The EU AI Act demands that AI-generated content carry markings that are "sufficiently reliable and robust." California's SB 942 goes further, requiring disclosure that is "permanent or extraordinarily difficult to remove."
A paper published in July asks the question neither law answered before passing: would this evidence actually hold up in court?
The researchers tested three major text watermarking methods against the standards US courts use to decide whether scientific evidence is admissible. The short version: the watermarks failed.
This is Part 3 of our series on the EU AI Act transparency rules. Part 1 covered what the law requires now that the August 2 deadline has passed. Part 2 covered Anthropic becoming the first major provider to watermark its output. This piece covers the problem nobody has solved yet: whether a watermark can function as proof.
What the researchers actually tested
The paper, "AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation" by Saifur Rahman Tamim and Amir Labib Khan, evaluates three watermarking methods that represent the main design families in the field: KGW, Unigram, and SynthID-Text.
If you read Part 2, that third name should look familiar. Anthropic confirmed that Claude's watermark is "a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024." The method family Anthropic adopted is one of the three the paper put on trial.
A method family is a shared recipe, not a single product. SynthID-Text is the recipe for hiding a mark inside text. Google runs its own version of that recipe, and Anthropic runs a version of it for Claude, each with private keys and private engineering. Outside researchers cannot test those private versions. What they can test is the recipe itself, in the best public copy of it that exists.
The researchers did not ask the usual question, "does the watermark get detected on average?" They asked whether watermark detection could survive the rules a judge applies to expert evidence, the Daubert standard, plus the NIST forensic process used for digital evidence. They built a scoring framework for it: twelve criteria, three mandatory gates, sixty points.
Think of it like this. A smoke detector that beeps most of the time is fine for your kitchen. A lab result that is right most of the time is not fine for a courtroom. Courts need known error rates, stable methods, and results that survive challenges. The paper tested the courtroom standard.
The results, in plain terms
The single most important attack in the study is also the gentlest one: paraphrasing. They rewrote watermarked AI text with a paraphrasing tool, keeping the meaning the same while changing the words. This matters because paraphrasing is ordinary editing. No court would call it evidence tampering.
Across 846 paraphrase runs, every single initially-detected text protected by KGW and Unigram lost its watermark. One hundred percent. SynthID-Text held on in 1.7% of cases.
Detection was already weak before anyone touched the text. Before the paraphrase attack, the methods missed 70%, 83%, and 80% of watermarked texts respectively.
The SynthID configuration had two more problems. It flagged 5.4% of paraphrased human-written text as AI-generated, which is a false accusation rate no court would accept. And 80% of its own pristine watermarked output landed in its "uncertain" zone, the score range where the detector refuses to answer.
None of the three methods satisfied more than two of the five Daubert factors.
Does this mean Claude's watermark is broken?
Here is where you have to read carefully, because this is the part that will get sloppy in most coverage of this paper.
The researchers tested the open-source MarkLLM implementation of SynthID-Text, not Google's production system and not Anthropic's version. They also tested small models, in the 1.5B to 9B parameter range. Claude is far larger. The authors say this plainly in their limitations section: they cannot speak to how the production versions would perform.
So the paper does not prove Claude's watermark fails in court. It proves something almost as important: the recipe Claude adopted, tested in its best publicly available implementation, could not produce courtroom-grade evidence at any scale tested. Nobody has published results showing the production versions clear that bar either. The reliable-and-robust promise remains untested exactly where it matters most.
There is a plausible defense, and Anthropic has already made part of it. Production systems run with more detector compute and tighter tuning than open-source reimplementations. There is a real difference between the two. The August 11 explainer was also candid about limits. It says detection answers "the likelihood this was partly written by Claude." It says the watermark works poorly on short passages. And it says the mark gets sparser on factual text, where there are fewer word choices to encode.
The summary for a business owner is short: marking is now law, the technology is real, and the evidence layer underneath it is unproven.
The timeline nobody is watching
Set the paper against the EU's own calendar and the gap gets starker.
