Executive signal. A quiet change in the machinery of generative AI is becoming visible at the policy layer. Since the European Union’s Article 50 transparency obligations became applicable on 2 August 2026, providers and deployers have faced legal duties around marking AI-generated material, detecting it and labelling certain synthetic publications. Anthropic now says future Claude models will place a hidden statistical watermark in generated text. OpenAI is combining C2PA Content Credentials, Google DeepMind’s SynthID and public verification tooling for supported media. The result is not a universal lie detector. It is the early formation of a provenance stack: a set of machine-readable signals, cryptographic records, statistical patterns and verification services designed to answer a narrower but increasingly valuable question — where did this content come from, and what happened to it on the way here?
That distinction matters. Provenance does not establish that a claim is true, that a human endorses it, or that an output is safe. It can, however, make origin and processing history less opaque. For enterprises, publishers, security teams and public institutions, this is the beginning of a new control plane for synthetic information. The organisations that treat it merely as a compliance label will miss the operational shift. The organisations that build provenance into creation, procurement, publishing and incident response will gain a measurable advantage in auditability.
1. Regulation has forced a research problem into production
The European Commission’s final Code of Practice on Transparency of AI-generated Content divides the problem into two sides. Providers are concerned with marking and detection; deployers are concerned with labelling deepfakes and certain AI-generated or manipulated text. Signing the code is voluntary, but the underlying Article 50 transparency requirements are legal obligations. The code therefore operates less like optional corporate ethics and more like a practical route towards demonstrating compliance.
This is important because the regulation does not pretend that one technical mechanism can solve provenance. Its stated standard — effective, interoperable, robust and reliable marking, as far as technically feasible — is deliberately broader than “add a watermark”. As Tech Policy Press’s analysis explains, the framework spans providers, deployers and vendors of marking or detection systems. It also leaves competent authorities, rather than vendors themselves, with the final assessment of compliance.
The practical consequence is a market-wide engineering deadline. Model laboratories must decide how signals are inserted during generation. Application providers must decide when users see a label. Platforms need a way to preserve, read and act on provenance. Publishers need editorial policies for machine-assisted work. Regulated businesses need evidence that their process performed the required checks. None of these tasks can be completed by placing an “AI-generated” badge at the bottom of a page.
The compliance burden also travels through the supply chain. An enterprise may not train a foundation model, yet it may deploy a writing assistant, transform its output, place it into a content-management system and distribute it across regions. Each hand-off can preserve, weaken or erase provenance. The governance question is therefore architectural: which system records origin, which identity signs the record, which transformations are logged, and which party is accountable when the signal disappears?
2. Text watermarking turns word choice into a keyed signal
Anthropic’s explanation of Claude’s text watermark provides a useful view of the mechanism. Language models repeatedly choose among plausible next words. A watermark can use a secret key and preceding context to influence these low-stakes choices, creating a statistical pattern across a sufficiently long passage. A detector holding the key can test whether the observed sequence is consistent with the watermarked generation process and return a likelihood.
This approach is fundamentally different from generic “AI detectors” that infer machine authorship from stylistic tendencies. A keyed watermark tests for a deliberately inserted signal. A classifier guesses from patterns it has learned. Neither should be treated as infallible, but the evidential basis is different. The watermark is closer to a machine-generated trace; the classifier is closer to a probabilistic opinion about style.
The production case is no longer purely theoretical. The peer-reviewed SynthID-Text paper in Nature describes a scheme that modifies sampling rather than model training, detects without running the underlying model and was evaluated in a live experiment involving nearly 20 million Gemini responses. Its reported benchmarks and human ratings found no change in capabilities or perceived quality. That combination — low latency, no retraining requirement and no obvious degradation — is what makes a watermark deployable at platform scale.
Yet “detectable” is not the same as “certain”. Short passages contain fewer choices from which to recover a statistical signal. Heavy editing can remove evidence. A result can indicate that a model was involved without resolving whether it drafted the whole passage, translated it, corrected its grammar or merely processed a fragment. Anthropic explicitly says a watermark does not determine ownership or authorship. This is a critical boundary for employers, schools and courts: a watermark hit is contextual evidence, not an automatic verdict about misconduct.
3. The robust design is layered, not magical
Different media fail in different ways. Images, audio and video can carry signed metadata, but platforms may strip that metadata during upload, re-encoding or format conversion. Invisible watermarks may survive some transformations, yet offer less contextual detail than a signed manifest. Free-form text cannot carry file metadata once it is copied into a message, document or web form. Visible labels are legible to people but can be cropped or omitted. This is why provenance is converging on layers rather than a single detector.
OpenAI’s provenance programme illustrates the pattern. It uses C2PA metadata and cryptographic signatures to carry creation context, SynthID as a more durable invisible signal, and verification tools that can interpret supported content. OpenAI extended its SynthID support and public verification beyond images to supported audio in July, while also introducing verification API access. Crucially, the company states that failure to detect a signal does not prove that content is authentic or human-made, because signals may have been stripped.
The underlying C2PA specification is designed to certify the source and history of media. Conceptually, this is closer to a tamper-evident chain of custody than a magic stamp. A signed manifest can say which conforming tool created or edited an asset and can reveal whether the record still validates. It cannot force every application to preserve that record, and it cannot certify the truth of the scene or statement represented by the asset.
