The Real Scope of AI Watermarks

I. Watermarks some years ago

I remember some years ago, in the era of the first computers, a time when some teachers would not accept a printed assignment and required you to submit it handwritten or typed on a typewriter. Those assignments could contain deep research, be correctly written, and meet every requirement, yet submitting them in print was still forbidden. In its early days, the computer aroused a suspicion that has now become normalized, as if using one automatically reduced the student’s intellectual work.

Not long ago, I wrote specifically about AI detectors and pointed out that work produced entirely by a human could be worse than work produced with the assistance of artificial intelligence, and vice versa. The same was true at school: you could write an essay by hand, but that did not guarantee it was better than work produced with a computer, regardless of the famous copy and paste.

I also remember that something similar happened years later with Photoshop, when social media filled with criticism and, in many spaces, mockery; over time, however, that too became normalized, and we learned to distinguish a color adjustment, a retouch, an artistic composition, and a manipulation.

Even so, it is relevant to note that Adobe, through Photoshop, did not invent photographic manipulation. The Metropolitan Museum of Art has documented retouching and montage techniques dating back to the 1840s; what Photoshop 1.0, released in 1990, did was make the method more accessible.

The comparison with artificial intelligence has evident limits because scale, speed, and the ability to produce convincing imitations have substantially changed the risk.

Even so, history helps us identify a reaction that repeats with each new tool: the tendency to use its name as a conclusion about the work produced.

II. Different kinds of watermarks

As with other tools, the arrival of artificial intelligence also brought different methods and tools for detecting generated content, but I consider it important to mention that each method has a different mechanism, even though the same expression is often used to categorize them regardless of the fact that many of them answer different questions.

For example, some include a visible legend that says “AI-generated” and were developed so that a person can identify it; others use an invisible watermark such as SynthID, which embeds a detectable signal in an image, audio, video, or, in certain products, text; there are also C2PA credentials, which can record information about a file’s origin and transformations; finally, an AI detector examines various patterns and produces a probability-based conclusion, even when it finds no signal placed by the system that produced the content.

It is important to understand the differences among these mechanisms because they are not equivalent, the conclusions that can be drawn are not equivalent either, and still less are they infallible, as I have already demonstrated with one of these tools. Metadata, for example, may disappear when a file is converted or through more sophisticated methods; a signal embedded in content may be lost through certain modifications; a visible label can be cropped out or copied out of context; a detector, in turn, may be right or may classify something written without assistance as artificial, or the other way around, as in the Substack publication where much of the text was generated by AI and was nevertheless labeled 100% human.

Even when the signal is authentic, as I have explained, its scope remains extremely limited. OpenAI explains, for example, that it can indicate that a certain image was generated by one of its tools, but it does not confirm the image’s accuracy, integrity, rights, or context. The C2PA standard states the limit even more clearly: it can validate the association between certain information and a file without judging whether that provenance is good or bad.

A watermark, therefore, can only answer a question about the technical creation or a certain part of the content’s process, but unfortunately it cannot answer what we really want it to answer: whether what is shown is true, whether the result has any value, and, above all, who is responsible for the content.

Knowing which tool produced something may be relevant in certain contexts, but turning that fact into a rating of the result requires reasoning that the watermark does not currently contain.

III. Do Claude and ChatGPT include watermarks?

In Claude’s case, Anthropic explains that compatible models embed an imperceptible watermark directly in text and that certain generated files add signed C2PA provenance metadata. Claude models launched in the European Union from August 2, 2026, include watermarking from launch, and the measure applies wherever those models are offered, while the company works to add it to earlier models during the transition period. It would therefore be incorrect to claim that every text produced by every version of Claude necessarily already contains that signal.

ChatGPT presents a different situation. OpenAI confirms that images generated with ChatGPT, Codex, and its API include C2PA metadata and SynthID watermarks, but, as of August 16, 2026, its public documentation does not confirm an equivalent hidden watermark in ordinary ChatGPT text. That difference shows why simply asking whether a tool “has a watermark” is insufficient, because the answer changes according to the model, the format, and the date when the content was produced.

IV. Reasons to label content

There are several relevant cases for defending content labeling: for example, a cloned voice during a call, a false image of a candidate on the eve of an election, an intimate video created without consent, false news, and so on. The speed at which this content circulates, the legal consequences, and the difficulty of reviewing every item can justify mechanisms that help establish provenance before people share it or accept it as valid.

Watermarks can also protect the human creator. C2PA, for example, is not limited to indicating the use of artificial intelligence; cameras, media outlets, and authors can record a file’s origin and part of its editing history. Therefore, when any real photograph can be dismissed with the phrase “AI made that,” verifiable provenance works in both directions.

There are also other contexts where disclosing the use of AI can legitimately change the assessment: for example, if a school is testing an individual ability, a competition prohibits certain assistance, a client commissioned an illustration under specific conditions, or a person presents an experience invented by a model as personal testimony, concealing the process may violate the rules or conditions that gave the assignment its meaning. The same is true when a legal, professional, or editorial obligation requires an explanation of how the result was obtained.

