What is text watermarking?

On 2 August 2026 a short paragraph of the EU AI Act came into force and asked AI companies to do something slightly magical: make their text recognisable as AI-generated, by machines, without any human noticing a thing.

Article 50 says providers must mark their systems’ output in a machine-readable format and make it detectable. A Code of Practice published in June sets out how, with at least two layers of marking where needed, such as signed metadata plus an invisible watermark. About 190 organisations have signed it, including OpenAI, Google, Anthropic, Microsoft, Meta and Mistral. Fines can reach €15 million or 3% of global turnover.

The Act also asks something of people who publish AI-generated text to inform the public on matters of public interest: they have to label it, unless a person has reviewed it and taken editorial responsibility.

How do you hide a mark in words?

Pictures can carry metadata. Text has nowhere to keep it. Copy a paragraph into an email and anything attached to the original file stays behind, so the mark has to live in the words themselves.

Here’s the trick. When a model writes, it doesn’t pick one inevitable next word. It weighs dozens of plausible ones. “The meeting was moved to Tuesday” and “the meeting was shifted to Tuesday” are both fine. A watermarking system uses a secret key to nudge those choices very slightly, again and again, in a pattern that means nothing to a reader and a great deal to a detector holding the key. Google DeepMind’s version, SynthID Text, was published openly in 2024. Anthropic’s watermark for Claude is based on it. OpenAI’s is called textGrain.^*

Who’s doing what

Anthropic says every Claude model released after 2 August carries a watermark, worldwide and with no opt-out, and older models will follow over the coming months. OpenAI announced on 5 October that it is adding a watermark to ChatGPT and Codex text in the EU only, and isn’t making it a global default. Both say the mark identifies nothing about you or your conversation, only that their model probably wrote the text. Neither offers a public checker. Detection is limited to researchers, regulators and similar organisations, case by case.

What it can’t do

A watermark is a statistical signal, not a signature. It gets weaker as text gets shorter, more factual or more edited. In OpenAI’s tests, swapping a quarter of the words for synonyms cut detection to about 17%. Heavy paraphrasing and translation can wash it out, and code carries it only faintly. Anthropic also warns of the opposite problem: human writing that a model has summarised or translated can pick up a signal of its own.

Can you remove it?

Partly, by rewriting, which is rather the point. Text that a person has properly rewritten is, more and more, that person’s text. What you can’t do is remove it by tidying up. A watermark isn’t a hidden character or a stray bit of formatting, so text cleaners, ours included, leave it exactly where it was.^†

1. * Nobody has explained the name. It sounds like a breakfast cereal for printers. ↩
2. † This post was drafted by Claude and edited by a human, so it may well be carrying one. If you’re reading it with a detector: hello. ↩