Article 50 of the EU AI Act, and what it means for you

AI models have already started putting invisible watermarks into the content they write. So, if you use AI to write stuff for you, re-structure your own writing, or even just use it to correct your grammar, then you will likely want to know how this may affect you!

The watermarking will apply everywhere, not just in Europe. And it will be baked into the models themselves, not just the tools which wrap around them. For example, Anthropic adds its watermarks whether you’re using the Claude website, desktop app, API, extensions like Claude Code, or running its models in cloud environments, like AWS (Amazon Web Services). And, because the law will expect every provider to do this, we can expect the likes of ChatGPT and Perplexity to follow suit.

New models, released from 2 August 2026 onwards already have it built in. Older models are currently being retrofitted, with a deadline of 2 December 2026. This transition period was granted in the EU’s AI Omnibus agreement of May 2026, for models which were already on the market. So, at some point, it will be unavoidable, at least with the most popular models.

In this post, I’ll share my research and understanding around the introduction of Article 50 of the European Union AI Act, and what it might mean for people who use AI.

Caveat

This post is about legislation, and I am not a lawyer! This blog post is my interpretation of Article 50, and, as diligent as I am when researching these things, my interpretation may not align with that of a professional lawyer.

Feel free to check my work using the official act, Regulation (EU) 2024/1689. Or, if you need serious legal advice about the European AI Act, then you really need to speak to an actual legal professional.

Transparency is important

The reason why a lot of people may be concerned about the introduction of this, is that a lot of people are using AI! But a lot of people are just not disclosing that this is what they’re doing! I’ve touched on this topic before in my post ChatGPT: Everybody’s dirty secret.

As somebody with ADHD and a chaotic brain, when writing blog posts or documentation, I have a tendency to go off topic or down rabbit holes. I end up on enough tangents and with enough content that the blog post feels bloated, and it’s not always clear what point I’m trying to make.

Also, this process is exhausting. What starts out as a blog post which should take a couple of hours to write can take me days or weeks to get something into a state where I’m happy with it. If you want a glimpse into the chaos of my brain, looking at my drafts folder, I currently have 34 part-written blog posts. Some have been part-written for so long that I’ll probably never publish them, because the stuff I wrote is unlikely to still be relevant or interesting.

So, for full transparency, these days, I regularly use Anthropic Claude, to help me split, re-structure and proofread my writing, and this post is no exception.

What is invisible watermarking?

There are two main approaches to invisible watermarking that will be implemented by language model providers. Text and image watermarking, and file labelling.

However, the Act does not mandate the use of a specific technique. Recital 133 lists the options it considers acceptable, and both of the approaches I’m going to cover below are named in it:

Such techniques and methods should be sufficiently reliable, interoperable, effective and robust as far as this is technically feasible… such as watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques.

When you hear somebody talking about an “invisible watermark in text”, it’s not clear exactly what this means. Does it mean there are non-visible but detectable hidden characters? For example, you could add zero-width spaces. Or, you could use special Unicode characters, which look exactly like others, but carry a different Unicode ID. Both of these would not be visible to the human eye, but would be easily detectable by a machine.

If you’re like me, and you grew up in the 90’s, then you may already be familiar with this as a method. Teachers, who were often less tech savvy than us millennial kids, would set homework with a minimum character count. Then, they’d use the “character count” tool built into Microsoft Word to check you had done as you were told, as the character count tool would count any character that was not whitespace.

However, as these were the days before dark-mode existed, we’d all just stuff a white “H” character between the words, as it was roughly the same width as a space. The teacher couldn’t see the white character against the white background, so visually your work looked fine, but the H was easily detected by the character count as a non-whitespace character, and artificially bumped your character count over the required threshold.

So, if us pesky kids in the 90’s could easily beat the system, it’s obviously not a very good method, and would be beaten these days by a simple find and replace, or a script that could remove the watermark in seconds. So, that is not how it will work. Instead, it will be cleverly encoded in the text generated by any language model.

Fingerprinting

Under the hood, language models are just big number crunchers. They write one word at a time based on statistical probability. At every step, there are usually several words it could choose from that would make sense in the current context. For example, “difficult”, “challenging”, or “hard”.

The watermark will lean on this statistical choice. Where several options are near enough identical in meaning, each model usually favours one over the other. This has historically been a natural choice due to the model’s training data. This has been known for a while, it’s called a “fingerprint”, and like humans, different LLMs have different fingerprints.

You can’t see a fingerprint, but you can sometimes feel it. It’s like reading a text message from your husband or wife. You know their writing so well, that you could easily pick their message out from 10 others, even if they were anonymised. Because, you intuitively recognise their preferred words, grammar structures and their choice of emojis.

However, although these fingerprints have historically been something which just happened naturally in each model, they will now be deliberately nudged towards particular words when given a choice, which will be defined by a secret watermarking algorithm.

When this secret nudge is applied to hundreds of words, and these word choices show up consistently hundreds of times in a single piece of writing, then this pattern becomes measurable. And, it will be measured using the tool built by the model provider, because they know exactly what to look for. This should then be able to tell you with some confidence, that the text was generated by AI.

I think it’s important to note that when I say “with some confidence”, I mean, detection is still statistical. Like the model itself, it’s a probability score. It can never be a binary yes or no, because only the author truly knows how much of it they wrote themselves.

