AI watermarks explained: what they prove, and what they don't

Two mechanisms, routinely confused

When people say a piece of content is “watermarked” by AI, they could mean one of two things that work nothing alike:

• Signed metadata attached to a file — the C2PA standard, wrapped around images, video, and documents.
• A statistical pattern woven into text — embedded at the model level, living in word and token choice.

They differ in what they cover, how robust they are, and — most importantly — whether you can actually check them. Take them one at a time.

1. C2PA: signed metadata on files

C2PA (the Coalition for Content Provenance and Authenticity) is an open standard backed by Adobe, Microsoft, the BBC, camera makers, and others. It embeds a cryptographically signed manifest inside a file that records what produced it and what edited it. Because it is signed, any change to the file after signing breaks verification — which is exactly how tamper detection works.

This is the part you can verify yourself, today. Our content credential verifier reads these manifests in your browser and tells you who signed a file, when, and whether it has been altered.

2. Text watermarks: statistical, and not yet checkable

The watermark in AI-generated text is a different animal. It is a subtle bias in how the model chooses among near-equivalent words, applied at generation time. Because it lives in the text itself, it survives copy-and-paste and some editing — unlike metadata, which is gone the moment you paste into a new document.

Anthropic began applying this to Claude's output at the model level in August 2026, across its API and products. But here is the part almost everyone gets wrong: no one outside the model providers can currently read these watermarks. Anthropic has said it is working to let third parties detect them, but has not published the mechanism. Until it does, any tool claiming to “check text for AI watermarks” is not doing what it says.

What about the “invisible character” tools?

A whole category of sites will scan your text for zero-width spaces and other invisible Unicode characters and present the result as AI watermark detection. It is not. Those characters are a real thing worth cleaning up — they break formatting and can hide data — but they are not the statistical watermark providers embed. Text can be heavily watermarked with none of them present, and can contain them for entirely mundane reasons.

Our own invisible character inspector finds them and says exactly this: useful for text hygiene, useless as proof of AI authorship.

The EU AI Act, Article 50

The reason all of this arrived at once is regulation. Article 50 of the EU AI Act became enforceable on 2 August 2026. It requires providers of generative AI to mark synthetic output in a machine-readable way so it can be detected as artificially generated.

• The transparency obligations took effect 2 August 2026 and were not delayed by the Digital Omnibus, which pushed back only the high-risk deadlines.
• The machine-readable marking requirement applies from 2 December 2026 for systems already on the market before August.
• The obligation sits on the provider of the AI, not on the person using the output.

The distinction that matters most

Whether it is a C2PA manifest or a text watermark, a mark tells you a file was processed by a model. It does not tell you who authored it. Someone who wrote a paragraph themselves and ran it through a model for grammar fixes carries the same mark as someone who had the model write it outright.

Treating a mark as proof of authorship produces false accusations against people who did nothing wrong. If you are using provenance signals to judge someone's work, treat them as one input to a human review — never as a verdict.