The EU cooked up another dumb idea. Now it’s watermarks on AI text

I didn’t want to go to sleep without commenting on the news that Anthropic would watermark text generated by Claude — and not only in the EU: apparently worldwide. Invisible watermark in the text, C2PA-style metadata in files, and the other “good student” providers will follow because the European rule is no longer a paper: Article 50 of the AI Act applies from 2 August 2026.

The EU has cooked up another dumb idea and is forcing it on AI providers.

On paper: transparency.
In reality: weak, counterproductive, and — again — a stone in the road.

This isn’t just my take. It’s the same diagnosis doing the rounds (see e.g. Michel Levy Provençal’s thread and Ben’s, which goes straight to the technical point), and it matches what you see when you actually use these tools. At least for seven reasons:

1. C2PA isn’t the problem. Text watermarking is #

You have to separate two things the headlines mix — on purpose or out of laziness.

On files, C2PA is signed metadata, an open standard: it doesn’t touch the content. Signatures, provenance, authenticity. That’s fine. I’m not losing sleep over it.

On text, “invisible watermark” means something else: steering the next-token choice so a statistical chain becomes detectable. You don’t stick a label in the margin. You bias the generator.

That’s the trick — and the problem.

2. Mathematical trade-off: either it distorts, or it’s barely detectable #

There’s no magic. If the watermark doesn’t distort the token distribution, it becomes very hard to detect. To make it robust, you have to bias harder. Third way: none.

That’s not bar talk: it’s the design trade-off of LLM watermark schemes (detectability / robustness / quality). Stronger mark → more signal for the detector → worse output.

The worst terrain is low-entropy generation: code and maths, where the next token is almost determined. Exactly where a lot of us actually use these models. An LLM-as-judge study (WaterJudge) prefers the unmarked output in 64% to 74% of cases — even for schemes sold as “distortion-free”.

I pay for a tool so it serves my goal. If the provider permanently skews sampling for their agenda (compliance, distillation, “transparency” branding), the product is no longer the same.

3. It doesn’t work (as anti-deception) #

Rewrite two sentences, translate, cut, paste into a CMS, ask another model to “rephrase this in another tone”: the watermark is gone.

People who want to cheat already know. Spammers, deepfake mills and low-grade content farms will not pause because Anthropic signed a Code of Practice. Ctrl+C signed nothing.

If a paraphrase kills it, it isn’t a watermark. It’s a rubber stamp. And if you crank it up until it can’t be killed, you’re back at point 2: you’ve degraded the model.

4. It punishes the good students #

Anthropic will play ball. Serious providers with lawyers in Brussels will too. Opaque actors, unstamped open source, and anyone who doesn’t need to sell into the EU do not care at all.

Outcome: “marked” content is the content of people who comply. Unmarked content is not “more human” — it’s often from people outside the compliance loop.

Classic: the rule is paid for by those already in the right lane. As a bonus they also pay with worse quality in the product they do mark.

5. Absurd false positives #

Just ask Claude to proofread your email? Translate a slide? Clean up a paragraph you wrote yourself?

Congratulations: that can end up as “AI-generated content”.

The EU has resolved the line between assisted and generated with a hammer. In daily work — coding, docs, a Moodle course, a client reply — we use these models the way we use a spellchecker or an IDE. Stamping all of that as “synthetic” doesn’t inform: it pollutes the label until it means nothing.

6. It creates false security #

No watermark does not mean human.
But that is exactly what a lot of people will believe: “if it isn’t marked, it must be trustworthy.”

The opposite is true: the cleanest text may come from a local model, one that never bent to the rule, or one run through three deliberate rewrites. Absence of a watermark becomes a fake authenticity badge.

We wanted to catch deception. We’re building a new way to trust badly.

7. The law does not require this method (and it’s another burden on Europe) #

Article 50(2) does require providers to mark outputs in a machine-readable way, text included. That’s not in dispute.

But Recital 133 lists watermarks, metadata, cryptographic methods, logging, fingerprints… “or other techniques, as may be appropriate”. The law requires an outcome (reliable, interoperable marking/detection, as far as technically feasible). It does not require touching the generation process or biasing tokens.

You could go via C2PA, signatures, logging, provenance layers. Instead we get the path that puts a hand on sampling — the most invasive for the product — and on top of that, because even the Commission doesn’t believe one technique is enough, more checklists, more codes of practice, more layers.

Meanwhile the US and China ship.

The AI Act was sold as protection. On this chapter it will slow the people who comply, degrade the tool, and fail to stop the people who won’t. Stones in the road: as usual.

Bonus: some providers may like a global watermark for reasons that have nothing to do with “transparency for citizens” — for example catching distillation, when other models train hard on proprietary outputs. Fair as industrial self-defence. Almost nothing to do with the label fairy tale for a blog reader.

What we asked for and what we’ll get #

We asked for transparency.
We’ll get bureaucracy, an invisible bias in the generator, and watermarks almost nobody can read… except to hassle the people who follow the rules and worsen the code and text of whoever pays the subscription.

The sensible bit of Article 50 — if you publish with editorial responsibility, you’re the one who answers — already existed in practice: it’s called putting your name on it. Signed metadata and provenance, too. The rest — especially the watermark that touches the next token — is technical theatre for the Brussels photo op.

Well done, EU.