Watermarks in AI Text: What They Prove and What They Don't

Andrew Maryasov, AI consultant, founder of Auspex and Grow2.ai. This breakdown is for anyone who has the words “AI detector” in the editorial team’s KPIs or in a contractor brief, and for the lawyer who has to sign off on the compliance page. Conversations about “AI wrote this text” lump three different mechanisms together: the provider’s watermark — a statistical trace in token selection that proves to whoever holds the detector that the text came from a specific model; the AI detector — a third-party guessing tool that proves nothing and is systematically wrong about texts by non-native speakers; and C2PA provenance — a publisher’s cryptographic signature that proves who signed the file but deliberately passes no judgment on whether the content is true. The obligation that took effect in the EU on 2 August 2026 is lifted by human review and a named responsible person, not by scrubbing AI traces.

TL;DR (in 30 seconds)

• A watermark proves origin, not authorship. SynthID Text embeds a signal in token selection; detection is probabilistic and has three states, including “uncertain.” There is no public verification route for text.
• Translation sharply reduces detector confidence — that is written in Google’s documentation. It directly affects teams that write in Ukrainian and translate into English.
• Even their own makers have shut AI detectors down. OpenAI discontinued its own classifier, which correctly identified 26% of AI text and produced 9% false positives on human text.
• Detectors are biased against non-native speakers: more than half of the texts by non-native authors were flagged as AI, while accuracy on native speakers was near-perfect.
• C2PA explicitly declines to judge truth. It confirms that the data hasn’t been tampered with and that the signer is known — not that what’s written is accurate.
• Article 50(4) of the AI Act has its own exception: the disclosure obligation doesn’t apply if the content has undergone human review and someone holds editorial responsibility. At the same time, 50(4) itself covers text on matters of public interest — a product blog or a newsletter doesn’t automatically fall under it.

The provider’s answer changed within two weeks

On 5 August 2026 a developer from the EU asked a very specific question on Google’s official forum: does the text returned by the Gemini API carry a watermark? The question was a practical one — they needed to meet the requirement of Article 50(2) of the AI Act in their own game. That same day a Google representative replied that it doesn’t, and that native text watermarking isn’t planned.

On 19 August the same representative came back to the thread with “an important correction”: after checking further with the team, it turned out that text from the Gemini API is SynthID-watermarked after all. The follow-up questions from other participants in the thread — had the watermark always been applied or was it introduced at some point, and what tool can verify it — remain unanswered as of October 2026. The documentation still says nothing about it.

You can’t rest a compliance page on a forum answer, in either its first version or its second. If official support gives opposite answers about its own product twice in two weeks, the watermark is a property you learn about through hearsay. You don’t build processes on that.

Three mechanisms that aren’t interchangeable

Mechanism	Who applies it	What it technically proves	What it doesn’t prove
Watermark (SynthID Text)	The model provider, during generation	That the text comes from a specific model — to whoever holds the detector	That you’ll be able to verify it
AI detector (third-party)	No one; it’s after-the-fact analysis	Nothing. It’s a statistical guess about style	Neither origin nor authorship
C2PA / Content Credentials	The publisher, by signing the file	Who signed it and that the data hasn’t changed since signing	That the content is true

The difference isn’t a matter of terminology. These three things answer three different questions, and a business usually wants the answer to a fourth: “Can I stand behind this?” None of the three answers it.

The watermark: what it can and can’t do

SynthID Text isn’t a label appended to the text, and it isn’t a metadata record. During generation it shifts token probabilities according to a pseudorandom function: the model picks slightly different words than it would have without it, in a way that lets the shift be detected statistically later without noticeably degrading the text. The method is described in a Nature paper (Dathathri, See et al., 23 October 2024), and Google has open-sourced the implementation.

The limitations that are visible in the documentation and almost never make it into the summaries matter more than the method itself.

Factual text is exactly where the watermark works worst. The documentation says so directly: on factual responses there is less room to vary the wording without hurting accuracy. The closer a text is to a dry fact sheet, the weaker the signal — and that is exactly the type of content businesses generate most often.