From that perspective, a watermark can provide useful information so that the recipient can make a better decision, but I believe it is important to qualify the point because the general argument that everything made with AI is badly made lacks support when the same solution is applied without considering the medium, the risk, or the degree of intervention. Generating an entire voice does not present the same problem as removing noise from a recording; inventing an editorial photograph that depicts the central thesis without introducing misleading details is different from presenting an invented photograph as documentary, and the same distinction can be made across countless examples.

V. The stigma these labels may create

I have read in several groups that people disagree with content labeling. Many have said they will stop paying for Claude because of its content watermarking, and, in legal groups in particular, the disagreement at least is not focused on transparency. Most of the lawyers I have read agree with transparency, but the problem is that many fear the label will stop informing and start discrediting the substance of the content.

A preregistered experiment with 877 participants, published in 2026, found that the labels “AI-generated” and “misleading” reduced the perceived authenticity of images; it also observed that, after viewing labeled content, unlabeled images appeared slightly more authentic.

That result does not show that we should abandon labels, but it does show that these labels change how the content as a whole is read. If the public begins to treat “unlabeled” as a synonym for true and “AI” as a synonym for false, we will have created a degree of trust that neither category deserves by itself.

In conclusion, a watermark can provide sound technical evidence in certain cases, but that label does not contain a measure of the content’s value.

VI. What the AI Act actually requires

It is necessary to study the European Union Artificial Intelligence Act to understand why claims such as “Europe requires a label on everything made with AI” are false. Article 50 contains different obligations for different subjects and situations, applicable from August 2, 2026, with certain exceptions and rules.

In general terms, providers must make certain synthetic content identifiable through a machine-readable signal; however, the rule excludes standard editing functions that do not substantially alter the data or its meaning. Those who use the systems have duties in specific situations, including deepfakes and certain texts on matters of public interest that have not undergone human review or editorial control.

This difference matters because embedding a provenance label in a file is not always the same as showing the reader a visible warning. It is equally important to determine who performs the conduct, which medium is used, and whether a person reviewed the result.

In that sense, the European regulation attempts to address risks of deception and disinformation, but it does not establish that every AI intervention makes content defective or that a label resolves its evaluation.

Additionally, I consider that this design, although it may pursue a legitimate purpose, raises several questions that can be debated: whether the exceptions are too broad, whether the signal will be interoperable, whether compliance will favor companies with more resources, or whether the public will truly understand this tool (although history may show us otherwise). I also think that a common provenance infrastructure applied to everyone would be more defensible than having each platform improvise its own label.

VII. If AlphaFold uses AI, are its results slop?

I know this question seems provocative, but it helps test the logic through which many of these issues are currently discussed. AlphaFold has made more than two hundred million protein structure predictions available to the scientific community, and its work was recognized by the Nobel Committee. OpenAI, for its part, has described research in which its models helped develop results that scientists later validated and refined. Anthropic introduced Claude Science as an environment that preserves code, artifacts, and history so that analyses can be audited.

Artificial intelligence is involved in all of those processes.

I would find it strange for someone to call a result such as those cited in the previous paragraph slop only because it was developed with the use of AI. The term, however, usually describes content produced in bulk, carelessly, repetitively, and without enough value to justify the attention it demands. Anyone can determine that some human material fits that description perfectly, while some AI-assisted results are genuinely valuable.

Origin can help explain one part of the process, but the poverty or richness of the result requires examining the result itself.

I must acknowledge that the example may not be the best one for AI-generated garbage or for the improper practices that European regulation seeks to control, but it is useful for revealing the method, because AI-assisted research is not beyond scrutiny either. AlphaFold predictions include confidence measures, and the European Bioinformatics Institute warns that low-confidence regions may depart from experimental structures. In other words, a test suggested by a model must be verified, just as an analysis requires reproducible methods. A finding that cannot be reproduced experimentally, or that does not withstand calculation or review, therefore remains insufficient and bad, even if it came from the most advanced system in the world.

Science thus provides a useful contrast because it does not stop at asking whether artificial intelligence was involved. It asks what data were used, how the result was obtained, the level of uncertainty, whether it can be reproduced, and what evidence can confirm it.

VIII. What we should demand after the watermark

I do not believe there is an easy answer to whether watermarks in artificial intelligence systems will be useful or whether they are required for all produced content, but I believe one of the profession’s most frequently used words will apply: “it depends,” because the category covers solutions and contexts that are too different. For now, however, I am more interested in asking when the information reasonably changes the recipient’s decision, how reliable the signal is, and which risk it seeks to reduce.

In media where a falsification can cause rapid harm that is difficult to repair, I consider that technical provenance and a visible warning may be necessary. In an assessment, a judicial proceeding, scientific research, or an assignment subject to rules, however, considerably more than the use of the tool may need to be explained. In trivial uses involving assistance, entertainment, and so on, the label may contribute little and predispose too much.

Thus, I consider that in most cases, after learning the provenance, almost all of the important work still remains. We must review whether the sources support what is claimed, whether the image retains its real context, whether the reasoning contains errors, whether other people’s rights were respected, and whether someone is willing to answer for what was published, because no watermark assumes that responsibility.

Perhaps public discussion has concentrated on identifying the use of the tool because that fact seems easier to obtain than the judgment that must follow, just as happened with the printed assignment and Photoshop, although the scale and risks are now different.