID-Text approach and is being introduced in connection with EU AI Act compliance.

Importantly, Anthropic does not describe its watermark as proof that Claude wrote an entire document. The detector can instead estimate the likelihood that Claude was involved in producing part of the text. That distinction matters for compliance, investigations and AI-detection claims.

Does ChatGPT add a text watermark?

OpenAI currently uses provenance signals for supported generated images and audio, including C2PA and SynthID depending on the content type. Its public provenance documentation and verification tooling do not currently describe a generally deployed ChatGPT text watermark comparable to Claude’s announced statistical approach.

Claims that ordinary ChatGPT text contains a hidden Unicode watermark should therefore be treated with scepticism.

Why text watermarks break

Three limitations matter most.

1. Factual text provides fewer choices

A statistical watermark needs flexibility. When several words would all express the same idea correctly, a model can choose among them while preserving meaning. But many outputs do not provide that freedom. Consider:

Isaac Newton’s most famous work was called Principia…

If the correct next word is Mathematica, replacing it with another token simply to preserve a watermark would reduce accuracy.

The same problem occurs in:

• mathematical answers;
• names and dates;
• factual lists;
• proofreading;
• technical terminology;
• source code.

Anthropic explicitly notes that watermarking becomes sparser in factual passages and may not be applied where an exact output is required.

2. Short samples provide weak evidence

Text watermark detection is statistical. The detector needs enough token choices to distinguish a meaningful pattern from chance. A 2,000-word article provides far more evidence than a two-sentence email. Anthropic therefore warns that watermark detection does not work well on small samples.

This makes text watermarks particularly limited for:

• social posts;
• short reviews;
• short emails;
• headlines;
• product descriptions;
• brief factual answers.

3. Rewriting destroys the original pattern

This is the largest practical weakness. A light edit may leave much of a statistical watermark intact. A substantial rewrite changes the token sequence on which the detector relies. Anthropic explicitly states that a complete rewrite in which every word is replaced can remove its watermark. Independent research reaches similar conclusions.

SIRA, presented in connection with ICML 2025, demonstrated attacks against several text watermarking schemes at very low computational cost.

Earlier ICML 2024 research also examined fundamental limits on robust watermarking when an attacker can repeatedly modify text while preserving output quality.

This does not make watermarking pointless. It does mean that a text watermark should not be treated as an immutable authorship certificate.

Text versus image watermarking compared

Side by side, these are not two versions of one technique. They are different technologies with different weak spots.

Dimension	Image watermarking	Text watermarking
Main technique	Invisible image watermark, often combined with C2PA metadata	Statistical pattern in token choices
Where the signal lives	Pixels and/or attached provenance data	Word or token choices
Reliability	Strongest on supported, lightly modified files	Highly dependent on text length and entropy
Sample size	A single image can be sufficient	Longer samples generally produce more confidence
Main weakness	Metadata stripping and targeted watermark removal	Rewriting and short or factual output
Public verification	Available in some ecosystems	Still limited
Examples	Google SynthID, OpenAI, C2PA ecosystem	SynthID-Text, Anthropic’s Claude approach

The key point is that these are not two implementations of one technology. They solve the same provenance problem using very different technical mechanisms.

What AI watermarking means for businesses

The technical debate becomes much more useful when translated into operational decisions.

1. Decide your AI disclosure policy intentionally

Do not improvise disclosure decisions article by article.

Determine:

• which AI uses require disclosure;
• which content falls under Article 50;
• what qualifies as meaningful human review;
• who carries editorial responsibility;
• how disclosures should appear to users;
• how the process is documented.

Research in Organizational Behavior and Human Decision Processes suggests that disclosure itself can influence trust. That does not mean organizations should hide AI use. It means transparency policies should be deliberate, consistent and connected to genuine editorial control.

2. Put real human editorial ownership in place

For AI-generated text concerning matters of public interest, human review and editorial responsibility can be legally significant. That review should be real.