Translation throws the detector off. Confidence drops sharply if the text has been thoroughly rewritten or translated into another language; robustness holds only against cropping pieces of text, changing a few words and mild paraphrasing. For the typical cycle of “draft in Ukrainian, then an English version on LinkedIn,” this means that after translation you can no longer rely on the watermark.

The provider decides who can verify. There are three modes: a fully private detector, a semi-private one exposed through an API, and a public one. For text there is no public route today. So even if a watermark was embedded in your text, you aren’t the one who can show it.

A watermark is the provider’s tool for the provider. It works in a dispute where one of the parties owns the detector, and it gives you, as a publisher, no way to prove anything about your own content.

AI detectors: the only one of the three that proves nothing

A detector is often seen as a lightweight version of a watermark. The two have nothing in common: a watermark looks for a signal that was deliberately put there, while a detector looks at finished text and guesses from its style.

OpenAI shut its own down. The AI Text Classifier was launched in January 2023 and discontinued on 20 July of the same year, citing low accuracy. The company published the numbers itself: on an English-language “challenge set,” the classifier correctly identified 26% of AI-written texts and incorrectly labeled human-written text as AI in 9% of cases. Nine percent false positives means one in every eleven texts written by a human.

The second part of the problem hits Ukrainian teams squarely. A Stanford University study published in the journal Patterns in 2023 ran texts by native and non-native English speakers through seven widely used detectors. The detectors classified more than half of the samples written by non-native speakers as AI-generated, while accuracy on native speakers’ texts was near-perfect. The authors showed the mechanism too: detectors react to a poorer vocabulary and simpler syntax, and enriching the vocabulary reduced the share of false positives. The same paper covers reliability from the other side: simple instructions to the model were enough to get around these detectors.

The tool systematically penalizes those who write in a second language and lets through those who deliberately evade it.

Both the study and the classifier’s shutdown date from 2023; today’s vendors claim higher accuracy. But those are the sellers’ own claims: as of September 2026, I couldn’t find a peer-reviewed test that refutes the effect on non-native speakers. Until one exists, a detector’s verdict remains a guess, and you can’t base HR or editorial decisions on it. It’s the same kind of mistake as with the evasion metric for agent monitoring: the number exists and looks convincing, but it answers a different question from the one you’re asking.

C2PA: it proves the signer, not the truth

C2PA (Coalition for Content Provenance and Authenticity) comes at it from the other side. Instead of looking for traces in the text, it attaches a signed manifest to the file — a Content Credential: who created it, what it was edited with, what was made from what. The specification isn’t limited to images: text/plain is among the formats a manifest can declare.

The consortium’s own explainer says it directly: Content Credentials do not provide value judgments about whether a given set of provenance data is “true” — they only confirm that the information is well-formed, free from tampering and signed by someone on a known trust list.

A forged report with a flawless C2PA manifest is still a forged report — it’s just that now you know exactly who signed it. That doesn’t make the mechanism useless: C2PA moves the conversation from “did AI write this?” to “who is responsible for it?” — and the answer to the second question can be verified.

What the law actually requires

Article 50 of the AI Act applies from 2 August 2026.

Article 50(2) — the provider’s obligation. Providers of systems that generate synthetic audio, image, video or text must ensure that the outputs are marked in a machine-readable format and detectable as AI-generated. Then comes the caveat where the weakness of text watermarking lives: the solutions must be effective and reliable “as far as this is technically feasible,” taking into account the limitations of various types of content, the costs of implementation and the state of the art. The same paragraph has an exception that is usually forgotten: the obligation doesn’t apply where AI performs an assistive function for standard editing or doesn’t substantially alter the input data or its semantics. Spell-checking or rephrasing a paragraph doesn’t require machine-readable marking.

Article 50(4) — the obligation of whoever publishes. Those who use AI to generate or alter text published with the purpose of informing the public on matters of public interest must disclose that the text has been artificially generated or altered. And an exception follows immediately: the obligation does not apply if the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication. The regulation spells out the condition under which no labeling is needed, and that condition isn’t scrubbing AI style, “humanizing” the text or passing a detector.

