As of August 2, 2026, the European Union applies Article 50 of the AI Regulation. The key requirement for developers of generative systems is formulated there as: outputs must be “labeled in a machine-readable format and defined as artificially created or modified,” and the decisions must be “effective, interoperable, robust, and reliable to the extent technically feasible.” For systems released to the market before this date, there is a grace period until December 2, 2026. The fines cap is €15 million or 3% of global turnover.
With images and videos it’s clear: you can embed an imperceptible signal in the pixels plus signed metadata. Text is more interesting, and there have accumulated a good deal of confident misconceptions around it. Below are the five most common ones, and what the primary sources say: the SynthID-Text authors’ article in Nature and the texts of the regulation itself.
Article 50 is addressed to two different parties. The system developer is obliged to label the output in a machine-readable form. The one who uses the system is obliged to disclose deepfakes at the first display and label AI-generated text published “for informing the public on matters of public interest”—unless that text has undergone human editorial review and control. Spell-check by editorial review does not count.
Myth 1. “A watermark is invisible symbols in the text”
This describes one of the approaches, and the most primitive one at that: swapping a regular space for another Unicode whitespace character, inserting zero-width characters, and the like. Such a mark is removed by normalizing the string—with one command.
The approach around which regulatory discussion centers works quite differently: it doesn’t add anything to the text. It changes which tokens the model chooses when generating.
In the SynthID-Text scheme, it looks like this. At each generation step, from the last H = 4 tokens and a secret key a seed is produced. The seed defines a set of pseudorandom functions g1…g30—defaulting to thirty layers. Candidates are drawn from the model’s distribution, split into pairs, and a tournament is played: in each layer of the pair, the token with the higher g value for its layer wins. The winner of the last layer ends up in the text.
There is no literal “watermark” in the text—there is a statistical skew toward tokens that win the tournament by the key. Reading it with the naked eye is not possible in principle.
Big providers occasionally write about homoglyphs and invisible characters in blogs—for example, in Shaun Godaoke’s July 2, 2026 analysis about OpenAI and Anthropic. Confirmations from the companies themselves could not be found; there are no official statements on this. Consider this an unverified observation rather than a fact.
Myth 2. “Such token substitution will ruin the text”
Intuitively, it seems that if you forbid models from choosing the best token, quality will drop. The authors of SynthID-Text tested this at a scale hard to dispute: about 20 million Gemini responses, some with a watermark, some without.
User-rated differences: the share of “up-thumb” ratings differed by 0.01% (in favor of the watermarked version), the share of “down-thumb” by 0.02% (also in favor of the watermarked version). Both differences are statistically insignificant and fall within 95% confidence intervals. They also manually evaluated 3,000 answers across five criteria—grammar, relevance, correctness, usefulness, overall impression—with no meaningful differences.
The computational cost is also small: 15.527 ms per token without the mark versus 15.615 ms with the mark on Gemma 7B-IT, i.e., +0.57% delay across thirty layers.
So this myth is indeed a myth. The published measures do not show a notable hit to quality.
Myth 3. “To verify text, you need access to the model”
No. The detector needs only the text itself (in tokenized form) and the key. It recomputes the average g-values across all tokens and all layers and compares to a threshold. The model, its weights, and its API are not required—making the scheme suitable for external verification.
From this, however, arises the first practical problem: the key. As long as it is secret, only the model owner can verify the text. As soon as the key becomes accessible for “compatibility” (which the regulation also demands), the mark becomes both forgeable and removable.
The requirement “effective, interoperable” and the model’s security “the mark rests on the secrecy of the key” pull in opposite directions. This is not a picky wording issue—it’s a structural contradiction, and the primary sources do not resolve it technically or regulatorily.
Myth 4. “Short text is enough to identify”
The Nature article figures are quite sobering for non-misleading cases. For an undistorted variant on Gemma 7B-IT at temperature 0.7, text length of 200 tokens yields about 90% detection with 1% false positives. Two hundred tokens are roughly 700–900 characters, about three or four paragraphs.
Things get worse for shorter texts. The watermark’s reliability grows with longer text and declines with lower entropy in the distribution. For short answers, factual questions with a single correct answer, code, or bullet lists—areas where the model has very few token choices—the watermark has nowhere to go. That’s why the regulation excludes short character sequences and source code from the labeling requirement.
One percent false positives sounds small until you check a thousand student papers. That’s ten people accused of nothing. And that’s the laboratory detector’s accuracy on its own mark—not those commercial “AI-text detectors” that guess by perplexity and have no key or model statistics. Those detectors don’t publish any verifiable accuracy, and you shouldn’t rely on their judgments when making decisions about people.
Myth 5. “If the mark is embedded, you can’t remove it”
It can be removed, and the authors admit this explicitly: watermarks of this type “weaken with edits to the text, for example paraphrasing with a language model.” Then comes the caveat—“although this usually noticeably changes the text”—but for practice it’s of little use: running your text through another model, even a weaker one, with the instruction “rewrite” takes seconds and costs next to nothing. Reversing the process works the same.
In the same vein, the authors list unresolved questions: watermark theft, watermark forgery (when someone attributes a watermark to another person’s text), and the impossibility of forcing open-source model developers to comply. Weights that can be downloaded and run locally do not have to perform any tournament selection—and that is what much of self-hosted AI relies on, for which there was a separate topic on local LLMs with an OpenAI-compatible API.
What follows from this
Labeling AI text is not a proof mechanism but a hygiene mechanism. It works well against a lazy mass of content: millions of generated reviews, comments, and SEO texts that no one will rephrase will actually become distinguishable. It does not work against someone who intentionally bypasses it: a single pass through another model—and there is no mark.
A practical takeaway for those on this side: do not build processes on the assumption that you can technically determine the origin of text. Neither “the detector showed 87% AI” nor the absence of a mark alone proves a person wrote it. But the fact that the EU now requires markings for materials published “to inform the public” if they were not read by a human deserves serious consideration—the responsibility here lies with the publisher.A side story about how fragile technical guarantees around model outputs can be, discussed in the topic about uncovering encrypted reasoning blocks.
Sources
- Dathathri et al. Scalable watermarking for identifying large language model outputs — Nature 634, 818–823 (October 23, 2024) — setup of a tournament sampling, quality measurements on 20 million responses, detection metrics, acknowledged author-imposed limitations
- Article 50 of the EU Regulation on AI — full text — formulations about the obligations of providers and applying parties
- European Commission: FAQ on transparency obligations under Article 50 — effective date, postponed until December 2, 2026, exemptions, penalties
- Sean Goedecke. Text AI watermarks will always be trivial to remove (July 2, 2026) — critical analysis; claims about homoglyphs at specific companies are not independently verified
A practical question for those who run local models: if the requirement for labeling eventually reaches open weights, what will it morph into — a field in the config that everyone will disable first, or a responsibility for platforms to check uploaded content? And has anyone encountered a reasonable AI-text detector with published accuracy in practice?