A strong process can document:

• who checked the facts;
• which sources were verified;
• who edited the draft;
• which material changes were made;
• who approved publication;
• which person or legal entity accepts editorial responsibility.

The goal is not to create paperwork for its own sake. The goal is to demonstrate that the organization has an actual editorial process.

3. Test whether your publishing stack destroys provenance

Many provenance failures are accidental. A file can start with perfectly valid Content Credentials and lose them before reaching a visitor. Test the complete publishing chain:

AI tool → file storage → image editor → CMS → CDN → website → social platform

Then download the publicly served file and inspect it again. Check especially:

• automatic image resizing;
• WebP or AVIF conversion;
• optimisation plugins;
• social-media uploads;
• CDN transformations;
• screenshot-based workflows.

4. Add Content Credentials where they provide value

Content Credentials are particularly useful when provenance itself matters. Examples include:

• news photography;
• branded campaign assets;
• product imagery;
• synthetic media;
• corporate communications;
• public-interest content.

Adobe’s Content Authenticity tools provide one route for adding and verifying Content Credentials. For commerce, the IPTC trainedAlgorithmicMedia value can also be relevant for identifying content created using generative algorithms.

But remember what provenance does and does not prove. It may tell you where a file came from. It does not automatically tell you whether the claim depicted in that file is true.

5. Do not use generic AI text detectors as proof

Generic AI detectors are fundamentally different from provider-controlled watermark detectors. They generally do not possess the watermark key used by a model provider. Instead, they estimate AI involvement based on linguistic patterns. That can produce serious errors.

Research published in Patterns found particularly high false-positive rates for non-native English writing. If the origin of important content needs to be known with confidence, document the system and workflow that produced it rather than relying entirely on a detector after publication.

6. Build a documented AI content workflow

For many companies this is more valuable than buying another detection tool. Record:

• which AI models are approved;
• which teams use them;
• what data may be entered;
• when output requires human review;
• which content requires disclosure;
• how provenance information is retained;
• who signs off on publication;
• where evidence of review is stored.

This makes compliance, quality control and audits easier. It also reduces ambiguity when AI use becomes part of everyday operations.

AI content, SEO and generative search

AI has made fluent text extremely cheap to produce. That changes what is scarce. Perfect grammar is no longer an advantage by itself. Neither is publishing another competent summary of information already available on hundreds of websites. What becomes more valuable is information that cannot easily be recreated from the existing web.

Examples include:

• original research;
• first-party data;
• expert analysis;
• customer cases;
• proprietary benchmarks;
• hands-on testing;
• screenshots of real processes;
• unique comparisons;
• clear opinions backed by evidence;
• named authors with demonstrable expertise.

Google’s current guidance for AI-powered Search explicitly encourages unique, valuable and non-commodity content. That is also a sensible strategy for generative engines. If an AI system can answer a question entirely from ten interchangeable pages, there is little reason for it to select yours.

Give search engines and generative systems information that is specific enough to quote, verify and attribute.

Conclusion

AI watermarking is moving from research into infrastructure and regulation. For images, the ecosystem is becoming increasingly mature. Invisible watermarks such as SynthID can complement signed C2PA provenance information and public verification tools.

Text is more difficult. Statistical watermarking can provide evidence that a model was involved in writing a sufficiently long passage, but short samples, factual output and rewriting limit how reliable that signal can be.

For businesses publishing content at scale, the practical priorities are straightforward:

1. know which AI systems you use;
2. understand which outputs are marked;
3. stop your own publishing stack from removing provenance;
4. establish genuine human editorial responsibility;
5. document your AI content workflow;
6. treat AI detectors as signals, not proof.

If you want to understand how your current AI workflows compare with Article 50 and the wider EU AI Act, an AI Assessment can identify your main opportunities, risks and compliance gaps.

For organizations that need help designing governance, processes or implementation, our AI Consultancy team can help put those requirements into practice.

Frequently asked questions (FAQ) on AI Watermarks