A mature trust pipeline therefore needs at least four components: origin metadata where the format supports it; an embedded signal that may survive ordinary transformations; a verification service capable of reading both; and an audit log recording what the organisation did with the result. Human-readable disclosure sits above these machine layers. It tells the audience what matters in context, rather than exposing an opaque detector score and asking readers to interpret it.
4. Adversarial reality makes confidence management the core capability
Any provenance system deployed on the open internet will meet adversaries. Attackers can paraphrase text, translate it, combine human and machine passages, submit short samples, re-record audio, screenshot images or route content through tools that do not preserve metadata. Defenders also face benign transformations that look similar: a copy editor may rewrite a paragraph; a newsroom may resize an image; an accessibility tool may transcode audio; a content-management system may remove unfamiliar fields.
Research is moving towards more resilient semantic signals. The recent paper on Dual-Embedding Watermarking reports improved post-paraphrase detection and detectability after translation by using contextual and token-level embeddings. The authors also identify the central technical tension: surface patterns can be reverse-engineered, while semantic schemes may trade additional computation or text quality for robustness. This is an active contest, not a solved standard.
That means organisations need calibrated decisions rather than binary gates. A high-confidence provenance match from a trusted key may justify routing an asset to a specific review path. Missing metadata should trigger “origin unknown”, not “human verified”. Conflicting signals — valid signed metadata but an unexpected watermark, for example — should become a security event. Low-confidence text detection should never by itself cause an employment, academic or legal sanction.
There is also a key-management problem hiding beneath the statistics. If detector keys leak, adversaries may learn to forge or suppress signals. If only a vendor can inspect its watermark, independent scrutiny is constrained. If verification endpoints become critical infrastructure, their uptime, access controls, logging and abuse resistance matter. Provenance is therefore part cryptography, part platform governance and part security operations.
5. Enterprise AI now needs a content bill of materials
Software security teams learned that dependency inventories matter because risk can enter through components that an organisation did not write. Synthetic content creates an analogous need: a content bill of materials. For a consequential document or media asset, an enterprise should be able to identify the source model or tool, the operator or service account, the governing prompt or workflow version, human approvals, subsequent transformations and the provenance checks performed before release.
This does not require exposing private prompts or confidential data to the public. It requires maintaining an internal evidence trail and publishing an appropriate disclosure. Procurement teams should ask AI vendors whether generated outputs carry open provenance metadata, which watermark is used, what sample length is needed for reliable text detection, whether customers can access verification APIs, how false positives are measured, and what happens when an output passes through third-party software.
Publishers should preserve credentials during asset ingestion rather than discarding them during optimisation. Security teams should add provenance anomalies to incident-response playbooks. Legal and compliance teams should define when a disclosure is mandatory and when AI assistance is merely part of an ordinary production process. Data-governance teams should specify retention periods for verification logs. Product teams should design labels that communicate origin without implying truth, quality or endorsement.
The strategic prize is larger than avoiding penalties. Reliable provenance can support authorised brand content, trace manipulated executive audio, distinguish official product imagery from impersonation, document approved model use in regulated workflows and accelerate investigations after an information-security event. In a network saturated with synthetic material, the ability to produce verifiable history becomes a commercial feature.
What to watch next
- Interoperability in the wild: whether social networks, office suites, content-management systems and messaging platforms preserve and display provenance across exports and transformations.
- Text verification access: whether providers expose watermark detectors through public or enterprise APIs, and whether independent assessors can test false-positive and false-negative rates.
- Post-editing resilience: how watermarks perform after translation, summarisation, mixed authorship and routine editorial revision rather than pristine laboratory generation.
- Enforcement practice: how European authorities distinguish reasonable technical effort from inadequate marking, especially when no method satisfies every robustness requirement.
- Adversarial tooling: the arrival of watermark removal, forgery and laundering services, followed by key rotation, ensemble detection and stronger chain-of-custody controls.
- Procurement standards: whether provenance support becomes a standard line item in enterprise AI contracts, alongside privacy, security, residency and model-evaluation commitments.
The decisive shift is conceptual. The internet has spent years trying to infer whether a finished artefact “looks AI-generated”. The emerging provenance economy starts earlier, at creation, and carries evidence forward. That approach is more defensible, but only if its limits remain explicit. Watermarks can establish a statistical trace. Signed metadata can establish an asserted history. Verification services can interpret signals. None can certify reality on its own.
Trust will come from the system around the signal: open standards, protected keys, resilient transport, calibrated thresholds, transparent labels, independent evaluation and accountable human decisions. The watermark is becoming a trust layer — but it will be useful only when organisations resist turning it into a truth machine.
Sources
- Anthropic — How Claude’s text watermark works
- European Commission — Code of Practice on Transparency of AI-generated Content
- OpenAI — Advancing content provenance for a safer, more transparent AI ecosystem
- Tech Policy Press — The EU’s AI Transparency Code of Practice, Explained
- Nature — Scalable watermarking for identifying large language model outputs
- arXiv — Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings
- C2PA — Content provenance and authenticity specifications
Leave a Reply