Two words run through that calendar, and the difference between them decides who has to do what. A provider is a company that builds and supplies a generative AI system: Anthropic, Google, OpenAI, Mistral. A deployer is a business that takes someone else's AI system, uses it, and publishes what comes out. The marking duty, the watermarks this whole series is about, sits entirely on the provider side. Deployers carry a narrower duty: disclose AI involvement in the specific cases Article 50 lists, mainly deepfakes and AI-generated text published to inform the public on matters of public interest. The Commission's guidelines keep that text rule away from ordinary commerce: product descriptions, fiction, and a chatbot reply seen only by the person who asked do not count as public-interest publications. The disclosure duty for public-interest text also disappears when the text went through real human editorial review before publishing, and the bar is real: the Guidelines say spell-checking or a cursory sign-off does not count. The marking runs in one direction. The law asks the machine to announce itself. It never asks a human to prove they are human.
August 2, 2026: marking obligations entered into force. Around 190 organizations have signed the Code of Practice on Transparency, 82 under the provider section and 152 under the deployer section, and some organizations signed both. The provider section holds the names most readers know: Google, OpenAI, Microsoft, Meta, Mistral, Anthropic. Six names out of 82. The Commission's own assessment is that about half of the signatories are "small and recent companies." It does not attach headcounts to that. The EU's standard yardstick defines a small company as fewer than 50 employees, and the wider small and medium category as fewer than 250. Read past the famous names on the provider list and you find firms like Claibe ApS, CleverChain, ChronoVerify, and ContentLens.ai. They signed the same code with the same deadlines.
December 2, 2026: providers whose systems were already on the market before August 2 must finish implementing marking and detection.
February 2, 2027: providers must make their watermark-detection mechanisms interoperable, so content can be verified without running each provider's detector separately.
Penalties run up to the greater of EUR 15 million or 3% of worldwide turnover.
Read that third date again. The EU has mandated, by law, that a cross-provider verification system exist within eighteen months, while the current best evidence says the underlying detection does not yet meet evidentiary standards. The regulator is ordering the construction of an evidence infrastructure before anyone has demonstrated the evidence holds.
That is not necessarily wrong. Deadlines force investment, and the Code of Practice is how the EU pushes the industry toward shared technical answers. It does mean businesses now face legal deadlines built on technology that has not yet proven itself.
What this means for your business
If you were waiting for watermarks to solve AI content accountability, the wait just got longer and more specific.
You cannot yet prove which AI system generated a given piece of text. Anthropic's detection API is still forthcoming with no launch date. Even when it arrives, it will answer "was Claude involved," not "who wrote this," and the paper gives real reason to doubt how well detection survives ordinary editing.
If false information about your business is spreading through AI answers, watermarking gives you nothing actionable today. The provenance layer, the ability to trace content to its source and prove it later, is the piece that would actually help you, and it is the piece that does not exist.
That is before considering the interoperability problem. By February 2027, in theory, one tool could check text against every provider's watermark. Until then, each provider's mark is readable mainly by that provider.
What to do instead
Monitor what AI engines say about you directly. That work does not depend on watermarks, courts, or EU timetables, and it is available now. Your visibility in AI answers is measurable today: whether you appear, how prominently, and in what context.
Keep records. When an AI engine misstates facts about your business, save the answer, the date, the platform, and the query. That documentation is the evidence you can actually control.
Watch two dates: December 2, 2026 and February 2, 2027. Provider announcements between now and then will tell you how fast the verification layer is really moving.
The bottom line
The law now requires machines to sign their work. The signatures are real and spreading across every major provider. The ability to verify those signatures in a way that counts for anything is still a research problem, and the first rigorous courtroom-style test came back negative.
Transparency was supposed to settle the question of provenance. Instead, provenance is now the whole game, and nobody has won it yet.
*Read Part 1: [The EU AI Act's August 2 Deadline Just Passed](https://parceit.com/blog/eu-ai-act-article-50-business-content-compliance) and Part 2: [Anthropic's Watermark Arrived. Detection Is Another Story](https://parceit.com/blog/anthropic-watermark-detection-gap-small-business).*