On the transition period: Regulation (EU) 2026/1744 (Digital Omnibus on AI) was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026; it added Article 111(4) to the AI Act — systems placed on the market before 2 August 2026 must be brought into compliance with Article 50(2) by 2 December 2026. That grace period doesn’t cover systems placed on the market after 2 August, and Article 50(2) itself was not postponed.

What to do about it

Stop measuring what can’t be measured. Running your own text through a detector before publication gives you no information. It gives you a number that will be worse for your non-native copywriter than for a native speaker, whether or not AI wrote anything there. If this metric is in your KPIs, take it out; and for the same reason, don’t promise a client “text with no AI traces.”

Record who read it. The exception in 50(4) sounds like bureaucracy, but it describes ordinary editorial work that most teams already do and simply haven’t documented: the editor’s name next to the piece, the date of the last check, saved links to the sources behind every figure. The difference between “our editor takes a look” and “we have editorial responsibility” is ten minutes spent writing down who exactly looked.

Keep a source log, not a prompt log. When a complaint lands, the question will be “where does this figure come from?” You won’t be able to prove which model the text came from; you will be able to prove the source, if the link has been saved.

Ask your provider about watermarking status in writing. From the documentation or from an account manager, with a date. The Gemini API story shows what a verbal answer is worth.

The logic is the same as in system prompt security: what protects you is a mechanism you can verify and show, not one that looks like protection. And just as with llms.txt, more expectations have grown up around a technical marker than it can bear.

The question “did AI write this?” is gradually losing its meaning: there is no reliable answer to it, and there won’t be. The question “who checked the facts, and who is accountable if they’re wrong?” always has one.

FAQ

Can you check whether a text carries a SynthID watermark?

There is no public tool for text. Google describes three models of access to the detector — fully private, semi-private via an API, and public — and the provider makes the choice. The published SynthID verification routes accept images, video and audio.

Is a business required to label AI content in the EU?

Article 50 of the AI Act has applied since 2 August 2026. Providers of generative systems must make sure the output carries a machine-readable mark (50(2)). Those who publish AI text on matters of public interest must disclose it (50(4)) — but not when the content has undergone human review or editorial control and there is a person with editorial responsibility for the publication.

Is a “created with AI” note enough?

For the Article 50(4) case, the regulation offers an alternative: human review plus a named person responsible for the publication lifts the disclosure obligation. For system providers under 50(2), a visible note doesn’t replace the machine-readable mark — these are different requirements for different actors.

What should you do if a client demands a guarantee that the text will pass an AI detector?

No such guarantee can be given honestly: a detector’s result is unstable and depends on the author’s language more than on how the text was produced. Offer what can be verified instead — checked sources, named authorship and editorial responsibility for the facts.

---

Published by Andrew Maryasov, AI consultant, founder of Auspex and Grow2.ai; implementations are run by Auspex (CRM) and Grow2.ai (AI agents).

Sources:

• Google AI for Developers — SynthID: Tools for watermarking and detecting LLM-generated Text (documentation, updated 9 April 2025)
• Dathathri S., See A., Ghaisas S. et al. “Scalable watermarking for identifying large language model outputs”, Nature, 23 October 2024
• Thread on text watermarking in the Gemini API, official Google AI Developers forum, 5–19 August 2026
• OpenAI — New AI classifier for indicating AI-written text (January 2023, with a note on its discontinuation in July 2023)
• Liang W., Yuksekgonul M., Mao Y., Wu E., Zou J. “GPT detectors are biased against non-native English writers”, Patterns 4(7):100779, Stanford University, 2023
• C2PA — Content Credentials Explainer 2.3, §2 (the source of the quote about the absence of value judgments) and the technical specification 2.3 (where text/plain is among the manifest formats)
• Regulation (EU) 2024/1689 (AI Act), Article 50; European Commission guidelines on transparency obligations
• Regulation (EU) 2026/1744, published in the OJ on 24 July 2026, in force since 27 July 2026 (Digital Omnibus on AI) — Article 111(4) of the AI Act and the transition period until 2 December 2026 for systems placed on the market before 2 August 2026