Yes, AI-Generated Text Can Be Watermarked

You can watermark an image. Most people accept that without much thought, because a picture holds millions of pixels and you can nudge a few thousand of them in a subtle pattern no eye will catch. But a sentence is just words, and if you change the words you change the meaning.

Personally, I had never heard of text watermarking. So I was surprised when I read the European Commission’s Code of Practice that recommends watermarking AI-generated text.

Google already watermarks the text its Gemini models produce, and the method is published. From 2 December 2026, marking generated text stops being a research curiosity and becomes a legal duty for anyone who sells a generative AI system in the EU.

If your product generates free-form text for people in the EU, that duty is partly yours, as the provider of the system, not only your model supplier’s. This article explains how text watermarking actually works, why it has a strange blind spot for short passages, and what to do if the model you build on doesn’t watermark its output.

How is a watermark hidden in words?

When a language model writes, it produces text one token at a time, a token being a word or part of a word. At each step the model has a ranked list of candidates for the next token, each with a probability. Often several candidates are almost equally good. Asked to finish “the coffee was too…”, a model might weigh “hot”, “strong” and “bitter” at similar odds.

A watermark lives in that choice.

The method Google published, called SynthID-Text, uses a secret key to score the candidate tokens, then leans the model’s selection towards the ones its key favours. Do that across a few hundred tokens and the finished text carries a faint statistical bias. It uses the key’s preferred words more often than chance would explain. The reader sees ordinary prose. The quality holds, because the model was only ever choosing between words it thought were equally appropriate.

Detection reverses the process. Run the same key over a passage, tally how often the favoured tokens appear, and compare against unmarked text.

Watermarked text identifies the model

There is no universal AI detector, because the mark is tied to a specific key. Google’s detector finds Google’s watermark. It has nothing to check OpenAI’s text against, because OpenAI’s text, if it were watermarked, would carry a different key entirely.

The Act anticipates this. Article 50(2) asks providers to make their output “detectable as artificially generated or manipulated”. The Code of Practice asks each provider to publish a free detection tool covering every technique it uses.

Why very short text gets a pass

A watermark this subtle needs room. A single sentence gives the key only a handful of choices to bias, and a handful can’t be told apart from a lucky run of common words. Make the passage longer and the signal builds until it’s unmistakable.

That is why the Code exempts free-form text under about 200 tokens, roughly 150 words. Current methods can’t watermark anything shorter with any reliability, and the Code expects that floor to drop as the technology improves. In practice, a two-line chatbot reply carries no watermark and needs none. A 1,200-word AI-drafted article does.

The mark is durable but not indestructible. Light editing may leave it intact. Running the whole passage back through another model to reword it can wash it out. Article 50(2) asks for marking that is “effective, interoperable, robust and reliable as far as this is technically feasible.” Watermarking is the best current technically feasible answer to the standard. But it is not a flawless one.

Who actually has to do this

The word watermark isn’t used in the Act. Read Article 50(2) and you’ll find that a provider’s output must be “marked in a machine-readable format and detectable as artificially generated or manipulated”, and that the technical solution has to be “effective, interoperable, robust and reliable.” Watermarking is how the Code of Practice proposes to meet that standard. The Act itself never names it. For images and video you can satisfy it with signed metadata plus a watermark. Free-form text can’t carry metadata, a raw string has nowhere to put it, so the watermark does the whole job.

The duty sits with the provider of the generative system, and it starts on 2 December 2026. The Digital Omnibus cut the original grace period from six months to three, so the marking date falls four months after the 2 August 2026 transparency deadline rather than the following year. If you build, sell or place on the market a tool that writes text, you’re the provider, and the clock runs the same whether you trained the model or wrapped someone else’s. For the full split between this marking duty and the visible labelling that deployers owe, see the Code of Practice walkthrough.

Where the model providers actually stand

Whether any of this is a problem for you depends on whether or not the model you build on watermarks its text.

Google watermarks the text Gemini generates with SynthID, and it open-sourced the underlying method in 2024, so if you self-host you can apply the same technique. That makes it the straightforward option for a provider that wants the marking done before the output reaches its own code.

In a June 2023 submission to the US National Telecommunications and Information Administration’s consultation on AI Accountability, Anthropic called text watermarking an open research problem, “fairly easy to defeat”, and not something it considered “an independently reliable accountability effort”, though it said it was open to implementing it. Anthropic still doesn’t watermark its text output.

OpenAI built a text watermarking method around 2023 that it reported as roughly 99.9% effective, then declined to release it, worried it could be defeated by paraphrasing and would push users towards competitors that didn’t mark their output. In May 2026 OpenAI joined the SynthID scheme, but for images and video, paired with C2PA metadata. Its text stays unwatermarked. A product that generates prose through the OpenAI API inherits no text watermark today, and the provider duty still lands on that product in December.

This is the gap to check first. A 20-person company selling an assistant that drafts sales emails on top of GPT has a marking obligation its model provider isn’t currently helping it meet. The same company built on Gemini is most of the way there.

What to do when your model doesn’t mark its text

You have options short of inventing your own scheme, which the Code says you don’t have to build.

Prefer a model that marks its text. If a configuration change moves the text you publish to EU users from an unwatermarked model to one that marks its output, that is the cheapest fix. Write down which model you rely on for which output.

Add the watermark yourself if you self-host. A text watermark has to go in during generation, inside the model’s token sampling, so it can’t be bolted onto finished text the way a metadata tag can. If you run an open-weight model like Llama on your own servers, this is the one case with real engineering: you wire an inference-time watermarking component into the generation step and stand up its detector. Google’s open-sourced method is a starting point.

Buy it in. Specialist marking and detection vendors can adopt the Code of Practice directly, so their tools track its requirements. For a small provider with no ML engineers, this is often the realistic route.

Share the detection. You don’t have to run a detector alone. The Code lets you rely on a model provider’s detector, a vendor’s tool, or a shared service that smaller providers join together. Whatever you rely on, record it, and check your own pipeline doesn’t strip the mark when it reformats or rewrites model output before publishing.

What to do now

1. Find out whether your text is marked. For each product that generates free-form text for EU users, check what your model provider does. Gemini, yes. OpenAI, not for text. An open-weight model you host, only if you added it.
2. Confirm you’re the provider. If you build and sell the generative system, the 2 December 2026 marking duty is yours, not only your model supplier’s. If you simply use an AI tool to make content, you’re a deployer and your job is the visible labelling instead.
3. Close the gap with the cheapest tool that works. Switch models, integrate open-source watermarking, or buy a vendor solution. Building a detector from scratch isn’t on the list.
4. Leave the short stuff alone. Under about 200 tokens there’s no watermark to apply and no duty to apply one. Spend the effort on the long-form text you publish.

The surprising part was only ever the premise that words can hold a hidden signal at all. They can, the method is public, and the marking deadline is real. What’s left is to find out whether the text your product ships already carries the mark, and to fix it where it doesn’t.