AI Watermarking: Why a Boring EU Code of Practice Matters

Around August 2026, the EU passed a piece of legislation: its Code of Practice on Transparency of AI-Generated Content. A super interesting and fun title.

What’s interesting here isn’t so much the legislation itself, which does sound quite boring. It’s the fact that, although this is a piece of EU legislation, the major AI model providers have decided to implement it across all of their models. In effect, that’s going to create a situation where you’ll be able to tell whether AI was used to produce a piece of content.

They’re doing this by using some clever statistics to weave watermarks into their models. As I understand it, as of September 2026 this has been implemented by Google, and the other major providers are going to come on board.

Why this matters

This opens up the possibility of services where you can submit content and be told which AI models were involved in producing it — with a degree of absolute certainty, or, if the content has been modified, a percentage confidence level.

How it works (and a common misconception)

There are a few useful resources that explain the science behind this:

• How Claude’s text watermark works – Anthropic’s own explanation
• Identifying AI-generated media online – Google’s explanation of its approach
• How AI text watermarking works: a visual guide – James Padolsey’s interactive explainer, the best one I’ve found on the underlying mechanics
• Computerphile on AI text watermarking – a good video walkthrough
• Steganography (Wikipedia) – background on the broader family of techniques for hiding information in plain sight

One misconception that’s been covered in the press is that watermarking somehow changes the probability of the output.

Remember that AI is probabilistic: it generates the next word, or token, in a sequence based on what it’s been fed. Depending on the level of randomness, it can get more creative by deviating from the highest-probability token. This video explains the basics of LLMs really well.

It’s true that early watermarking methods were designed to pick a different piece of text from that distribution. But the way it’s now been implemented in the major models doesn’t change the distribution at all. From the user’s point of view, you’ll still get the same quality of output.

What it does mean is that, because of the way it works cryptographically, the model providers themselves will be able to tell whether text was generated using their model.

The rise of aggregation services

There’s a catch: only a specific model’s provider can tell you whether text came from that model. It can’t tell you if the text was generated by another model.

That’s why I think we’ll see aggregation services springing up fairly quickly. You’ll be able to put in some content and be told which model, or combination of models, generated it, with a degree of certainty.

So what does this all mean?

A couple of things.

Some people have decided to be quite angry that this is being done at all (John Gruber’s Anthropic’s ‘Watermark’ Text Adulteration in Claude Is a Perversion of Writing is the fullest version of the critical case). It’s interesting to consider what their motivation is. Given that watermarking doesn’t materially change the output, but does show the lineage of the output that’s generated, I personally think it’s a good thing.

What’s going to be really interesting is what it means in practice. In many areas, you don’t really care whether text was AI-generated. But in areas like education, where institutions are already struggling to identify AI-written content in academic papers and student work, this is going to be significant.

Open questions and limitations

There are still problems to solve, and lots of questions that need further testing:

• AI-written vs AI-edited – It will still be hard to distinguish text that was 100% AI-written from text that was edited from AI output. For example, if you’ve used AI for your research and then taken chunks of it and edited them, how will that be flagged?
• Determined users can beat it – Running text through a rewriting tool that isn’t a large language model, and so doesn’t use watermarking, will still be possible.
• Adoption is unclear – It’s not yet clear how many of the current models will implement watermarking, or when.

My view

Overall, I think this is a positive and interesting development that doesn’t carry much risk, because it doesn’t alter the model’s output. We just need to see how it develops, and what tools are released, before drawing any further conclusions.