Is AI Text Watermarked Now?

There has been a lot of click-bait posts on social media about the new EU AI Act. The usual fear based type of declarations, “something is dead”, “something just killed” remains their favorite picks. As I’m rolling my eyes, the curiosity of the frustration propelled me to look into this deeper.

What is the act?

The Article 50 of the EU AI Act requires providers of generative AI must ensure their outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated."

What does this mean?

If an AI generates an image, video, audio, or text, something has to be built into that output that flags it as machine-made. Invisible to a human reader, readable by the right software.

New systems must comply from 2 August 2026. Systems already on the market get until 2 December 2026 to retrofit. Fines go up to €15 million or 3% of global turnover.

What does it mean to be implemented?

The Act left the how it should work or the standards vague, it only states that the solutions need to be "effective, interoperable, robust and reliable". What do these 4 words mean exactly? No one knows and it’s not defined within the Act itself, only “as far as this is technically feasible”.

So "implemented" can mean anything from genuinely robust to the bare minimum enough for a legal team to sign off on.

That gap made me curious, so I dug further.

The Act was originally intended for deepfake, not text

Article 50 was never meant for text-generating chatbots. The proposal dates back to 2021, before ChatGPT existed as a consumer product. What the EU was actually responding to was deepfakes: fake video, audio, and images convincing enough to impersonate real people, feeding straight into fears about disinformation and elections.

Text got folded in later, sitting in the same sentence as "audio, image, video". That's fine in itself, technology evolves all the time, and we are at the beginning of the AI era so it’s normal for regulation to play catchup.

But it just so happens that this time, one rule was drafted around one problem and stretched over a second problem that works completely differently under the hood.

How does the tech differ: deepfake vs. text watermarking?

Let’s start with deepfakes, since that's what the Act was built for. Imagine a puzzle piece with a second image printed on it in UV-reactive ink. Under normal light it looks like any other piece. Shine a UV light on it, and a hidden picture appears. That's roughly how image, video, and audio watermarking works: extra data is embedded into the pixels or the waveform, invisible for human eye but easy for a detector that knows where to look. The technique goes back to 1990s copyright protection. The point is: there is a genuine hidden object inside the file, waiting to be found.

Text has nowhere to hide anything, there are no pixels to embed on. So text watermarking is a different invention entirely. So how is AI text generated?

A model doesn't retrieve a stored answer. It builds the reply one word at a time. At each step it calculates probabilities across its whole vocabulary: given everything written so far, maybe "cat" is 40% likely, "dog" 25%, "car" 3% for instance. It picks one, writes it down, and repeats. A whole response is just this, thousands of times in a row.

Now the watermark. Before the model decides what the next word is, all the possible candidates for that choice have already been split into Group A and Group B. The model then ranks probabilities as usual, but Group A words get a small boost. It's not forced; a strong Group B word can still win. But over hundreds of words, Group A shows up more often than chance.

The model itself is not aware any of this is happening; subconsciously, if you will. It writes the way it always writes.

The finished text reads normally. But it carries a distinctive pattern made by these two groups, and the subconscious that created the split can recognize it, rerun the same split at every word and count whether the actual words landed in Group A more than a coin flip would predict. Nothing is hidden inside any word. The pattern is the watermark.

If you've seen The Matrix, this is Neo learning to read the code. Everyone inside the simulation lives an ordinary day, no idea that green code underlies every object and every choice, at every instant. Not hidden inside things but the substrate the world is built from. Neo doesn't find a secret message. He learns to see the pattern that was governing everything all along. The reader sees a normal sentence. The detector, holding the key, reads the pattern.

Why does the difference matter?

Because the two technologies make completely different promises, while the Act treats them as the same: effective, interoperable, robust, reliable.

The deepfake side has a real anchor. Actual data sits inside the file, and as long as the file isn't stripped or degraded too far, it's still there. A durable thing you can point to.

The text side never had an object to begin with, only a bias in a sequence of choices. And I would argue that makes it much more fragile: rewrite the sentences enough, swap words, change the phrasing, and the pattern that carried the watermark is disrupted. There is nothing to strip out, because nothing was ever put in. The deepfake embed survives editing far better than that.

What are the implications?

I understand the intention behind this Act, letting people tell when content is artificial is useful and important, but the way how it’s set up is the classic case of bureaucracy. Not to mention open-source and non-EU models carry no obligation at all, so the systems easiest to misuse face no requirement.

None of that makes the regulation pointless. But is AI text watermarked now? The technical answer is: Yes. But the reality is: Right up until someone has a reason for it not to be.