This fingerprinting can also be applied to images. Because coloured pixels are essentially data, when the model generates an image, it can encode a particular series of pixels to be an exact known colour value. Then, when analysing the image, the tool can triangulate all of these pixels to know if the image was generated by AI. Or, it can triangulate some of those pixels to be able to say with some level of certainty that it’s a generated photo which has since been edited using other tools. Google Gemini has this type of image fingerprinting.

There have been third party tools available for a long time to try and detect these fingerprints, but this is the first time that the companies who ship the models are also responsible for enabling detection. Article 50 requires their outputs to be “detectable as artificially generated”, and the Code of Practice for AI generated content that providers like Anthropic have signed, commits them to shipping detection tools along with their models.

Most model providers have not published exactly how their version will work. So, I want to be clear that the mechanism above is just a general approach, not necessarily an on-point description of exactly how it will work in every model. If we look at what Anthropic has said, they say the watermark is part of the text itself, not metadata. It survives copy and paste, and that it “may persist through some editing”.

File labelling

The second type of watermark is a label on files. This means that if a language model generates an image, like a .png, .jpeg, or .svg, it attaches an identifier somewhere to the file to say where it came from. This is metadata.

The record is signed using a key, the same way as software updates are signed so you know what you’re getting. This means you should be able to tell if someone has tampered with it. This is a standard already used called C2PA, and it’s the same idea as the “edited in Photoshop” label we’d look for as an indication that something had been tampered with, back in the day!

However, file labels are fragile at best, and useless at worst. If we take a screenshot of the photo, convert the format using an image editor, or upload it to most content delivery networks, most of the time the label is stripped from the metadata. So, I imagine file labelling will very much be a secondary method, used as an easy win for detection, with low computational effort.

Interestingly, the Act itself acknowledges that these methods have limits. Because, Article 50(2) only holds providers to what is technically feasible:

Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art.

What can a watermark tell you?

A watermark says that some of the text was likely processed by a language model. That’s pretty much it!

It does not say that a language model authored the entire thing, that the person who wrote it is a fraud, or that the entire piece of writing should be discredited.

For example, say you paste your own writing into Claude, ask it to fix your grammar and add headings to break up the content. What you get back is now likely going to be watermarked. But, your ideas, the argument you make, and the structure you used are still yours.

A detected mark tells you that the content may have been processed by Claude. It does not, on its own, confirm the full provenance of the content.

A lack of a watermark also does not tell you much. No watermark does not necessarily mean no AI has been used. If you re-write something heavily enough, the fingerprint degrades. Because, you have likely replaced the preferred word choices that the model and the detection method leans on. Also, short paragraphs may not contain enough words to test on. And, anything generated by an older model may never leave any fingerprints at all.

Also, we’re in a bit of a weird situation right now, where these watermarks can’t actually tell us anything! Because, nobody outside of the organisations that build the models can actually check for it accurately. The fingerprints are already embedded, but the detection tooling they are creating has not yet been released to the public.

Do I have to declare my use of AI?

When it comes to declaring our use of AI, I think transparency is important. I believe we should declare our use of AI, but I can understand why this may not be a very popular opinion.

However, what I believe we should do, and what the law says we must do, may not be totally aligned.

When it comes to the EU AI Act, the need to declare the use of AI falls into two camps, and it is important not to confuse one with the other.

The responsibility of the watermarking itself lands entirely on the organisation who owns the model. They built it, they profit from it, so they carry the burden of watermarking the content that it creates. As a user of the model, there is nothing for you to do. It is happening already, whether you’re conscious of it or not.

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.

The other half of the responsibility lands on the deployer of the AI system. This is you, or your organisation. It’s the people who make the tool available to use, and those who are using it and publishing that content.

If you publish AI generated content, with the purpose of informing people on matters of public interest, then you must say so.

Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated.

That sounds a bit vague, and very broad, until you read the exception:

This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.

So, on your own website, that person is you. You’re responsible for editing and publishing it. You’re also responsible for your own reputation if what you published is trash. So, you shoulder that responsibility if anything comes back your way from that generated content.

This is likely the way most of us are working already. We use a language model to help us structure our ideas, not to think for us. It looks like anything a human edits, and a human publishes, falls outside of that labelling duty.

What about the UK?

The EU AI Act is not UK law. But, that does not mean we are exempt from it.

The Act applies to anyone whose AI output is consumed inside the EU, wherever they are based. This is referenced in Article 2, which says the Act applies to:

providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union

The Commission takes a broad stance on what “used in the Union” means. As I’ve interpreted it, publishing in the open on the internet will count, even if you are not specifically targeting European countries.

Post-Brexit we are considered a third country with no special treatment, sitting alongside the US and everyone else. So, in principle it will apply to a personal site in the UK. But, in practice, the exception for human-edited content is the thing to lean into, not your geographical location.

What am I going to do about it?

Nothing, really. I’ve never been secretive about my use of AI. I view it as a tool to help me articulate my thoughts and ideas with more clarity and structure. Not to manipulate people, spread disinformation, or to give a false impression of my abilities.

Final thoughts

In my opinion, if you write for a living, for an employer, or even just for yourself, your focus should not be on trying to use language models whilst avoiding detection, because it’s unlikely you’ll be able to beat the system.

Instead, focus on transparency, explaining clearly how you use AI in your writing. Because, a watermark cannot answer this question, it can only provide somebody with a probability score of how likely it was that an AI tool was used somewhere in the process.

A probability score without an explanation is more likely to erode trust in you and your writing, because people will make up their own conclusions. If you’re transparent about how you use AI in your work, then it doesn’t really matter if it contains detectable watermarks.

What do you think? Is honesty the best policy?

As always, thanks for making it to the end.
Craig